4 ms·

It's all wrapped up in the same technology platform - SecureBoot and BitLocker work together/are the same thing in some cases during the boot process. There are

It's all wrapped up in the same technology platform - SecureBoot and BitLocker work together/are the same thing in some cases during the boot process. There are differences, but I don't want to be pedantic.

cobookman 13y ago
As a non-microsoft employee I'd never know that drive encryption and secure boot settings would be the same 'technology' or even under 'bitlocker'. As bitlocker to me is the same as os x filefault or truecrypt. Why wouldn't you just put bitlocker, anti-virus, secure boot, UAC, ...etc under one menu called 'Comp. Security'.
- AaronFriel 13y ago
  Because then there'd be hundreds of settings in the same folder. This isn't a user-visible menu or a wizard for configuring security settings, this is something for expert users to really modify how their OS is designed. Your suggestion is akin to putting every RHEL/SLED/Ubuntu security setting into one flat configuration file. IPSec, Sudo (and gksudo and friends), anti-virus, cryptfs, apparmor / selinux, ufw / iptables, package signing requirements (including repositories to use), etc. Something like that would never happen even if Red Hat did control all of the pieces of the puzzle. Now contrast Linux versus Windows here: if you want to configure those things you have to discover the tools or file formats for each security layer configuration manually, versus going into "gpedit.msc" and having categorized settings for the whole OS.
  - vetinari 13y ago
    Still, it's the same rationale as sticking your network adapters configuration under http server configuration. The httpd uses the network, right? Still makes no sense.
- derefr 13y ago
  BitLocker is basically its own concept[1], separate from something like Filevault or Truecrypt, and it requires Secure Boot to really do what it does. BitLocker, although it can be used to encrypt external/data volumes, is primarily a technology for encrypting the boot volume and then storing the encryption key in the TPM chip. That encryption key can itself be encrypted using some combination of a passphrase, a biometric signature, and a smart card, which must be presented at startup. In the TPM chip, along with the boot-volume encryption key, there is stored a manifest of SHA signatures for important OS files (specifically, the kernel and drivers required to bring up policy-based security like ACLs and domain authentication.) This manifest is signed by that same encryption key. Thus, the bootstrap loader, having retrieved the credentials necessary to make use of the TPM, can then verify the manifest with the key, and then use the manifest to verify that the OS it's going to boot into can be trusted, and will continue to protect the security of the files stored on the drive when control is passed to it. This whole setup basically means that there's no way to get data off a BitLocker+Secure Boot computer without it allowing it (or, in limited cases, doing tricks with sticking RAM chips in liquid nitrogen.) If you didn't have BitLocker, you could just read the data "at rest"; if you didn't have Secure Boot, you could just install a rootkit and grab the data "in motion." --- [1] Really, I think the only reason the two technologies (BitLocker and Secure Boot) ended up with different names is that they were supposed to be two subfeatures of one initiative -- Microsoft Palladium or http://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base http://en.wikipedia.org/wiki/Next-Generation_Secure_Computin... -- but that initiative was shelved (likely due to the huge public backlash), leaving just these few practical remnants behind. (It's pretty obvious that the BitLocker Settings panel was originally the Palladium Settings panel; it's where you go to reset TPM keys et al.)
ChikkaChiChi 13y ago
Then it should be readily available from the Control Panel and not through GPO. MS hides things in GPO or registry settings when it wants to alleviate the concerns of network administrators while still managing to infuriate the end users who have no business touching 'their' operating system.
rbanffy 13y ago
> It's all wrapped up in the same technology platform And that's, of course, absolutely intuitive.

cobookman 13y ago

As a non-microsoft employee I'd never know that drive encryption and secure boot settings would be the same 'technology' or even under 'bitlocker'. As bitlocker to me is the same as os x filefault or truecrypt. Why wouldn't you just put bitlocker, anti-virus, secure boot, UAC, ...etc under one menu called 'Comp. Security'.

AaronFriel 13y ago
Because then there'd be hundreds of settings in the same folder. This isn't a user-visible menu or a wizard for configuring security settings, this is something for expert users to really modify how their OS is designed. Your suggestion is akin to putting every RHEL/SLED/Ubuntu security setting into one flat configuration file. IPSec, Sudo (and gksudo and friends), anti-virus, cryptfs, apparmor / selinux, ufw / iptables, package signing requirements (including repositories to use), etc. Something like that would never happen even if Red Hat did control all of the pieces of the puzzle. Now contrast Linux versus Windows here: if you want to configure those things you have to discover the tools or file formats for each security layer configuration manually, versus going into "gpedit.msc" and having categorized settings for the whole OS.
- vetinari 13y ago
  Still, it's the same rationale as sticking your network adapters configuration under http server configuration. The httpd uses the network, right? Still makes no sense.
derefr 13y ago
BitLocker is basically its own concept[1], separate from something like Filevault or Truecrypt, and it requires Secure Boot to really do what it does. BitLocker, although it can be used to encrypt external/data volumes, is primarily a technology for encrypting the boot volume and then storing the encryption key in the TPM chip. That encryption key can itself be encrypted using some combination of a passphrase, a biometric signature, and a smart card, which must be presented at startup. In the TPM chip, along with the boot-volume encryption key, there is stored a manifest of SHA signatures for important OS files (specifically, the kernel and drivers required to bring up policy-based security like ACLs and domain authentication.) This manifest is signed by that same encryption key. Thus, the bootstrap loader, having retrieved the credentials necessary to make use of the TPM, can then verify the manifest with the key, and then use the manifest to verify that the OS it's going to boot into can be trusted, and will continue to protect the security of the files stored on the drive when control is passed to it. This whole setup basically means that there's no way to get data off a BitLocker+Secure Boot computer without it allowing it (or, in limited cases, doing tricks with sticking RAM chips in liquid nitrogen.) If you didn't have BitLocker, you could just read the data "at rest"; if you didn't have Secure Boot, you could just install a rootkit and grab the data "in motion." --- [1] Really, I think the only reason the two technologies (BitLocker and Secure Boot) ended up with different names is that they were supposed to be two subfeatures of one initiative -- Microsoft Palladium or http://en.wikipedia.org/wiki/Next-Generation_Secure_Computing_Base http://en.wikipedia.org/wiki/Next-Generation_Secure_Computin... -- but that initiative was shelved (likely due to the huge public backlash), leaving just these few practical remnants behind. (It's pretty obvious that the BitLocker Settings panel was originally the Palladium Settings panel; it's where you go to reset TPM keys et al.)

ChikkaChiChi 13y ago

Then it should be readily available from the Control Panel and not through GPO. MS hides things in GPO or registry settings when it wants to alleviate the concerns of network administrators while still managing to infuriate the end users who have no business touching 'their' operating system.

rbanffy 13y ago

> It's all wrapped up in the same technology platform And that's, of course, absolutely intuitive.