How BitLocker Encrypts Data

BitLocker encrypts entire volumes. The contents of the volumes can be decrypted only by someone with access to the decryption key, known as the Full Volume Encryption Key (FVEK). Windows 7 actually stores the FVEK in the volume metadata; this is not a problem because the FVEK itself is encrypted using the Volume Master Key (VMK).

Both the FVEK and the VMK are 256 bits. The FVEK always uses AES encryption to protect the volume. By editing the Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Choose Drive Encryption Method And Cipher Strength Group Policy setting, you can set the specific AES encryption strength to one of four values:

• AES 128 bit with Diffuser (this is the default setting)
• AES 256 bit with Diffuser (this is the strongest setting, but using it might negatively affect performance)
• AES 128 bit
• AES 256 bit

More Info For more information about the encryption algorithms used and the use of diffusers, read "AES-CBC + Elephant Diffuser: A Disk Encryption Algorithm for Windows Vista," at http://download.microsoft.com/download/0/2/3/0238acaf-d3bf-4a6d-b3d6-0a0be4bbb36e/BitLockerCipher200608.pdf.

Windows Vista and Windows 7 encrypt and decrypt disk sectors on the fly as data is read and written (as long as it has access to the FVEK) using the FVE Filter Driver (Fvevol.sys). As shown in Figure below, the FVE Filter Driver, like all filter drivers, resides between the file system (which expects to receive the unencrypted contents of files) and the volume manager (which provides access to the volume). Therefore, applications and users are not aware of encryption when everything is functioning normally.

Encrypting and decrypting data do affect performance. While reading from and writing to a BitLocker-encrypted volume, some processor time will be consumed by the cryptographic operations performed by BitLocker. The actual impact depends on several factors, including caching mechanisms, hard drive speed, and processor performance. However, Microsoft has put great effort into implementing an efficient AES engine so that the performance impact on modern computers is minimal.