this post was submitted on 20 Jul 2026
18 points (87.5% liked)

Asklemmy

54967 readers
498 users here now

A loosely moderated place to ask open-ended questions

Search asklemmy ๐Ÿ”

If your post meets the following criteria, it's welcome here!

  1. Open-ended question
  2. Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
  3. Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
  4. Not ad nauseam inducing: please make sure it is a question that would be new to most members
  5. An actual topic of discussion

Looking for support?

Looking for a community?

~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~

founded 7 years ago
MODERATORS
 

I got this query while distrohopping. On Linux I have to enter my password erveytime I boot to decrypt the disk. But on windows I never had to do it. The first time windows bitlocker asked for password was when I booted into windows after installed Linux. Why is it so?

you are viewing a single comment's thread
view the rest of the comments
[โ€“] dan@upvote.au 34 points 1 day ago* (last edited 1 day ago) (2 children)

Bitlocker stores the key required to boot the system in the TPM.

You can do that on Linux too if you want to, using Clevis or systemd-cryptenroll.

As far as I know, Bitlocker uses two keys to boot: There's a key in the TPM, that's used to decrypt a key stored on the drive, that's used to decrypt the data.

~~I think some data (maybe just user-specific data?) is encrypted with a user-specific key too, that isn't unlocked until you log in.~~ Edit: I think I was thinking of DPAPI.

I'm not 100% sure about the specifics of its design.

[โ€“] groet@feddit.org 6 points 1 day ago

To expand: both bitlocker and LUKS (what OP probably uses on Linux) can unlock without userinput from TPM or require a user password or use the TPM and a password. Its just the defaults are different. In all cases, the TPM/passwords are used to decrypt the Volume Master Key that is used to de/encrypt the actual disk. If you change your password you don't have to reencrypt 2TB of hard drive and wait 20+h.

With TPM only unlock, secure boot/verified boot is used to ensure the hard disk is accessed using the correct operating system and no meaningful changes have been made to the system since the last boot. With bitlocker, several vulnerabilities in bitlocker allow full decryption in TPM only mode because windows is fundamentally broken. So you should always use pin+TPM unlock.

PS. about the encrypted user data: that is not part of bitlocker. It encrypts the whole drive and that's it. DPAPI is a windows component that encrypts some user data with the user password. For example chrome cookies are saved in DPAPI so even an administrator can not read your cookies while you are not logged in to the system (if you log in they can read everything)

[โ€“] Mihies@programming.dev 4 points 1 day ago* (last edited 1 day ago) (1 children)

I doubt that it is the case - it encrypts ~~disk~~ partition , not user specific data AFAIK. It has a single key AFAIK.

[โ€“] dan@upvote.au 2 points 1 day ago

Yeah I think I was thinking of DPAPI. Updating my comment!