4 ms·
Why does MS full disk encryption require TPM?
by pyuser583 6y ago
Why does MS full disk encryption require TPM?
- nvrspyx 6y agoI believe the TPM is where the private encryption key is kept.
- tsbinz 6y agoIt doesn't (it does heavily push you towards it, but you don't need it), you can edit a group policy in order to be able to store the key on a usb drive or to use a passphrase.
- mkup 6y agoTo solve chicken and egg problem. In order to enter password, you need to boot full OS (with keyboard and display drivers, for example); but to decrypt OS boot drive you need a password (or more precisely, some key material derived from the password). So a copy of that key material is stored in a TPM, and provided to software only if measured boot goes as usual (i.e. this is not a Linux booting from USB thumbdrive).