1

My computer doesn't have TPM

There is an option to turn on bitlocker if only I used USB to store the private key

How would security be affected on that scenario?

will it be as safe as TPM?

If my house got raided by FBI or syariah cops, for example, and they found the USB but doesn't know my windows password, will my data be okay?

If I rarely shut down my computer and only put them to sleep, can I just hide the USB somewhere?

Also how do I explain this

On computers without a compatible TPM, BitLocker can provide encryption, but not the added security of locking keys with the TPM. In this case, the user is required to create a startup key that is stored on a USB flash drive.

http://windows.microsoft.com/en-id/windows-vista/bitlocker-drive-encryption-overview

2

The USB stick would still need to be used in conjunction with the bitlocker password to decrypt the drive, all the TPM module does is store it on the module so you have no need to carry an easily lost USB stick.

if you don't tell them your Bitlocker password you are just as protected

  • But then FBI can get my private key on the USB? – user4951 Sep 11 '14 at 12:48
  • Can anyone confirm this? – user4951 Sep 11 '14 at 12:48
  • Yes they can get your private key, so one in sense its not as secure as TPM but in another sense without the password its just as secure... – CharlesH Sep 11 '14 at 12:50
  • And once they got my private key, FBI can decrypt the drive with it right? – user4951 Sep 11 '14 at 12:57
  • Even though FBI doesn't know the password? – user4951 Sep 11 '14 at 12:57
0

The security model is different. (This answer is a work in progress.)

Startup key on USB flash drive

Pros:

  • No need for a TPM.
  • 2FA: user needs both the startup key (stored on a USB flash drive by default) and the PC, in order to decrypt the system disk.

Cons:

  • You might accidentally overwrite or format your USB flash drive, requiring you to manually enter the recovery key in order to be able to boot Windows. This risk can be mitigated by using a USB flash drive with hardware write-protection.
  • If your USB flash drive is lost or stolen, then an attacker who comes into possession of it can read (and copy) the startup key from it. This particular attack can be mitigated by using a hardware-encrypted USB flash drive (e.g. this; there are other brands available).
  • If your PC is sufficiently compromised, then an attacker could potentially read the startup key from your USB flash drive while it is inserted into the PC during the boot process. This will be true even for hardware-encrypted USB flash drives, as they must be unlocked in order for the PC to boot. However, if your PC were compromised to this extent, then whoever compromised it would probably already be in a position to read everything that BitLocker is protecting, i.e. the startup key would probably be superfluous for them.

TPM

Pros:

  • No need to purchase a USB flash drive.
  • No risk of that USB flash drive being lost or stolen.
  • Unlike USB flash drives, TPMs are intended to prevent the private data that they store from being read. Instead, they use challenge-response mechanisms. As such, an attacker without advanced skills or equipment will not be able to retrieve the private key from a TPM.

Cons:

  • Attackers with advanced skills or equipment, and with electronic or physical access to the PC, may be able to retrieve the private key from a TPM, e.g. by:

  • Attackers with sufficiently advanced skills may be able to fool the TPM into performing the challenge-response successfully even if Windows has been modified by an attacker. (This is more of an attack against "secure boot" than against BitLocker per se.) However, if your PC were compromised to this extent, then whoever compromised it might already be in a position to read everything that BitLocker is protecting.
  • If you move the BitLocker-protected drive to another PC, you will need to manually enter the recovery key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.