Extracting Bitlocker Keys from a TPM
pulsesecurity.co.nz
Extracting Bitlocker Keys from a TPM
1–10 of 41 posts
Re: Extracting Bitlocker Keys from a TPM
#2Very nice article. I was pondering the same attack surface when using luks-tpm2 package on Arch that works just like Bitlocker in basic (non PIN) configuration.
Re: Extracting Bitlocker Keys from a TPM
#3Ahhh, I was very concerned until I got to the part about pre-boot verification. That is definitely a critical part of full disk encryption, and should really be the default. (Although I’ll admit that it’s really annoying sometimes.)
Re: Extracting Bitlocker Keys from a TPM
#4SGX could mitigate this — it’s much more resistant to this type of attack than the TPM.
Re: Extracting Bitlocker Keys from a TPM
#5SGX could mitigate this — it’s much more resistant to this type of attack than the TPM.
How? The lack of trusted I/O in SGX seems like it would make secure disk encryption rather hard. You still need to use something like a password for access control. While it can be mixed with a key in SGX, you have to get that password into SGX from untrusted space. At least in the TPM architecture there's some effort to establish a trusted pre-boot environment where you can enter a password/PIN.
Then, sure, you could keep the data encryption keys within SGX, but the decrypted data is going to come out of it. So, once you have the password, you can ask SGX to decrypt the drive for you.
I don't see how SGX is well-suited for drive encryption use cases. It's mostly for trusted execution.
Re: Extracting Bitlocker Keys from a TPM
#6FWIW in the earlier days of BitLocker (when it was called cornerstone) a preboot PIN was considered then default secure setting.
Working in the 16-bit boot loader places some serious restrictions on numeric text entry. If you have to consider the 100 or so keyboard layouts that windows supported at that time, so the pin was required to be entered using function keys F1 F2 etc. because they’re on all keyboard layouts
Source: I was on the Palladium/NGSCB/BitLocker team from 2002-5
Re: Extracting Bitlocker Keys from a TPM
#7Ahhh, I was very concerned until I got to the part about pre-boot verification. That is definitely a critical part of full disk encryption, and should really be the default. (Although I’ll admit that it’s really annoying sometimes.)
I agree the pre-boot verification and PIN should be a default. Otherwise, just having the hardware makes it insecure. All hardware is insecure with physical access of course, but it should be more difficult to access even for someone with a logic analyzer.
Regarding annoyance, one of the most significant inconveniences I've experienced is the inability to boot when the hardware changes significantly, e.g. installing a new graphics card.
Fortunately the solution is easy: boot with the old hardware configuration, pause Bitlocker, install new hardware, resume Bitlocker. I feel this is safe as it requires you (with your PIN) to unlock the drive to perform the pause operation.
Re: Extracting Bitlocker Keys from a TPM
#8I knew several of the acronyms in the article but some were new to me. Here are some references in case anyone is in the same boat.
TPM: Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. [0]
PCR: A Platform Configuration Register (PCR) is a memory location in the TPM that has some unique properties. The size of the value that can be stored in a PCR is determined by the size of a digest generated by an associated hashing algorithm. [1]
LPC: The Low Pin Count bus, or LPC bus, is a computer bus used on IBM-compatible personal computers to connect low-bandwidth devices to the CPU, such as the boot ROM, "legacy" I/O devices (integrated into a super I/O chip), and Trusted Platform Module (TPM). [2]
VMK: Volume Master Key. The FVEK and/or TWEAK keys are encrypted using another key, namely the Volume Master Key (VMK). Several copies of the VMK are also stored in the metadata. Each copy of the VMK is encrypted using another key, also know as key-protector key. [3]
[0] https://en.wikipedia.org/wiki/Trusted_Platform_Module
[1] https://docs.microsoft.com/en-us/windows/security/informatio...
[2] https://online.tugraz.at/tug_online/voe_main2.getvolltext?pC...
[3] https://www.forensicswiki.org/wiki/BitLocker_Disk_Encryption
Re: Extracting Bitlocker Keys from a TPM
#9I knew several of the acronyms in the article but some were new to me. Here are some references in case anyone is in the same boat. TPM: Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. [0] PCR: A Platform Configuration Register (PCR) is a memory location…
> TPM: Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. [0]
Introduced around the time of Windows Vista by Hollywood to provide unbreakable HW drm throughout the OS.
I’ve never once enabled this malicious, user-hostile hardware.
Re: Extracting Bitlocker Keys from a TPM
#10This is excellent. I've been wondering/troubled about the ease of use of bitlocker. Nice to get confirmation that standard bitlocker is rubbish against real attackers.
Sad however, that the only additional defense appear to be "more blind trust in hardware" and no option for key derived from a passphrase.
We know from the Xbox hack that keys in cheap hw isn't secure (enough).