The boot key problem

One affair to abode in abounding deejay encryption is that the blocks area the operating arrangement is stored accept to be decrypted afore the OS can boot, acceptation that the key has to be accessible afore there is a user interface to ask for a password. A lot of Abounding Deejay Encryption solutions advance Pre-Boot Affidavit by loading a small, awful defended operating arrangement which is carefully bound down and hashed against arrangement variables to analysis for the candor of the Pre-Boot kernel. Some implementations such as BitLocker Drive Encryption can accomplish use of accouterments such as a Trusted Platform Module to ensure the candor of the cossack environment, and thereby annul attacks that ambition the cossack loader by replacing it with a adapted version. This ensures that affidavit can yield abode in a controlled ambiance after the achievability of a bootkit getting acclimated to capsize the pre-boot decryption.

With a Pre-Boot Affidavit environment, the key acclimated to encrypt the abstracts is not decrypted until an alien key is ascribe into the system.

Solutions for autumn the alien key include:

Username / password

Using a smartcard in aggregate with a PIN

Using a biometric affidavit adjustment such as a fingerprint

Using a dongle to abundance the key, bold that the user will not acquiesce the dongle to be baseborn with the laptop or that the dongle is encrypted as well.

Using a boot-time disciplinarian that can ask for a countersign from the user

Using a arrangement altering to balance the key, for instance as allotment of a PXE boot

Using a TPM to abundance the decryption key, preventing crooked admission of the decryption key or abolishment of the cossack loader.

Use a aggregate of the above

All these possibilities accept capricious degrees of security, about a lot of are bigger than an unencrypted disk