BitLocker

This is a good article. Click here for more information.
Source: Wikipedia, the free encyclopedia.

BitLocker
Other namesDevice Encryption
Developer(s)Microsoft
Initial releaseJanuary 30, 2007; 17 years ago (2007-01-30)
Operating systemMicrosoft Windows
TypeDisk encryption software
Websitelearn.microsoft.com/en-us/windows/security/operating-system-security/data-protection/bitlocker/ Edit this on Wikidata

BitLocker is a

cipher block chaining (CBC) or "xor–encrypt–xor (XEX)-based Tweaked codebook mode with ciphertext Stealing" (XTS) mode[1] with a 128-bit or 256-bit key.[2][3] CBC is not used over the whole disk; it is applied to each individual sector.[3]

History

BitLocker originated as a part of Microsoft's

BitLocker is available on:

Features

manage-bde
Developer(s)Microsoft
Initial releaseJanuary 30, 2007; 17 years ago (2007-01-30)
Operating systemMicrosoft Windows
TypeCommand
LicenseProprietary commercial software
Websitemanage-bde

Initially, the graphical BitLocker interface in Windows Vista could only encrypt the operating system volume. Starting with Windows Vista with Service Pack 1 and Windows Server 2008, volumes other than the operating system volume could be encrypted using the graphical tool. Still, some aspects of the BitLocker (such as turning autolocking on or off) had to be managed through a command-line tool called manage-bde.wsf.[13]

The version of BitLocker included in Windows 7 and Windows Server 2008 Release 2 adds the ability to encrypt removable drives. On

FAT32 or exFAT filesystems are used.[14] In addition, a new command-line tool called manage-bde replaced the old manage-bde.wsf.[15]

Starting with Windows Server 2012 and Windows 8, Microsoft has complemented BitLocker with the Microsoft Encrypted Hard Drive specification, which allows the cryptographic operations of BitLocker encryption to be offloaded to the storage device's hardware.

Windows PowerShell.[18] Finally, Windows 8 introduced Windows To Go in its Enterprise edition, which BitLocker can protect.[19]

Device encryption

Connected Standby) specifications,[22] which requires solid-state drives and a TPM 2.0 chip.[20][23]

Starting with Windows 10 1703, the requirements for device encryption have changed, requiring a TPM 1.2 or 2.0 module with PCR 7 support,

UEFI Secure Boot, and that the device meets Modern Standby requirements or HSTI validation.[24]

In September 2019 a new update was released (KB4516071[25]) changing the default setting for BitLocker when encrypting a self-encrypting hard drive. Now, the default is to use software encryption for newly encrypted drives. This is due to hardware encryption flaws and security concerns related to those issues.[26]

Encryption modes

Three authentication mechanisms can be used as building blocks to implement BitLocker encryption:[27]

  • Transparent operation mode: This mode uses the capabilities of TPM 1.2 hardware to provide for transparent user experience—the user powers up and logs into Windows as usual. The key used for disk encryption is sealed (encrypted) by the TPM chip and will only be released to the OS loader code if the early boot files appear to be unmodified. The pre-OS components of BitLocker achieve this by implementing a Static Root of Trust Measurement—a methodology specified by the Trusted Computing Group (TCG). This mode is vulnerable to a cold boot attack, as it allows a powered-down machine to be booted by an attacker. It is also vulnerable to a sniffing attack, as the volume encryption key is transferred in plain text from the TPM to the CPU during a successful boot.
  • User authentication mode: This mode requires that the user provide some authentication to the pre-boot environment in the form of a pre-boot PIN or password.
  • USB Key Mode: The user must insert a USB device that contains a startup key into the computer to be able to boot the protected OS. Note that this mode requires that the BIOS on the protected machine supports the reading of USB devices in the pre-OS environment. BitLocker does not support smart cards for pre-boot authentication.[28]

The following combinations of the above authentication mechanisms are supported, all with an optional escrow recovery key:

Operation

BitLocker is a logical volume encryption system. (A volume spans part of a hard disk drive, the whole drive or more than one drive.) When enabled, TPM and BitLocker can ensure the integrity of the trusted boot path (e.g. BIOS and boot sector), in order to prevent most offline physical attacks and boot sector malware.[35]

In order for BitLocker to encrypt the volume holding the operating system, at least two

bootstrapping files to be transferred to it.[37]

Once an alternate boot partition has been created, the TPM module needs to be initialized (assuming that this feature is being used), after which the required disk-encryption key protection mechanisms such as TPM, PIN or

