In the comparison chart, Bitlocker info is wrong
lulMeow opened this issue · 5 comments
Bitlocker isn't even a file encryption technology but rather a drive encryption one. not only that, Bitlocker is part of a bigger and more important ecosystem of inter-connected technologies that together safeguard Windows from attackers, even the most sophisticated attacks.
so, if it's about fairness, Bitlocker shouldn't even be in that chart, because it operates on a whole different level and league.
but since you put it there, here is some reading material to get the right facts 🙂
BitLocker Countermeasures
https://learn.microsoft.com/en-us/windows/security/information-protection/bitlocker/bitlocker-countermeasures#attacker-with-skill-and-lengthy-physical-access
I use Bitlocker to encrypt my entire SSD drive using Windows 11 and unlike what the chart says, I'm using XTS-AES 256-bit, not AES 128-bit. even if the user doesn't configure anything, the default encryption method is XTS-AES 128-bit.
Bitlocker can use TPM 2.0, Secure Boot, DMA protection and Startup PIN (and other advanced security options) to secure the entire system and that's in fact what I'm using.
About ease of use, there is nothing easier than Bitlocker, after using the GUI to encrypt the drives once after buying a new computer, which is straight forward, you literally don't have to do anything else. OS drive auto unlocks, and other drives can be auto unlocked too. all secured with the help of Secure Boot feature in UEFI, TPM 2.0 chip in hardware, and a user defined Start-up PIN (at least 6 characters).
Well, a lot of people use BitLocker to encrypt their files so it's significant enough for a comparison. If VeraCrypt can make the list, so should BitLocker since they are very similar. By default, BitLocker is AES-128, and the comparison chart uses the defaults of popular encryption tools, so I will keep it as AES-128. Also, since users don't get to choose AES-256 during drive encryption (it must be done in the group policy editor), we can't assume that people will always choose AES-256. The mode of operation (XTS) is also irrelevant unless it's something really bad like ECB, so there's no need to specify it.
The reason why I have it listed as "🟧 Medium" is because I'm comparing the free version of all the tools. By default, BitLocker only comes with Windows Pro, Enterprise, and Education, and the Home version only has a CLI for BitLocker. Thus, a CLI would be medium difficult to use. However, to be fair, I do agree it should be easy as most people will probably assume Windows Pro anyways if you're using BitLocker, so I will update the Ease-Of-Use for BitLocker to be "✅ Easy".
Well, a lot of people use BitLocker to encrypt their files so it's significant enough for a comparison. If VeraCrypt can make the list, so should BitLocker since they are very similar. By default, BitLocker is AES-128, and the comparison chart uses the defaults of popular encryption tools, so I will keep it as AES-128. Also, since users don't get to choose AES-256 during drive encryption (it must be done in the group policy editor), we can't assume that people will always choose AES-256. The mode of operation (XTS) is also irrelevant unless it's something really bad like ECB, so there's no need to specify it.
The reason why I have it listed as "🟧 Medium" is because I'm comparing the free version of all the tools. By default, BitLocker only comes with Windows Pro, Enterprise, and Education, and the Home version only has a CLI for BitLocker. Thus, a CLI would be medium difficult to use. However, to be fair, I do agree it should be easy as most people will probably assume Windows Pro anyways if you're using BitLocker, so I will update the Ease-Of-Use for BitLocker to be "✅ Easy".
Bitlocker encrypts files but it's not all it does. the only way for Bitlocker to just encrypt files is to create a VHDX, put some files in it and encrypt it with Bitlocker. other than that, Bitlocker encrypts the entire drive, and unlike Picocrypt, it's backed by hardware security chips. Bitlocker encrypts the entire drive meaning the files that are there in the drive, the hidden files, the shadow of files and the empty space, so much more than Picocrypt can do.
and Technically, Bitlocker can be configured either in group policy, registry or using PowerShell cmdlets.
And as I mentioned Bitlocker uses SecureBoot, so it performs pre-boot checks to verify the OS hasn't been corrupted/tampered with a bootkit. Third party encryption software and tools such as Picocrypt and Veracrypt break this secure chain of trust which, flows from the firmware (UEFI)) to Windows bootloader and then to BitLocker. it is critical for this chain of trust to exist in order to prevent an entire category of attack against Windows systems. This is not theoretical, this stops real-life attacks.
