I got this query while distrohopping. On Linux I have to enter my password erveytime I boot to decrypt the disk. But on windows I never had to do it. The first time windows bitlocker asked for password was when I booted into windows after installed Linux. Why is it so?
Bitlocker stores the key required to boot the system in the TPM.
You can do that on Linux too if you want to, using Clevis or systemd-cryptenroll.
As far as I know, Bitlocker uses two keys to boot: There’s a key in the TPM, that’s used to decrypt a key stored on the drive, that’s used to decrypt the data.
I think some data (maybe just user-specific data?) is encrypted with a user-specific key too, that isn’t unlocked until you log in.Edit: I think I was thinking of DPAPI.I’m not 100% sure about the specifics of its design.
To expand: both bitlocker and LUKS (what OP probably uses on Linux) can unlock without userinput from TPM or require a user password or use the TPM and a password. Its just the defaults are different. In all cases, the TPM/passwords are used to decrypt the Volume Master Key that is used to de/encrypt the actual disk. If you change your password you don’t have to reencrypt 2TB of hard drive and wait 20+h.
With TPM only unlock, secure boot/verified boot is used to ensure the hard disk is accessed using the correct operating system and no meaningful changes have been made to the system since the last boot. With bitlocker, several vulnerabilities in bitlocker allow full decryption in TPM only mode because windows is fundamentally broken. So you should always use pin+TPM unlock.
PS. about the encrypted user data: that is not part of bitlocker. It encrypts the whole drive and that’s it. DPAPI is a windows component that encrypts some user data with the user password. For example chrome cookies are saved in DPAPI so even an administrator can not read your cookies while you are not logged in to the system (if you log in they can read everything)
I doubt that it is the case - it encrypts
diskpartition , not user specific data AFAIK. It has a single key AFAIK.Yeah I think I was thinking of DPAPI. Updating my comment!