Skip to main content
Source Link
Shuzheng
  • 1.3k
  • 6
  • 28
  • 42

What is the purpose of the Volume Master Key in BitLocker?

From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive:

  • Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and stored on-disk)
  • Volume Master Key (VMK) (encrypted by a key protector and stored on-disk)
  • Key Protector (KP) (TPM or numerical password)

I don't understand what security value the VMK provides. Why not just encrypt the FVEK directly using KPs?

In any case, if a KP leaks, the FVEK can be obtained anyway?