TPM alone is not enough The "Transparent operation mode" and "User authentication mode" of BitLocker use TPM hardware to detect whether there are unauthorized changes to the pre-boot environment, including the
BIOS and
MBR. If any unauthorized changes are detected, BitLocker requests a recovery key on a USB device. This cryptographic secret is used to decrypt the Volume Master Key (VMK) and allow the
bootup process to continue. However, TPM alone is not enough: • In February 2008, a group of security researchers published details of a so-called "
cold boot attack" that allows full disk encryption systems such as BitLocker to be compromised by booting the machine from removable media, such as a USB drive, into another operating system, then
dumping the contents of pre-boot memory. The attack relies on the fact that
DRAM retains information for up to several minutes (or even longer, if cooled) after the power has been removed. The
Bress/Menz device, described in US Patent 9,514,789, can accomplish this type of attack. Similar full disk encryption mechanisms of other vendors and other operating systems, including
Linux and
Mac OS X, are vulnerable to the same attack. The authors recommend that computers be powered down when not in physical control of the owner (rather than be left in a
sleep mode) and that the encryption software be configured to require a password to boot the machine. • BitLocker still does not properly support TPM 2.0 security features which, as a result, can lead to a complete bypass of privacy protection when keys are transmitted over
Serial Peripheral Interface in a motherboard. All these attacks require physical access to the system and are thwarted by a secondary protector such as a USB flash drive or PIN code.
Upholding Kerckhoffs's principle Although the AES encryption algorithm used in BitLocker is in the
public domain, its implementation in BitLocker, as well as other components of the software, are
proprietary; however, the code is available for scrutiny by Microsoft partners and enterprises, subject to a
non-disclosure agreement. According to Microsoft sources, BitLocker does not contain an intentionally built-in
backdoor, so there is no Microsoft-provided way for
law enforcement to have guaranteed access to the data on a user's drive. In 2006, the
UK Home Office expressed concern over the lack of a backdoor and tried entering into talks with Microsoft to get one introduced. Microsoft developer and cryptographer
Niels Ferguson denied the backdoor request and said, "over my dead body". Microsoft engineers have said that United States
Federal Bureau of Investigation agents also put pressure on them in numerous meetings to add a backdoor, although no formal, written request was ever made; Microsoft engineers eventually suggested that agents should look for the
hard copy of the
encryption key that the BitLocker program suggests that its users make. Niels Ferguson's position that "back doors are simply not acceptable"
Other concerns Starting with Windows 8 and Windows Server 2012, Microsoft removed the Elephant Diffuser from the BitLocker scheme for no declared reason. Dan Rosendorf's research shows that removing the Elephant Diffuser had an "undeniably negative impact" on the security of BitLocker encryption against a targeted attack. Microsoft later cited performance concerns, and noncompliance with the
Federal Information Processing Standards (FIPS), to justify the diffuser's removal. Starting with Windows 10 version 1511, however, Microsoft added a new FIPS-compliant
XTS-AES encryption algorithm to BitLocker. Starting with Windows 10 version 1803, Microsoft added a new feature called "Kernel Direct Memory access (DMA) Protection" to BitLocker, to protect against
DMA attacks via
Thunderbolt 3 ports. "Kernel Direct Memory access (DMA) Protection" only protects against attacks through Thunderbolt. Direct Memory Access is also possible through
PCI Express. In this type of attack an attacker would connect a malicious
PCI Express Device, which can in turn write directly to the memory and bypass the Windows login. To protect against this type of attack, Microsoft introduced "Virtualization-based Security". In October 2017, it was reported that a flaw enabled private keys to be inferred from
public keys, which could allow an attacker to bypass BitLocker encryption when an affected TPM chip is used. The flaw is the Return of Coppersmith's Attack or
ROCA vulnerability which is in a code library developed by
Infineon and had been in widespread use in security products such as
smartcards and TPMs. Microsoft released an updated version of the firmware for Infineon TPM chips that fixes the flaw via Windows Update. == See also ==