Hacker News Reader

Comment by mjg59 | Hacker News Reader

Why? You're not booting Windows again, and restoring the secure boot state and boot order to the original values will result in the PCR values being what they were before, so what's changing that would force recovery mode?

View on HN

The TPM tracks the state of the secure boot and the bios, that log is stored in the TPM itself the next time you’ll try to boot into windows it will see that something happened and bitlocker will lock itself out.

Do this experiment.

Boot into any Linux live CD on a machine with bitlocker enabled.

Reboot and see what happens.

No, the TPM doesn't retain PCR measurements over reboots, and the log (rather than the composite PCR value) is handled by the firmware and the OS and the TPM has no idea it exists.

It seems that this is a property of TPM 1.2.

> On devices with TPM 1.2, changing the BIOS or firmware boot device order

https://learn.microsoft.com/en-us/windows/security/operating...

I did that last night. It didn't have any issues booting back into Windows after booting to a live USB.

I didn't change any parameters of the Windows boot option or the rest of the system.

It seems that this is a property of TPM 1.2.

> On devices with TPM 1.2, changing the BIOS or firmware boot device order

https://learn.microsoft.com/en-us/windows/security/operating...

Yeah I seem to recall every time I've done that it seems to auto boot fine when I change it back to what it was before.

And as mentioned it's never had issues if I did a one off choice from the boot menu.

Changing it will trigger recovery, changing it back to the original won't

It doesn't matter if you change the settings back. I don't know how it works, but something non-user configurable is changed that prompts Windows to require a reset of the TPM keys.

Reply on news.ycombinator.com