1

I need to create a "duress" capability on a Linux-based and a Windows-based computer that have encrypted drives. I assume the easiest and quickest way would be to blow away the keys. On the Linux, LUKS encryption has a simple command to clear the key slots making the drive unrecoverable. Is there a disk encryption tool for Windows that provides a method to clear the key slots, or perhaps a way to clear the TPM?

  • I googled "windows clear TPM" and got this from the official Windows documentation: docs.microsoft.com/en-ca/windows/security/hardware-protection/… – schroeder Feb 8 '18 at 14:07
  • Modern storage devices with SED capability can also instantly wipe all the data by deleting a key used transparently for encryption. – forest Feb 8 '18 at 14:20
  • Thanks for the reference to microsoft...trustedplatformmodule/clear-tpm.view=win10-psYes, that would be great, but sadly, these are not SED. – Ruhgster Feb 9 '18 at 14:45
2

You can use the Clear-Tpm Powershell commandlet to do this programmatically, rather than using the TPM management control snap-in.

You could also use ATA Secure Erase on any modern SSD. This tutorial shows you how to trigger an ATA secure erase command on Linux. For Windows you'd need to write your own code to send the ATA commands to the disk - you'll need to consult the ATA command reference (section 1.8 explains how to use SECURE ERASE) and do some DeviceIoControl calls to execute those commands.

  • ATA Security Erase also works on HDDs, not just SSDs. Now that most modern drives of all types support SED, the erasure is extremely quick. – forest Feb 15 '18 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.