Safety level of encrypting data with BitLocker?

Question

Is it kind of impossible to decrypt data that is encrypted by BitLocker and data will be safe enough if my computer was stolen?

Answer 1

In theory as long as you keep the encryption key separate from your device and it is not stolen also you should be fine. However not so long ago a security researcher found a way to bypass bitlocker altogether on domain joined devices. The biggest problem with encryption is not the algorithms but the implementation. Since Bitlocker isn't open source it has never been audited by the community so we can't know if there are more "accidental" backdoors. You could say that bitlocker is good enough and if someone does steal your device it's probably not going to be the NSA. I'd rather go with open source solutions that have been verified by the community such as veracypt (the replacement of truecrypt) for instance. Here is a very good read on the whole topic.

Answer 2

Igor Liv's answer elsewhere on this page addresses BitLocker specifically. My answer will instead address BitLocker simply as an example of full disk encryption (FDE). In other words, my points below should be applicable to other conventional FDE software packages, such as TrueCrypt.

Is it kind of impossible to decrypt data that is encrypted by BitLocker?

No, it is not impossible. Anyone who has the decryption key should able to decrypt data encrypted by BitLocker. BitLocker would not be useful otherwise.

Additionally, there is a risk that BitLocker's design or implementation has a weakness: either an intentional weakness ("backdoor") or an unintentional weakness (bug). Such weaknesses broadly divide into two categories: shortcomings in the implementation of the cryptographic algorithms themselves, or the presence of side-channels. (Here is a discussion of one potential side channel, relating to SSD wear-levelling.) Opening the source code for the software, and having that code audited by trusted professionals, reduces the risk of such a weakness; but it is hard to eliminate such a weakness altogether, short of formally verifying the software.

and data will be safe enough if my computer was stolen?

That depends upon a number of factors.

If your computer is stolen while it is switched on and you are logged in (e.g. if someone snatches your laptop from you at a cafe while you are working on it), then as long as the thief can keep the laptop awake, BitLocker will not prevent them from viewing your files.

Alternatively, if an attacker obtains a copy of your decryption key, then the attacker will be able to access your data. That might occur if your key (or the passphrase used to protect your key) is weak and susceptible to a brute-force attack, or if your attacker uses some other means to obtain your decryption key, such as a DMA attack, a cold boot attack or an evil maid attack. See Daniel Selifonov's DEF CON 21 talk A Password Is Not Enough: Why disk encryption is broken and how we might fix it for a longer discussion of attack vectors like this, and potential mitigations.

Finally, if BitLocker's design or implementation has a weakness (see above), then an attacker may be able to access your data.