0

My laptop is not equipeed with a TPM. I have enabled bypass group policy to use BitLocker with a USB thumb drive.

Under certain circumstances I would like to upgrade my authentication by adding a PIN to an exsting encrypted system drive. Or later to remove the USB thumbdrive authentication in favour of PIN/password only.

I have already set up the group policy to allow these settings but I can find no option in the BitLocker settings screen to upgrade security for my system drive. It is instead available to my secondary drive (which is auto-decrypted when the system boots up).

I imagine that I could decrypt the entire drive and perform re-encryption with new settings.

I want to ask if there is any shorter way to accomplish this

0

Well, after thinking a bit about it I concluded an answer made of good sense.

If it was ever possible to add a PIN to an existing Bitlocker-encrypted system drive that is unlocked with a USB key in absence of a TPM the added security would be exactly equal to zero. Only secure procedure is to fully decrypt the disk and re-encrypt using stronger security

Why can't be this done on a USB-powered encryption (and vice versa)?

BitLocker uses symmetric cryptography. I haven't gone into the details but using a PIN or a thumb drive with a secret that can reveal the encryption key equals (from the security point of view) to assuming that the drive or the PIN is the key.

So you have your friendly setup where you already exported the key to a USB drive or memorized under the form of a PIN/password. That key exists, and that key can decrypt the disk. Suppose that the key gets compromised. The system asks for an additional password. But since the key is contained in the thumb drive, an attacker with physical disk access may still use the key to decrypt the drive because the symmetric key is all the information needed to decrypt information. The attacker can use any software under his control that does not require silly additional authentication

Why CAN this be done on a TPM setup?

The TPM is a different device. The key, or the secret information that is used to derive the decryption key, exists within the bounds of an active computer system, acting as a vault. If you change your vault's lock, the vault will refuse to open without new authentication.

The OS, who controls (owns) the TPM may kindly request the TPM not to release the key anymore unless additional authentication is provided. With a TPM and with the exception of the escrow keys that BitLocker generates, the key can never be exposed. One can change the PIN/password at will, still no one possesses a medium with the byte array of the secret key available.

  • 1
    But since the key is contained in the thumb drive, an attacker with physical disk access may still use the key to decrypt the drive because the symmetric key is all the information needed to decrypt information. This is NOT true. If you enable PIN authentication in addition to the USB key, both are required to unlock the drive. This improves your security because now you must have something (USB drive) and know something (The PIN) to unlock. – Twisty Impersonator Apr 26 '17 at 23:28
  • See superuser.com/q/116080/213131 – Twisty Impersonator Apr 26 '17 at 23:31
  • I strongly suggest you fix the inaccuracies in your answer – Ramhound Apr 27 '17 at 1:28

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.