From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive:
- Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and stored on-disk)
- Volume Master Key (VMK) (encrypted by a key protector and stored on-disk)
- Key Protector (KP) (TPM or numerical password)
I don't understand what security value the VMK provides. Why not just encrypt the FVEK directly using KPs?
In any case, if a KP leaks, the FVEK can be obtained anyway?