TPM with PIN (Require PIN At Every Startup)

This requirement prevents the computer from starting until the user types a personal identification number (PIN), as illustrated in Figure below. This helps to protect the data in the event the computer is stolen while shut down. You should never use PINs to protect computers that need to start automatically without a human present, such as computers that are configured to start up for maintenance or backup purposes or computers that act as servers.

Note Be sure to change your PIN frequently. Although Trusted Computing Group (TCG)-compliant TPMs offer protection from password-guessing attacks by forcing the user to wait between attempts, laptop keys show wear. This is especially true if you enter the PIN using your rarely used function keys (on most keyboards, you can use the standard number keys as well). If you use the same PIN for years, the keys in your PIN may show more wear than other keys, allowing a sophisticated attacker to guess the characters in your PIN, thus reducing the number of keys the attacker needs to guess. To minimize this risk further, use a long PIN and use the same key multiple times in your PIN.

When requiring a PIN, the computer's TPM hardware forces a non-resettable delay between PIN entry attempts (the exact delay varies between TPM vendors). Because of this delay, a four-digit PIN might take an entire year to crack. Without this delay, a random four-digit PIN could be cracked in less than a day. Because of this password-guessing weakness when a delay is not enforced by TPM, BitLocker does not allow PIN authentication on computers that do not have TPM hardware.

PIN Authentication

In this authentication scenario, the administrator sets up a PIN when BitLocker is turned on. BitLocker hashes the PIN using SHA-256. The resulting nonreversible hash is used as authorization data sent to the TPM to seal the VMK. The VMK is now protected by both the TPM and the PIN. To unseal the VMK, the user enters the PIN when the computer starts, the PIN is hashed, and the result is submitted to the TPM. If the submitted hash and other platform configuration registers (PCRs) are correct (proving that the user entered the same PIN), the TPM unseals the VMK.

The following authentication techniques are available regardless of whether the computer has a TPM.