USB key are configured.[38] The volume is then encrypted as a background task, something that may take a considerable amount of time with a large disk as every logical sector is read, encrypted and rewritten back to disk.[38] The keys are only protected after the whole volume has been encrypted when the volume is considered secure.[39] BitLocker uses a low-level device driver to encrypt and decrypt all file operations, making interaction with the encrypted volume transparent to applications running on the platform.[38]

Encrypting File System (EFS) may be used in conjunction with BitLocker to provide protection once the operating system is running. Protection of the files from processes and users within the operating system can only be performed using encryption software that operates within Windows, such as EFS. BitLocker and EFS, therefore, offer protection against different classes of attacks.[40]

In Active Directory environments, BitLocker supports optional key escrow to Active Directory, although a schema update may be required for this to work (i.e. if the Active Directory Services are hosted on a Windows version previous to Windows Server 2008).

BitLocker and other full disk encryption systems can be attacked by a

rogue boot manager. Once the malicious bootloader captures the secret, it can decrypt the Volume Master Key (VMK), which would then allow access to decrypt or modify any information on an encrypted hard disk. By configuring a TPM to protect the trusted boot pathway, including the BIOS and boot sector, BitLocker can mitigate this threat. (Note that some non-malicious changes to the boot path may cause a Platform Configuration Register check to fail, and thereby generate a false warning.)[35]

Security concerns

TPM alone is not enough

The "Transparent operation mode" and "User authentication mode" of BitLocker use TPM hardware to detect whether there are unauthorized changes to the pre-boot environment, including the BIOS and MBR. If any unauthorized changes are detected, BitLocker requests a recovery key on a USB device. This cryptographic secret is used to decrypt the Volume Master Key (VMK) and allow the bootup process to continue.[41] However, TPM alone is not enough:

  • In February 2008, a group of security researchers published details of a so-called "cold boot attack" that allows full disk encryption systems such as BitLocker to be compromised by booting the machine from removable media, such as a USB drive, into another operating system, then dumping the contents of pre-boot memory.[42] The attack relies on the fact that DRAM retains information for up to several minutes (or even longer, if cooled) after the power has been removed. The Bress/Menz device, described in US Patent 9,514,789, can accomplish this type of attack.[43] Similar full disk encryption mechanisms of other vendors and other operating systems, including Linux and Mac OS X, are vulnerable to the same attack. The authors recommend that computers be powered down when not in physical control of the owner (rather than be left in a sleep mode) and that the encryption software be configured to require a password to boot the machine.[42]
  • On 10 November 2015, Microsoft released a security update to mitigate a security vulnerability in BitLocker that allowed authentication to be bypassed by employing a malicious Kerberos key distribution center, if the attacker had physical access to the machine, the machine was part of a domain and had no PIN or USB flash drive protection.[44]
  • BitLocker still does not properly support TPM 2.0 security features which, as a result, can lead to a complete bypass of privacy protection when keys are transmitted over Serial Peripheral Interface in a motherboard.[45]

All these attacks require physical access to the system and are thwarted by a secondary protector such as a USB flash drive or PIN code.

Upholding Kerckhoffs's principle

Although the AES encryption algorithm used in BitLocker is in the public domain, its implementation in BitLocker, as well as other components of the software, are proprietary; however, the code is available for scrutiny by Microsoft partners and enterprises, subject to a non-disclosure agreement.[46][47]

According to Microsoft sources,

encryption key that the BitLocker program suggests that its users make.[51]

Niels Ferguson's position that "back doors are simply not acceptable"[50] is in accordance with Kerckhoffs's principle. Stated by Netherlands-born cryptographer Auguste Kerckhoffs in the 19th century, the principle holds that a cryptosystem should be secure, even if everything about the system, except the encryption key, is public knowledge.

Other concerns

Starting with Windows 8 and Windows Server 2012, Microsoft removed the Elephant Diffuser from the BitLocker scheme for no declared reason.

