21
Why does Linux require password for decryption but not windows?
(sh.itjust.works)
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 20 Jul 2026
21 points (100.0% liked)
Asklemmy
55310 readers
511 users here now
A loosely moderated place to ask open-ended questions
Search asklemmy ๐
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 7 years ago
MODERATORS
Bitlocker stores the key required to boot the system in the TPM.
You can do that on Linux too if you want to, using Clevis or systemd-cryptenroll.
As far as I know, Bitlocker uses two keys to boot: There's a key in the TPM, that's used to decrypt a key stored on the drive, that's used to decrypt the data.
~~I think some data (maybe just user-specific data?) is encrypted with a user-specific key too, that isn't unlocked until you log in.~~ Edit: I think I was thinking of DPAPI.
I'm not 100% sure about the specifics of its design.
To expand: both bitlocker and LUKS (what OP probably uses on Linux) can unlock without userinput from TPM or require a user password or use the TPM and a password. Its just the defaults are different. In all cases, the TPM/passwords are used to decrypt the Volume Master Key that is used to de/encrypt the actual disk. If you change your password you don't have to reencrypt 2TB of hard drive and wait 20+h.
With TPM only unlock, secure boot/verified boot is used to ensure the hard disk is accessed using the correct operating system and no meaningful changes have been made to the system since the last boot. With bitlocker, several vulnerabilities in bitlocker allow full decryption in TPM only mode because windows is fundamentally broken. So you should always use pin+TPM unlock.
PS. about the encrypted user data: that is not part of bitlocker. It encrypts the whole drive and that's it. DPAPI is a windows component that encrypts some user data with the user password. For example chrome cookies are saved in DPAPI so even an administrator can not read your cookies while you are not logged in to the system (if you log in they can read everything)
I doubt that it is the case - it encrypts ~~disk~~ partition , not user specific data AFAIK. It has a single key AFAIK.
Yeah I think I was thinking of DPAPI. Updating my comment!