<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=WordSection1>
<p class=MsoNormal><span style='color:#1F497D'>I had a compatibility problem
with Acronis TrueImage, and TrueCrypt. Supposedly, however, there is no
problem with BitLocker. I won't be able to actually *test* that until
later today, or tonight. I'm starting BitLocker now, and thought I'd share
...<o:p></o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='color:#1F497D'>Bitlocker is different than I
expected, in a kinda cool way. The cool part is not so much BitLocker,
but the TPM. My expectation, which seems to be pretty consistent with
everything else, is that you have to type in a password to decrypt your
encrypted drive. But the TPM does a much cooler job... making it so you
don't need to do anything at all, and still the system is trusted secure.
Although BitLocker uses the TPM, it's not the *only* thing that can use
it. AFAIK, there's nothing preventing other encryption tools from using
it too. Here's a useful article, and my summary of the important points:</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'><a
href="http://windows.microsoft.com/en-US/windows-vista/BitLocker-Drive-Encryption-Overview">http://windows.microsoft.com/en-US/windows-vista/BitLocker-Drive-Encryption-Overview</a></span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>TPM is a piece of hardware, kind
of like a BIOS-level usb boot disk. It's disabled by default in
BIOS. If enabled, during power-on, it will read certain blocks of the hard
disk, compute a hash and compare against previously computed values, to verify
the OS hasn't been tampered with. If successful, it will then make itself
readable one-time, so the OS can fetch the encryption keys. And then the
OS is able to decrypt the hard drive.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>You are relying on the OS to
provide login security. An attacker can't read your drive by removing it
from the computer. The only way to read your drive is to boot from it,
untampered, with TPM enabled, on the same computer where it was first enabled.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>The obvious fears are: (a)
What if I intentionally reinstall or change my OS? and (b) What if my
laptop dies and I need to read that hard disk in another computer?</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>(a) If the TPM checksum fails,
the TPM simply doesn't release the keys. If you're intentionally running
some other OS, it will still work, as long as it has no need for your
encryption keys. But if you intentionally tamper with your OS ... like
... install a custom MBR or change the boot partition, or something like that
... You better carefully consider whether it will cause a problem, and how to
handle it. I don't know that level of detail right now. You can
always avoid every problem by decrypting your drive before making such changes,
and then re-encrypting your drive afterward. But there may be faster or
better ways to handle such situations when they occur.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>(b) If the hard drive is removed
from the computer, it's not readable, because the encryption keys are not
known. But during the process of enabling the TPM, you had the option of
saving your keys to a file, which your IT person has surely done, and saved in
a secure location. ;-) So your IT person can attach the drive to
another computer and read it, but an attacker would have a hard time.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>If desired, you can deploy
BitLocker via Group Policy. I don't know how to do that, and I don't know
what implications it may have.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>If desired, you can do all sorts
of other cool stuff, like require a password or PIN or a smartcard, in addition
to the untampered OS, to unlock TPM.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'> </span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'>If desired, you can use things
like PIN or smartcard or biometrics as a windows authentication
augmentation. Configuration of such features, at least on my system, are
pretty brainless and simple. I'm sure this can be deployed by Group Policy
too, but there's a simple software tool under the start menu.</span><o:p></o:p></p>
<p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p>
</div>
</body>
</html>