When starting a BitLocker-encrypted machine with a TPM and Windows 10 installed, you aren't prompted to enter a decryption key. The system relies on Windows lockscreen for authentication instead. My current understanding is that, when starting the system:

  1. The TPM checks whether the selected bootloader (i.e. the .EFI binary) matches a hash stored inside it
  2. If the hash matches, the key is released and transferred over to the CPU, which stores it into RAM
  3. No other OS executables that could be modified to reveal the key are unencrypted and the bootloader will refuse to boot if C: isn't encrypted with the key supplied by the TPM; the AES key is derived, decryption of the BitLocker volume containing Windows begins and Windows boots from the volume now transparently decrypted and mounted at C:
  4. Once boot is complete, the Windows lockscreen environment is secure enough not to let anyone without credentials in, and couldn't have been tampered with due to the entire OS and system files being encrypted

Realistically, the TPM can't check the entire OS (several gigabytes!) at each boot. In other words, if my understanding is correct, the core of TPM-based BitLocker security lies in the fact that the bootloader is scanned for tampering and nothing else really matters from a security standpoint, since without the cryptographic key you aren't able to create meaningful ciphertext that can alter the OS's behavior. This should also mean that in order for an attacker to set up an "Evil Maid" attack, they'd have to break the bootloader and replace it with something else that will log the recovery password (you'd be prompted for one since the TPM won't release the key now).

Performing such an attack should however not be possible if secure boot is enabled and the BIOS is locked with a password and is one of the non-resettable ones: it would simply fail to boot, and the user would just need to reflash BIOS (in case of modification) and - starting from a Linux live disk - recover data using the key. Or simply wipe everything.

Is this correct, and if not, how does it work then? Is this model flawed (aside from inevitable cold-boot attacks)?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.