Thunderbolt 3 ports.[55][56]

In October 2017, it was reported that a flaw enabled private keys to be inferred from

smartcards and TPMs. Microsoft released an updated version of the firmware for Infineon TPM chips that fixes the flaw via Windows Update.[58]

See also

References

  1. ^ a b Hakala, Trudy (January 29, 2020). "What's new in Windows 10, versions 1507 and 1511". TechNet. Microsoft. Retrieved March 7, 2020.
  2. ^ a b "Windows BitLocker Drive Encryption Frequently Asked Questions". TechNet Library. Microsoft. March 22, 2012. Retrieved March 7, 2020.
  3. ^ a b Ferguson, Niels (August 2006). "AES-CBC + Elephant Diffuser: A Disk Encryption Algorithm for Windows Vista" (PDF). Microsoft. Retrieved March 7, 2020. {{cite journal}}: Cite journal requires |journal= (help)
  4. ^ a b Biddle, Peter (2004). "Next-Generation Secure Computing Base". Microsoft. Archived from the original (PPT) on August 27, 2006. Retrieved March 7, 2020.
  5. ^ Thurrott, Paul (September 9, 2005). "Pre-PDC Exclusive: Windows Vista Product Editions". Supersite for Windows. Penton. Archived from the original on April 2, 2015. Retrieved March 7, 2020.
  6. ^ a b Microsoft (April 22, 2005). "Secure Startup–Full Volume Encryption: Technical Overview" (DOC). Retrieved March 7, 2020.
  7. ^ Microsoft (April 21, 2005). "Secure Startup – Full Volume Encryption: Executive Overview" (DOC). Retrieved March 7, 2020.
  8. ^ a b "What's New in BitLocker". TechNet Library. Microsoft. August 31, 2016. Retrieved March 7, 2020.
  9. ^ "BitLocker Drive Encryption in Windows Vista". TechNet. Microsoft. Archived from the original on November 17, 2016. Retrieved March 7, 2020.
  10. ^ "BitLocker Drive Encryption Overview". TechNet. Microsoft. November 17, 2009. Retrieved March 7, 2020.
  11. ^ "Compare Windows 10 Editions". Windows for Business. Microsoft. Retrieved March 7, 2020.
  12. ^ "Finding your BitLocker recovery key in Windows". Windows support. Microsoft. Retrieved December 2, 2021.
  13. ^ Hynes, Byron (September 8, 2016). "Advances in BitLocker Drive Encryption". TechNet Magazine. Microsoft. Retrieved March 7, 2020.
  14. ^ "Description of BitLocker To Go Reader". Microsoft. Archived from the original on September 24, 2019. Retrieved April 25, 2017.
  15. ^ "Enabling BitLocker by Using the Command Line". TechNet. Microsoft. September 12, 2012. Retrieved March 7, 2020.
  16. ^ "Encrypted Hard Drive". TechNet. Microsoft. August 31, 2016. Retrieved March 7, 2020.
  17. MSDN. Microsoft
    . June 1, 2017. Retrieved March 7, 2020.
  18. ^ "BitLocker". TechNet. Microsoft. Retrieved March 7, 2020.
  19. ^ "Windows To Go: Frequently Asked Questions". TechNet. Microsoft. October 23, 2013. Retrieved March 7, 2020.
  20. ^ a b "Device Encryption". Device Encryption. Microsoft. November 18, 2015. Retrieved March 7, 2020.
  21. ^ Cunningham, Andrew (October 17, 2013). "Windows 8.1 includes seamless, automatic disk encryption—if your PC supports it". Ars Technica. Condé Nast. Retrieved March 7, 2020.
  22. ^ a b "Help protect your files with device encryption". Windows Help portal. Microsoft. Archived from the original on May 2, 2016. Retrieved March 7, 2020.
  23. Penton Media. Archived from the original
    on June 9, 2013. Retrieved March 7, 2020.
  24. ^ "BitLocker drive encryption in Windows 10 for OEMs". docs.microsoft.com. November 16, 2018. Retrieved March 7, 2020.
  25. ^ "September 24, 2019—KB4516071 (OS Build 16299.1420)". support.microsoft.com. Retrieved March 7, 2020.
  26. ^ Cimpanu, Catalin (November 5, 2018). "Flaws in self-encrypting SSDs let attackers bypass disk encryption". www.zdnet.com. Retrieved March 7, 2020.
  27. ^ "BitLocker Drive Encryption". Data Encryption Toolkit for Mobile PCs: Security Analysis. Microsoft. April 4, 2007. Archived from the original on October 23, 2007. Retrieved March 7, 2020.
  28. ^ Dansimp. "Using BitLocker with other programs FAQ (Windows 10) - Windows security". docs.microsoft.com. Retrieved July 27, 2022.
