1

I use TPM2.0 + Bitlocker + PIN to encrypt SSD with Windows 10 Professional. I have backed up recovery password and continued. After the encryption complete and two reboots behind I can write in console:

manage-bde -protectors -get c:

,and it shows me plaintext (!!!) recovery password:

BitLocker Drive Encryption: Configuration Tool version 10.0.18362
Copyright (C) 2013 Microsoft Corporation. All rights reserved.

Volume C: []
All Key Protectors

    Numerical Password:
      ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
      Password:
        XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX-XXXXXX

    TPM And PIN:
      ID: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
      PCR Validation Profile:
        7, 11
        (Uses Secure Boot for integrity validation)

Plaintext password for disk encryption with TPM in 2019? Really? Why do I need TPM then?

I have tried to find something in manage-bde to solve the problem, but with no luck.

Is there a way to hide it or make unrecoverable (for example, when only passwords hash saved, not plaintext)?

1

The purpose of the TPM (in this case) is to securely hold the decryption key so that the system can boot automatically without user intervention. The system is simply providing a way to retrieve the recovery key (for recovery scenarios such as ones that include removing the hard drive), but it does so in a secure way. First, it requires the system to successfully boot in order to retrieve it (thus going through the decryption process) and second, it requires administrative access.

  • We talk about security and cryptography. I still do not get it why Microsoft developers do not store the salted hash. If you were a developer who needed to create the most unbreakable system, would you save it in plaintext too? – muhazzz Jul 26 at 14:52
  • Give them slightly more credit. The decryption key must exist in the clear somewhere (in this case, in the TPM), otherwise it would be unable to decrypt the hard drive. Hashing it is useless in this case. The system is willing to give you the recovery key because of the conditions under which it happens: 1) the data has already been decrypted and 2) you have administrative access to the device. If an attacker has already met both of these conditions, there is no benefit to hiding the recovery key because they already have full access to the machine and full access to the data. – dzampino Jul 26 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.