I started using bitlocker yesterday and I have a TPM2.0 in my laptop. I enabled the option to enter a pin when starting and I enabled the option to use AES256 before encrypting. I don't really understand how it is safe to have the TPM unlock the drive automatically when starting. It has to start the OS so it has to decrypt it before starting windows right? If this is done automatically an attacker can just come to my laptop and start it and my data isn't encrypted, this seems very unsafe so I'm probably just understanding it wrong. Which is the safest way to use Bitlocker?


If this is done automatically an attacker can just come to my laptop and start it and my data isn't encrypted

This is the procedure. It isn't secure. For the average person, BitLocker and TPM is more secure than not using full-disk encryption. TPM is a secure microcontroller with cryptographic capabilities designed to provide basic security-related functions involving encryption keys. now the specifics BitLocker seals the master encryption key in the TPM and only allows the key to be released when code measurements have not changed from a previous secure boot. - Trusted Platform Module (TPM) and BitLocker Support

This is done with support from secure boot. Hence, directly booting and circumventing the normal boot procedure is not allowed. However, if you can find a vulnerability within Windows, you can circumvent this, as you do not physically need the decryption master key. E.g. Windows will boot to the lock screen, if you can identify a vulnerability here (when the drive is decrypted) you have access. Windows ’sticky keys’ exploit exploited a vulnerability where startup recovery would print the diagnostics within Notepad.exe with elevated administrator privileges. Notepad could open Windows Explorer and rename a program which would run at the login screen, sticky keys are one example. Renaming cmd.exe to sethc.exe allowed cmd.exe to be run with elevated administrator privileges at the login screen.

Which is the safest way to use Bitlocker

Use a strong password on BitLocker or setup a USB key. The USB key, will be a USB flash drive, just like TPM. Except you will control the storage mechanism, also you can easily remove the drive. However, both the options I said here can introduce other problems. This is very subjective depending upon your OpSec requirements. Bitlocker: USB Key vs Password?

  • Thanks a lot for replying :) Ok as I thought it's not very secure to have it decrypt automatically. I would love to simply use a password as I am used to luks under linux but when using Bitlocker with TPM the only options for unlocking are automatically, usb key and pin.
    – Tanonic
    Jul 22 '18 at 17:26
  • ok I just took a look at this post security.stackexchange.com/a/129364/156701 and it seems to have a good solution for using a password and not only a pin
    – Tanonic
    Jul 22 '18 at 17:36

This site is temporarily in read only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .