Microsoft rolls out hardware-accelerated BitLocker in Windows 11

Microsoft is rolling out hardware-accelerated BitLocker in Windows 11 to address growing performance and security concerns by leveraging the capabilities of system-on-a-chip and CPU. BitLocker is the native full-disk encryption feature in Windows that protects data from being readable without proper authentication. During normal device boot, it relies on the Trusted Platform Module (TPM) to securely manage encryption keys and automatically unlock the drive. Microsoft states that as non-volatile memory express (NVMe) storage has become more performant, BitLocker's cryptographic operations have a more noticeable performance impact for gaming and video editing activities. With hardware acceleration, bulk cryptographic operations can be offloaded to system-on-a-chip (SoC) components equipped with hardware security modules (HSMs) and trusted execution environments (TEEs), significantly improving cryptographic performance. This will naturally reduce CPU usage and improve overall system performance. "When enabling BitLocker, supported devices with NVMe drives along with one of the new crypto offload capable SoCs will use hardware-accelerated BitLocker with the XTS-AES-256 algorithm by default," Microsoft explains. "This includes automatic device encryption, manual BitLocker enablement, policy driven enablement, or script-based enablement with some exceptions." In actual tests, hardware-accelerated BitLocker had around 70% fewer CPU cycles per I/O compared to software-powered BitLoc...