In the document Windows Server 2008 R2 BitLocker™ Drive Encryption Security Policy For FIPS 140-2 Validation, in the section 6.1.2 FIPS 140-2 Security Rules bullet point 2 it says:

BitLocker™ will only release keys to be stored on USB flash drives, if the Crypto Officer performs this operation

What does "operation" mean in this context?

What "operation" requires that "release keys to be stored on USB flash drives"?

What situations would require "release keys to be stored on USB flash drives"?

What is the exact definition of "releasing keys"?

2 Answers 2


The FIPS 140 standard defines a number of technical terms (§2.1). Beyond that, you can assume common English meanings for words that aren't defined in the security policy you're reading.

The word operation is not defined in the standard, so it has its ordinary English meaning: “the act or process of operating” (Webster) (oh, and operate means “to produce, as an effect; to cause”). The operation here is the release of keys for storing on a USB flash drive.

Releasing a key from the cryptographic module means copying a key from inside the module to the outside of the module. Since Bitlocker is a software module, “inside” means that you need to go through Bitlocker to access it and “outside” means that you don't.

What the sentence means is that only the crypto officer can cause Bitlocker to release keys. Crypto officer is defined by FIPS 140-2; it is the role of the person(s) who can manage the keys stored in the module. This is usually the administrator role, the most privileged role possible on a cryptographic module. If the cryptographic module is a physical box with secret material inside, the crypto officer is the guy with the keys to the box; other users can only act on the box in controlled ways from the outside.

Bitlocker is intended to keep keys confidential. This sentence says that only the crypto officer can break this confidentiality. Usually, keys are extracted from a security module to back them up or to migrate them to another security module.


"Operation" enabling BitLocker

When BitLocker is used, a key is generated that must be present in order to decrypt access to the drive.

BitLocker will only store the unlock key on a USB drive so that the USB drive needs to be plugged in to the machine to unlock it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .