1

I'm in the process of setting up encryption on some machines in the office, and BitLocker is the obvious choice for Windows ones.

Some computers already have BitLocker activated with password protection, but our aim is to use USB keys with all of them.

I can't seem to find a way of switching from password protection to USB key in a "direct" way.

I'm starting to think the only option is to disable encryption and then re-enable it with USB key instead of password, but, since this process would take quite a lot of time, I thought of asking for your help first.

3
  • AFAIK, full decryption then re-encrypt as you say is the only option. Aug 25, 2016 at 12:34
  • Thanks @YorickdeWid. I wonder if it has something to do with the way BitLocker works under the hood.
    – stassinari
    Aug 25, 2016 at 14:22
  • This is not going to fit in an comment; BitLocker encrypts the drive with AES-128-CBC by default. CBC (but also XTS since Windows 10) allows for random IO, so individual files can be accessed per sector. All the blocks within a sector use the same master key, a password hashed version of your BitLocker password. For a private key, the process goes slightly different. This explains why the entire drive needs to be decrypted first, before you can re-encrypt again. I'd understand why you asked the question, and however it is in theory possible to setup encryption in such a way that you can easily Aug 25, 2016 at 14:41

2 Answers 2

1

I found the below method to add USB key for bitlocker which is already set up using password. This is for bitlocker without TPM.

Open PowerShell with administrator privileges and enter

manage-bde –protectors -add C: -startupkey E:

E: is the flash drive letter. C: is where windows is installed

Now you can unlock your system using USB flash drive or password.

Edit: As pointed out by CBHacking, if you want to delete the existing password protector you can execute the below command.

manage-bde -protectors -delete C: -t Password

See manage-bde -protectors -h for more options.

More information here: https://docs.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker#bkmk-managebde

2
  • Welcome to security.SE! This is a good first step but doesn't quite address the question, because the old password (probably "PIN")-based protector would still be present and usable. Fortunately, it's easy to remove those using manage-bde too.
    – CBHacking
    Sep 2, 2022 at 3:07
  • Thanks @CBHacking. As suggested by you I have edited the answer to include method to remove existing password protector.
    – Umesh
    Jan 31 at 15:31
0

This is actually pretty easy. You just need to add a "startupkey" protector (assuming this is a boot volume) or "recoverykey" (if not) protector to the drive, and remove the "pin" (if boot volume) or "password" (if not boot volume) protector. All of this can be done with the manage-bde.exe command-line utility, or using Powershell's BitLocker administration cmdlets. Note that, if this is a boot drive and the machine has a TPM as well, you should add a "tpmandstartupkey" protector (and probably need to remove a "tpmandpin" protector rather than just a "password" protector); if you use a "startupkey" protector instead of "tpmandstartupkey" then the TPM won't be used for BitLocker at all (although that's mostly relevant for "pin"-based protectors; the startup key isn't feasibly brute-forcible the way a PIN/password is, and the odds of an attacker stealing both an encrypted disk and the startup key but not the machine with the relevant TPM is quite low).

Depending on how much you trust your users to have configured things correctly, you might also want to set a new "recoverypassword" (the long numeric value used for recovery when normal unlock is impossible) protector, replacing the old one and optionally storing the new recoverypassword value in AD or somewhere else secure. (Of course, if your employees recorded the original recovery password like they're supposed to when turning on Bitlocker initially, they might need to know that it won't work anymore.)

Note that all of this is extremely fast, and happens without any need to decrypt (or re-encrypt) the drive. The reason is that every Bitlocker volume is actually encrypted with a totally random key that has nothing to do with any of those values (PINs, passwords, recovery or startup keys, etc.). The recoverypassword, TPM (if used), and all other key protectors are just that: they protect the actual volume encryption key by "wrapping" (encrypting) it with another key. These wrapped versions of the volume encryption key are stored within the Bitlocker metadata on the drive. When unlocking the drive, you need the key from any one protector (might be a password, the TPM, a file on a flashdrive, etc.; note that the "tpmand..." protectors count as a single protector but can require multi-factor authentication) to unwrap (decrypt) the volume encryption key. Neither the protector-derived key nor the volume encryption key are ever stored anywhere on the system except in kernel-only RAM.

You can even render a drive with Bitlocker completely unreadable forever by just removing all the protectors; even if somebody still knows e.g. the old recovery password, it won't help, because the recovery password doesn't actually have anything to do with the volume encryption key, it just is used to derive a key that unwraps an encrypted version of the volume encryption key. When the "recoverypassword" protector (or any other protector) is deleted, the corresponding wrapped version of the volume encryption key is also deleted. On the flip side, this means you can completely change the protectors for any volume (so long as you're able to unlock it at all, since you do need the volume encryption key in plain text in memory) for essentially free, because it doesn't change the actual volume encryption key (and therefore doesn't change the actual disk encryption) at all!

The only time you'd need to decrypt and re-encrypt is if you wanted to change the actual volume encryption key (e.g. to go from 128 bits to 256 bits) or the encryption mode (CBC, CBC-with-diffuser, or XTS), as those directly impact the way encryption of the actual data on the volume is performed and therefore you have to touch every single encrypted byte. Changing the protectors only requires touching a tiny bit of metadata.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .