From this FAQ, I understand that BitLocker uses the following keys to encrypt the hard-drive:

  • Full Volume Encryption Key (FVEK) (used to encrypt raw data; encrypted by the volume master key and stored on-disk)
  • Volume Master Key (VMK) (encrypted by a key protector and stored on-disk)
  • Key Protector (KP) (TPM or numerical password)

I don't understand what security value the VMK provides. Why not just encrypt the FVEK directly using KPs?

In any case, if a KP leaks, the FVEK can be obtained anyway?


I was wondering about the same thing myself, did some googling around, until found the answer here:
BitLocker : Update Volume Master Key and meaning of "keyed" vs "re-keyed"
Microsoft's docs

Basically, use of intermediate key (VMK between FVEK and KPs) is to allow the change of keys if KPs are compromised without the need of re-encrypting the (encrypted) data itself.
KPs compromised -> create new (KPs and) VMK -> encrypt old FVEK with new VMK

Then, attacker with old KPs will get to the old VMK and trying to decrypt the encrypted FVEK won't work (because it was re-encrypted with new VMK). Of course, depends how quick the attacker is and other circumstances.

  • Thanks, but isn't the VMK always stored locally on the system? I mean with administrative privileges, you can obtain the KPs - but, at the same time you'd be able to obtain the VMK, either by dumping memory or using some tool? – Shuzheng Oct 7 '19 at 4:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.