TPM with PIN and External Key

In Windows 7 and Windows Vista SP1, you have an additional option for BitLocker security on computers with a TPM: requiring the user to type a PIN and insert a USB key. This provides the highest level of BitLocker protection by requiring something the user knows (the PIN) and something the user has (the external key). For an attacker to successfully access data on a BitLocker-protected partition, the attacker needs to acquire the computer with the hard disk, have the USB key, and work with the computer's owner to acquire the PIN.

You must use the Manage-bde.exe BitLocker command-line tool to configure this authentication option. Manage-bde.exe is discussed later in this section.

External Key (Require Startup USB Key At Every Startup)

The user provides the VMK on a USB flash drive or similar external storage so that BitLocker can decrypt the FVEK and the volume without requiring TPM hardware. The external key can be either the standard key or a recovery key created to replace a lost external key.

Using a startup key without TPM does allow you to encrypt a volume without upgrading your hardware. However, it does not provide boot integrity, and it will not detect whether the hard disk has been moved to a different computer.

Recovery Password

The user enters a 48-character recovery password, which decrypts the VMK, granting access to the FVEK and the volume. The recovery password is designed with checksums so that IT support can read the password to a user over the phone and easily detect whether a user has mistyped a character. For more information, read the section titled "How to Recover Data Protected by BitLocker" later in this tutorial.

Clear Key

No authentication occurs. BitLocker does not check the integrity of the computer or operating system, and the VMK is freely accessible, encrypted with a symmetric key stored in the clear on the hard disk. However, the volume remains, in fact, encrypted. This is used only when BitLocker is disabled (to upgrade the computer's BIOS, for example). When BitLocker is re-enabled, the clear key is removed and the VMK is rekeyed and re-encrypted. For more information, read the section titled "How to Disable or Remove BitLocker Drive Encryption" later in this tutorial.