Score:9

How strong are Bitlocker recovery keys?

pm flag
asd

This is an example of a bitlocker recovery key;

820042-335825-646573-481530-265253-688132-339900-822810 

İs that key actually strong? It does not have any letters, it uses only numbers, so is it OK?

Score:12
ng flag

Based on official doc here, unofficial doc there, and confirmed by some experiments:

  • A valid Bitlocker recovery key consists of eight exactly 6-digit decimal numbers separated by seven hyphens (-) or space ( ) signs. Each such number is of the form $11\times k$ with $k\in[0,2^{16})$, thus in $[000000,720885]$. Hence the question's example is not a valid Bitlocker recovery key: the first and last 6-digit numbers are out of range, and only the but-last is a multiple of 11.
  • A valid Bitlocker recovery key thus has (at most) 8×16=128 bits of entropy.
  • It gets slightly stretched, with on-disk salt, by an iterated (not memory-hard) SHA-256 hash with $2^{20}$ loops.

So that if a Bitlocker recovery key is competently and honestly generated (I have no idea), it's like 148-bit strong, which is expected to be very secure for some decades (save for Cryptographically Relevant Quantum Computers, which are quite hypothetical).

Note: When there is a Bitlocker recovery key (which is optional), the AES 256-bit Volume Master Key gets encrypted under that 148-bit strong stretched Bitlocker recovery key, and stored, theoretically reducing the strength of the overall encryption.

Maarten Bodewes avatar
in flag
Alright, your Google fu is also strong :P
asd avatar
pm flag
asd
yes it's not an actual bitlocker key, i used a pass. generator using only 48 digits and divided it with ''-'' by myself. thanks for the answer.
Maarten Bodewes avatar
in flag
If you had to generate a valid key yourself you could just generate 128 bits, split that up into 16 bits, using the unsigned value of each and then multiply that number with 11, printing out the decimal digits, left-padding with zeros where required. I.e. you'd start with the key and then encode it. Of course, it makes much more sense to use the Microsoft environment for the generation.
user71659 avatar
cn flag
Note the recovery password is optional, it can be [added or removed](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/manage-bde-protectors). So Bitlocker is not inherently limited to 148-bit security, just the default setup is.
fgrieu avatar
ng flag
@user71659: Thanks for the correction. I edited the note to reflect that.
Score:7
in flag

I've found this at this GitHub page that tries to specify the Bitlocker format from Microsoft:

A valid recovery password consists of 48 digits where every number is dividable by 11 with a remainder of 0. The result of a division by 11 of a number is a 16-bit value. The individual 16-bit values make up a 128-bit key.

This means that there is some error detection mechanism - this shows the importance of looking at the defined format rather than just a sample key.

If the digits and thus numbers would be fully random - which they are not - then they would be able to encode a $log_2(10^{48}) \approx 159$ bit key. So clearly the size of the password / key makes up for the small amount of possibilities per character. Both the calculated 159 bit and the indicated / correct answer of 128 bit strength are much stronger than a human generated password which averages about 42 bits or so if I remember correctly; such a password could be brute forced.

128 bit symmetric keys - which I assume is used here (apparently after a key stretching algorithm - see the other answer , which is not really needed for this kind of key strength) - are considered strong. They may not be fully protected against a pretty large quantum computer. We currently don't know if quantum computers can scale to that size; currently they are definitely not around, but you could store encrypted information until one becomes available, if ever. Normally Bitlocker uses AES as a block cipher.

Maarten Bodewes avatar
in flag
Dang, that info was **not** easy to find. I was somewhat afraid that I would be beaten by sombody posting 159 bit strength as an answer.
asd avatar
pm flag
asd
thx a lot for the answer! so it's pretty strong to use a 48 digits only generated password like that one, right? for any of my online account?
Maarten Bodewes avatar
in flag
If you have to rely on something you have to store in text then it is pretty secure for that. Using devices with additional protection may be even more secure. That later point is more about how the password is stored / accessed than the key strength though; the key strength is fine for most purposes. I'd only be worried if you would store long term or state level secrets with regards to the strength in bits.
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.