Operation
Like its official name, BitLocker Drive Encryption is a logical volume encryption system. A volume may or may not be an entire drive, and cannot span one or more physical drives. Also, when disabled, TPM and BitLocker cannot ensure the integrity of the trusted boot path (e.g. BIOS, boot sector, etc.), in order to prevent most offline physical attacks, boot sector malware, etc.
In order for BitLocker to operate, the hard disk requires at least two NTFS-formatted volumes: one for the operating system (usually C:) and another with a minimum size of 100 MB from which the operating system boots. BitLocker requires the boot volume to remain unencrypted—on Windows Vista this volume must be assigned a drive letter, while on Windows 7 that is not required. Unlike previous versions of Windows, Vista's "diskpart" command-line tool includes the ability to shrink the size of an NTFS volume so that the system volume for BitLocker may be created from already-allocated space. A tool called the "BitLocker Drive Preparation Tool" is also available from Microsoft that allows an existing volume on Windows Vista to be shrunk to make room for a new boot volume, and for the necessary bootstrapping files to be transferred to it; Windows 7 creates the secondary boot volume by default, even if BitLocker is not used initially.
Once an alternate boot partition has been created, the TPM module needs to be initialized (assuming that this feature is being used), after which the required disk encryption key protection mechanisms such as TPM, PIN, or USB key are configured. The volume is then encrypted as a background task, something that may take a considerable amount of time with a large disk as every logical sector is read, encrypted, and rewritten back to disk. The keys are only protected after the whole volume has been encrypted, when the volume is considered secure. BitLocker uses a low-level device driver to encrypt and decrypt all file operations, making interaction with the encrypted volume transparent to applications running on the platform.
The Microsoft Encrypting File System (EFS) may be used in conjunction with BitLocker to provide protection once the operating system kernel is running. Protection of the files from processes and users within the operating system can only be performed using encryption software that operates within Windows, such as EFS. BitLocker and EFS, therefore, offer protection against different classes of attacks.
In Active Directory environments, BitLocker supports optional key escrow to Active Directory, although a schema update may be required for this to work (i.e. if the Active Directory Services are hosted on a Windows version previous to Windows Server 2008).
Other systems similar to BitLocker can have their recovery key/password entry process spoofed by another bootmanager or OS install. Once the spoofed software captured the secret, it could be used to decrypt the Volume Master Key (VMK), which would then allow access to decrypt or modify any information on the user's BitLocker-encrypted hard disk. By configuring a TPM to protect the trusted boot pathway, including the BIOS and boot sector, this threat can be removed.
Read more about this topic: Bit Locker Drive Encryption
Famous quotes containing the word operation:
“You may read any quantity of books, and you may almost as ignorant as you were at starting, if you don’t have, at the back of your minds, the change for words in definite images which can only be acquired through the operation of your observing faculties on the phenomena of nature.”
—Thomas Henry Huxley (1825–95)
“Human knowledge and human power meet in one; for where the cause is not known the effect cannot be produced. Nature to be commanded must be obeyed; and that which in contemplation is as the cause is in operation as the rule.”
—Francis Bacon (1560–1626)
“An absolute can only be given in an intuition, while all the rest has to do with analysis. We call intuition here the sympathy by which one is transported into the interior of an object in order to coincide with what there is unique and consequently inexpressible in it. Analysis, on the contrary, is the operation which reduces the object to elements already known.”
—Henri Bergson (1859–1941)