topic Device/Master Key - Filevault/Bitlocker in Endpoint

Device/Master Key - Filevault/Bitlocker

Saul_Goodman — Mon, 26 Sep 2022 18:53:37 GMT

Hi CheckMates,

Base on the link below under Fundamental Functionality:

ATRG: FDE E80.64 and above (checkpoint.com)

"Gather and deliver requested information back to the Endpoint Management"

"Generation of device/master key. Status shown and reported: Init "

Is the "device/master key" encrypted when uploading to EPMgmt? if yes what cipher is used and is it documented? or how Check Point secures the uploading of this key to the EPMgmt or EPMaaS?

Re: Device/Master Key - Filevault/Bitlocker

PhoneBoy — Mon, 26 Sep 2022 23:20:49 GMT

I thought BitLocker operated using keys in the TPM of the device in question?
In which case, we wouldn't have the keys.
Though I believe we do have the recovery key.

Re: Device/Master Key - Filevault/Bitlocker

Saul_Goodman — Tue, 27 Sep 2022 02:25:28 GMT

So if the Management have the recovery key how is it delivered to the EP Management? and is it encrypted or not? or any documentation supporting this.

Re: Device/Master Key - Filevault/Bitlocker

PhoneBoy — Tue, 27 Sep 2022 21:42:13 GMT

The recovery key is a string of numbers and letters.
I was trying to find documentation explaining where/how this stuff is documented.
The most logical place for it to exist is here, where we have other similar details documented about our FDE implementation: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112693&partition=Basic&product=Harmony

I'll see if I can get this documented.