While doing some encryption work on drives I found that BitLocker keeps making these "recovery keys". No other encryption software I used did that so it annoyed me and made me biased perhaps.
While laboring with safe storage of these "recovery keys", I suddenly realized how small they looked and now I started suspecting a more serious problem.
I searched for how they worked and found the post How does Microsoft's BitLocker Recovery Code work?. It says it is just another encryption key, like the password.
Now my passwords are 128-character alphanumerics with special characters that I generate using algorithms with some random input (e.g., my mouse movements). My estimate is that it is 7 bit per character = 896 bits. If half of it is random, the key is way above 256 bits and suits the industrial standards.
The recovery key on the other hand is 48 digits, at most log2(10^49) = 163 bit, if my math is correct. A 163-bit key seems mighty small and is certainly not up to an industrial standard of 256 bit.
But then something else struck me. When generating the key I didn't move neither my mouse, nor pressed keys, nor was my computer connected to the Internet. What else could Windows use for randomness? Thermistors on the chipset? Too slow, the key was printed out within a few seconds. So it must be a pseudorandom 163-bit key. The time to crack anything below 128 random bits falls off the cliff so under the worst case scenario it could be cracked very quickly using regular GPUs. So it adds up to two questions:
Can a BitLocker-locked drive be brute-forced within hours by guessing the recovery key by an actor with a supercomputer? With a couple of GPUs? (assuming Microsoft put as much effort as possible into that pseudo-random recovery key and didn't insert any back doors by reducing the already-miserable amount of randomness there)
Is there an option to disable BitLocker recovery keys?
Answer to question 2. (I hope) I found a way to disable the recovery keys!
In Windows, search Run → gpedit.msc → Computer Configuration → Administrative Template → Windows Components → BitLocker Drive Encryption → Fixed/Removable Data Drives → Choose how fixed/removable drives can be recovered. Reboot. Recreate the drives.
I was happy about my discovery for a minute, but I realized if the answer to question 1 is yes, it might just create the recovery key in the background, but never display, save, or log it. The vulnerability would work just the same.
I was actually not able to disable the recovery key entirely. BitLocker just fails with an error saying there is no option to create a recovery key. I did switch to the 256-bit recovery key, which somebody on some forum says ought to be FIPS compliant. It saves it as a hidden system file on a USB disk.