All of the encryption and cipher methods existing in Windows is compatible with NIST, if it was weak or vulnerable, it wouldn't be in Windows, so they are all considered good. trying to rate them based on how secure they are is like comparing infinity with infinity +1 or infinity +2.
most importantly, using Bitlocker, I don't notice any issue or performance drop, but when I had decided to give Picocrypt a go, by encrypting some 30GB folder with my files, it was taking ages to encrypt, and unlocking them was taking equally long time. maybe it's good for encrypting small files like few MBs to store in unsecure places, but for real world use and lots of files, it's painfully slow.
so much more than Picocrypt can do.
Picocrypt is not meant to replace anything and everything. It's a one-size-fits-most and not a one-size-fits-all. What do you expect me to do, roll out TPM-based encryption with signed EFI files that does on-the-fly encryption with integrated memory integrity? Sorry, but as an open source developer, I don't have the time, money, or resources to do that. Feel free to use what you like, but keep in mind that Picocrypt comes at no cost to you whereas BitLocker is technically a paid product.
trying to rate them based on how secure they are is like comparing infinity with infinity +1 or infinity +2.
By definition, 256-bit AES is more secure than 128-bit because the key is many magnitudes larger. From Wikipedia, "AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while [...] AES with 256-bit keys are necessary for the protection of Top Secret information." So there is a difference between 128-bit and 256-bit, as said and executed by the NSA themselves. Of course, I'm not saying that AES-128 is insecure, I'm just saying that between the two, and looking into the future of computing, AES-256 and XChaCha20 are a better bet than AES-128.
Sorry if that sounded a bit rough, no hard feelings 👍 . Picocrypt will never be BitLocker because it takes more time and energy than an open source developer has to be on par with BitLocker. Besides, Picocrypt's power comes from its simplicity, right?
so much more than Picocrypt can do.
Picocrypt is not meant to replace anything and everything. It's a one-size-fits-most and not a one-size-fits-all. What do you expect me to do, roll out TPM-based encryption with signed EFI files that does on-the-fly encryption with integrated memory integrity? Sorry, but as an open source developer, I don't have the time, money, or resources to do that. Feel free to use what you like, but keep in mind that Picocrypt comes at no cost to you whereas BitLocker is technically a paid product.
trying to rate them based on how secure they are is like comparing infinity with infinity +1 or infinity +2.
By definition, 256-bit AES is more secure than 128-bit because the key is many magnitudes larger. From Wikipedia, "AES with 128-bit keys are sufficient for protecting classified information up to the Secret level, while [...] AES with 256-bit keys are necessary for the protection of Top Secret information." So there is a difference between 128-bit and 256-bit, as said and executed by the NSA themselves. Of course, I'm not saying that AES-128 is insecure, I'm just saying that between the two, and looking into the future of computing, AES-256 and XChaCha20 are a better bet than AES-128.
Sorry if that sounded a bit rough, no hard feelings 👍 . Picocrypt will never be BitLocker because it takes more time and energy than an open source developer has to be on par with BitLocker. Besides, Picocrypt's power comes from its simplicity, right?
I agree, you are not getting paid for the product you create, appreciate your work on the software,
and yes I agree because it's true that there is a difference between AES 128 and AES 256, that's why I'm myself using XTS AES 256 with Bitlocker instead of the default one,
Bitlocker is also free, heck even Windows itself is free, on this very Github page we are writing right now scripts exist that activate it for free (albeit gray area in terms of legality)
and no worries, there wasn't anything rough at all. and yeah I guess simplicity is power, don't think Bitlocker can be made simple due to the need to be supported on a gazillion hardware combinations in PCs that people use, deep root in hardware and OS and backward compatibility etc.
stay safe from the 3-letter agencies, cheers!
Thanks for understanding! Constructive feedback is always helpful and I will be changing BitLocker's Ease-Of-Use to Easy in the coming days.