Skip to main content
Information Security

Return to Answer

added more relevant text
Source Link
Polynomial
Polynomial
  • 135.8k
  • 44
  • 309
  • 383

The diagram in the page you linked demonstrates the functionality quite well. The idea is that the authentication mechanisms are all capable of decrypting the Volume Master Key (VMK), which then in turn can unlock the Full Volume Encryption Key (FVEK).

The idea behind this is that, if any of the individual authentication parts are compromised, the VMK can be changed without having the re-encrypt all of the data on the disk. Essentially, you can just change the VMK and re-encrypt the FVEK with it.

BitLocker itself does not provide any functionality to change the FVEK, as it would require decrypting and re-encrypting the entire volume. The only way to re-key appears to be to fully decrypt the volume and re-encrypt it.

Changing the VMK, however, is certainly possible. When BitLocker is put into disabled mode, the VMK is encrypted with a randomly generated surrogate key, which is stored in cleartext on the disk during this time. As the VMK is essentially not protected during this time, BitLocker automatically generates a new VMK after it is enabled again.

The diagram in the page you linked demonstrates the functionality quite well. The idea is that the authentication mechanisms are all capable of decrypting the Volume Master Key (VMK), which then in turn can unlock the Full Volume Encryption Key (FVEK).

The idea behind this is that, if any of the individual authentication parts are compromised, the VMK can be changed without having the re-encrypt all of the data on the disk. Essentially, you can just change the VMK and re-encrypt the FVEK with it.

BitLocker itself does not provide any functionality to change the FVEK, as it would require decrypting and re-encrypting the entire volume. The only way to re-key appears to be to fully decrypt the volume and re-encrypt it.

The diagram in the page you linked demonstrates the functionality quite well. The idea is that the authentication mechanisms are all capable of decrypting the Volume Master Key (VMK), which then in turn can unlock the Full Volume Encryption Key (FVEK).

The idea behind this is that, if any of the individual authentication parts are compromised, the VMK can be changed without having the re-encrypt all of the data on the disk. Essentially, you can just change the VMK and re-encrypt the FVEK with it.

BitLocker itself does not provide any functionality to change the FVEK, as it would require decrypting and re-encrypting the entire volume. The only way to re-key appears to be to fully decrypt the volume and re-encrypt it.

Changing the VMK, however, is certainly possible. When BitLocker is put into disabled mode, the VMK is encrypted with a randomly generated surrogate key, which is stored in cleartext on the disk during this time. As the VMK is essentially not protected during this time, BitLocker automatically generates a new VMK after it is enabled again.

Source Link
Polynomial
Polynomial
  • 135.8k
  • 44
  • 309
  • 383

The diagram in the page you linked demonstrates the functionality quite well. The idea is that the authentication mechanisms are all capable of decrypting the Volume Master Key (VMK), which then in turn can unlock the Full Volume Encryption Key (FVEK).

The idea behind this is that, if any of the individual authentication parts are compromised, the VMK can be changed without having the re-encrypt all of the data on the disk. Essentially, you can just change the VMK and re-encrypt the FVEK with it.

BitLocker itself does not provide any functionality to change the FVEK, as it would require decrypting and re-encrypting the entire volume. The only way to re-key appears to be to fully decrypt the volume and re-encrypt it.