New answers tagged


The operating system needs to claim the TPM. That can be done by clearing it first. After that, the boot process gets attested and the Bitlocker key can be unlocked using TPM. Please note that anytime you change something in the BIOS or the startup sequence or add additional hard drives or USB thumb drives, the unlock key needs to be entered again.


Now if this firmware is somehow hacked or infected and if you take it to another PC, is it possible for this firmware to infect other hardware on this new PC? Yes, certainly. This could be done by supplying a custom boot sequence, or supplying altered information to the boot process (the malware does not need to integrate in the boot process: it can boot ...


Well, you could keep your bootloader on an external device and set your computer to boot from that device, but that would not protect from other forms of tampering such as a backdoor BIOS. Such a backdoor could allow you to load your genuine bootloader, but surreptitiously inject malicious code into it while it is being run. Generally, anyone who can modify ...


There's no known reason other than Microsoft just not deeming it necessary. A common theme in cryptographic design is to keep the system as simple as possible, to avoid problems later on. If they'd have added a scheme to combine the PIN and the TPM key, they'd need to come up with a way to combine those keys. That likely means something like hashing the two ...

Top 50 recent answers are included