3 ms·
No. BitLocker when it uses the TPM uses verified boot. PCRs are filled during the boot process, recording the boot state. If the boot state does not match, the
by my123 6y ago
No. BitLocker when it uses the TPM uses verified boot.
PCRs are filled during the boot process, recording the boot state. If the boot state does not match, the TPM will not release the key.
- geofft 6y agoThen it shouldn't matter whether you can modify a hibernated Linux image to gain arbitrary code execution in ring 0, right? (That is, the benefit of securely implementing Linux lockdown hibernation would be a direct benefit for Linux users who care about lockdown and hibernation, as opposed to an indirect benefit for Windows / BitLocker users who don't want to be attacked through Linux.)
- my123 6y agoYes, the benefit of securely implementing hibernation with Secure Boot on for Linux is a direct benefit for Linux users, no impact one way or another for those using Windows.
- geofft 6y agoOK - that matches my understanding, that the threat model of BitLocker includes the possibility of attackers having ring 0 access using a different OS. I've downvoted the comment I originally replied to, since it appears to be totally wrong.