  29. ^ "ProtectKeyWithTPM method of the Win32_EncryptableVolume class". MSDN Library. Microsoft. March 31, 2018. Retrieved March 7, 2020.
  30. ^ "ProtectKeyWithTPMAndPIN method of the Win32_EncryptableVolume class". MSDN Library. Microsoft. March 31, 2018. Retrieved March 7, 2020.
  31. ^ "ProtectKeyWithTPMAndPINAndStartupKey method of the Win32_EncryptableVolume class". MSDN Library. Microsoft. March 31, 2018. Retrieved March 7, 2020.
  32. ^ "ProtectKeyWithTPMAndStartupKey method of the Win32_EncryptableVolume class". MSDN Library. Microsoft. March 31, 2018. Retrieved March 7, 2020.
  33. ^ "ProtectKeyWithExternalKey method of the Win32_EncryptableVolume class". MSDN Library. Microsoft. March 31, 2018. Retrieved March 7, 2020.
  34. ^ "ProtectKeyWithNumericalPassword method of the Win32_EncryptableVolume class". MSDN Library. Microsoft. March 31, 2018. Retrieved March 7, 2020.
  35. ^ a b c "BitLocker Drive Encryption in Windows 7: Frequently Asked Questions". TechNet. Microsoft. September 12, 2012. Retrieved March 7, 2020.
  36. ^ "Windows BitLocker Drive Encryption Step-by-Step Guide". TechNet. Microsoft. July 2, 2012. Retrieved March 7, 2020.
  37. ^ "Description of the BitLocker Drive Preparation Tool". Microsoft. December 21, 2011. Retrieved March 7, 2020.
  38. ^
    OCLC 851209981
    .
  39. .
  40. CBS Interactive
    . Retrieved March 7, 2020.
  41. ^ Byron, Hynes (September 7, 2016). "Keys to Protecting Data with BitLocker Drive Encryption". TechNet Magazine. Microsoft. Retrieved March 7, 2020.
  42. ^
    Schoen, Seth D.; Heninger, Nadia; Clarkson, William; Paul, William; Calandrino, Joseph A.; Feldman, Ariel J.; Appelbaum, Jacob; Felten, Edward W (February 21, 2008). Lest We Remember: Cold Boot Attacks on Encryption Keys (PDF) (Thesis). Princeton University
    . Retrieved March 7, 2020.
  43. ^ "Systems and methods for safely moving short term memory devices while preserving, protecting and examining their digital data". Retrieved March 7, 2020.
  44. ^ "Microsoft Security Bulletin MS15-122 – Important". Security TechCenter. Microsoft. October 11, 2017. Retrieved March 7, 2020.
  45. ^ "From Stolen Laptop to Inside the Company Network". Dolos Group. July 28, 2021. Retrieved December 2, 2021.
  46. ^ Thurrott, Paul (June 10, 2015). "No Back Doors: Microsoft Opens Windows Source Code to EU Governments". Petri. Retrieved March 7, 2020.
  47. ^ "Shared Source Initiative". www.microsoft.com. Retrieved March 7, 2020.
  48. ^ "Back-door nonsense". System Integrity Team Blog. Microsoft. March 2, 2006. Retrieved March 7, 2020.
  49. ^ Stone-Lee, Ollie (February 16, 2006). "UK holds Microsoft security talks". BBC. Retrieved March 7, 2020.
  50. ^ a b Evers, Joris (March 6, 2006). "Microsoft: Vista won't get a backdoor". CNET. CBS Interactive. Retrieved March 7, 2020.
  51. ^ Franceschi-Bicchierai, Lorenzo (September 11, 2013). "Did the FBI Lean On Microsoft for Access to Its Encryption Software?". Mashable. Retrieved March 7, 2020.
  52. ^ "BitLocker Overview". technet.microsoft.com. August 31, 2016. Retrieved March 7, 2020.
  53. ^ Rosendorf, Dan (May 23, 2013). "Bitlocker: A little about the internals and what changed in Windows 8" (PDF). Archived from the original (PDF) on October 22, 2021. Retrieved March 7, 2020.
  54. ^ Lee, Micah (June 4, 2015). "Microsoft Gives Details About Its Controversial Disk Encryption". The Intercept. Retrieved March 7, 2020.
  55. ^ "Blocking the SBP-2 driver and Thunderbolt controllers to reduce 1394 DMA and Thunderbolt DMA threats to BitLocker". Microsoft. November 7, 2018. Retrieved March 7, 2020.
  56. ^ "Kernel DMA Protection for Thunderbolt™ 3". Microsoft. March 26, 2019. Retrieved March 16, 2020.
  57. ^ Goodin, Dan (October 16, 2017). "Millions of high-security crypto keys crippled by newly discovered flaw". Ars Technica. Condé Nast. Retrieved March 7, 2020.
  58. ^ Busvine, Douglas (October 16, 2017). "Infineon says has fixed encryption flaw found by researchers". Reuters. Retrieved March 7, 2020.

External links