Bitlocker doesn't support USB key + PIN (password). The reasoning was "the password is too weak to provide additional security". Isn't that flawed? With a USB key and password, I've got some level of two-factor, right? The USB drive contains 128/256 bits of key material, and the user could provide as large a passphrase as needed. That way, stealing a USB key doesn't grant access, nor does somehow finding the password (watching, listening, etc.)

The same for TPM. I'd like to use the TPM to verify the startup environment. But I don't want to trust my entire key to chips that may be very poorly implemented. (I recall some news of attackers being able to just open up the TPM and access the key material directly.) If Bitlocker used my password, I could get the best of both worlds.

  • If someone is determined enough to mount your disk to spy on you continuously until they see your password or conduct an IMF-like operation to steal your flash drive, they are determined enough to spy on you continuously until they see your password and conduct an IMF-like operation to steal your flash drive. That being said, in theory using both would provide you with greater security.
    – KnightOfNi
    Mar 2, 2014 at 17:43
  • 1
    I don't think it's far-fetched or too intense. A casual office observer can look over your shoulder and see you enter your password. A casual office worker can steal your USB key (or you could just accidentally leave it plugged in). That's half the point of using FDE in the first place, right?
    – MichaelGG
    Mar 2, 2014 at 22:10
  • If you type in your password when someone is looking over your shoulder or you're careless with your flash drive, you're probably brain-dead enough to type in your password when someone is looking over your shoulder and be careless with your flash drive. That's just the way it is... Also, unless a Bitlocker employee willing to violate their non-disclosure agreement happens to see this question, it's probably never going to be answered, because no one else has access to the rationale of the company any more than you do.
    – KnightOfNi
    Mar 3, 2014 at 4:28
  • If you want to change your password, wouldn't the whole disk needs to be reencrypted? May 19, 2014 at 16:40
  • @grasGendarme no the way that it's handled is that the key stored is a Key Encryption Key, and it unlocks a Data Encrypting Key.
    – MichaelGG
    May 20, 2014 at 8:36

2 Answers 2


It does sound like a flawed argument though I've not checked the details personally.

But this doesn't surprise me as it seems to me, from the perspective of seeing Bitlocker deployed to a large enterprise, Bitlocker is pretty flawed anyway.

Certainly TrueCrypt supports using both.

Of course, the downside of using USB devices for security is their rate of failure. As they fail pretty regularly, I certainly would not want to rely on one as the only mechanism for logging in to something.


Unless I'm misunderstanding you, doesn't -protectors -tpmandpinandstartupkey do what you want? That requires the PIN (the password), the USB key (the startup key), and of course the TPM.

The same for the second paragraph re:TPM. -protectors -tpmandpin does use the TPM and the password, which seems to be exactly what you're asking for.

If your concern is at a lower level, the FVEK (used to encrypt the disk) is encrypted using the VMK (on the TPM) which is encrypted using the keys from your external protectors (PIN and USB). If you're just using the TMP protection with no other protectors (not something recommended) then yes, if you compromise the TPM (physically) you'll potentially be able to access the FVEK and decrypt the disk. But as long as you're including a key from an external protector you can't decrypt the FVEK.

  • Does the PIN actually help encrypt the VMK? I thought the PIN was a passcode for the TPM's use. Even if BDE did mix in the PIN material, the TPM might store the PIN plaintext (maybe? is this stuff even spec'd or verified?).
    – MichaelGG
    Jun 26, 2014 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .