Thomphoolery
Constable Thomas Van Hoolery
Guild Member
Posts: 3951
429.00g
View Inventory
Send Money to Thomphoolery
|
 |
« Reply #23 on: April 06, 2010, 02:01:24 PM » |
|
A few interesting things if you are a security nut:
BitLocker is more than just 'disk encryption'. BitLocker is the first OS-shipping tool to utilize the TPM hardware present in most modern platforms.
To give you an idea of how awesome BitLocker is, it operates off of a TPM foundation known as 'Dynamic Root of Trust'. Basically, in order to "trust" that a system has not been tampered with, most systems do this:
1) Cold boot 2) The BIOS is trustworthy - start there 3) Boot the OS, compare current hardware/memory hashes to known "trusted" values. Add this to the TPM 'trust register' 4) As you launch more applications, snapshot the system through hashes to keep expanding the trust register
The trust chain goes all the way to boot-up - however as soon as this chain is broken, the only way for a system to be trusted again is to cold boot it and start over. For users of BitLocker, this basically means: "I cannot trust my system enough to put in my authentication credentials. No trust == no decryption".
In comes 'dynamic root of trust', a process run by the hardware and driven by companies like Intel, Microsoft, and others. When an application asks to be dynamically trusted, the OS (with help from the hardware) provides a trusted launching point - A totally clean, virtualized, springboard to begin the trust chain. Cold booting a system is no longer necessary, as the hardware can provide roots of trust dynamically.
So how does this apply to BitLocker? From the day the chipset on your motherboard is installed, the TPM hardware (most likely Intel's iTPM chipset) generated a huge (think 2048 bit) prime number to use as its private key. It is unique to the hardware, and NO ONE is able to read it. Not ever. Now, BitLocker wants to encrypt your data. It asks for a dynamic root of trust to begin an untampered, unattacked section of memory to encrypt. It then uses the hardware-accessible-only private key that was generated at build time to encrypt the data. Your public key is given by the BitLocker issuer. When you decrypt, the same process takes place.
It's really really slick, and incredibly high-tech. It's not your standard disk encryption.
-j
|