0

From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive:

  • Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and stored on-disk)
  • Volume Master Key (VMK) (encrypted by a key protector and stored on-disk)
  • Key Protector (KP) (TPM or numerical password)

I don't understand what security value the VMK provides. Why not just encrypt the FVEK directly using KPs?

In any case, if a KP leaks, the FVEK can be obtained anyway?

Improve this question

1 Answer 1

Reset to default
2

I was wondering about the same thing myself, did some googling around, until found the answer here:
BitLocker : Update Volume Master Key and meaning of "keyed" vs "re-keyed"
Microsoft's docs

Basically, use of intermediate key (VMK between FVEK and KPs) is to allow the change of keys if KPs are compromised without the need of re-encrypting the (encrypted) data itself.
KPs compromised -> create new (KPs and) VMK -> encrypt old FVEK with new VMK

Then, attacker with old KPs will get to the old VMK and trying to decrypt the encrypted FVEK won't work (because it was re-encrypted with new VMK). Of course, depends how quick the attacker is and other circumstances.

Improve this answer
1
  • Thanks, but isn't the VMK always stored locally on the system? I mean with administrative privileges, you can obtain the KPs - but, at the same time you'd be able to obtain the VMK, either by dumping memory or using some tool?
    – Shuzheng
    Commented Oct 7, 2019 at 4:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .