Longhorn – secure startup – this looks important

Boot volume security has previously relied on third party products, that have a lot of limitations for example support for suspend and hibernation, and general concerns over stability and management.   Secure startup in Longhorn for the system volume combined with EFS for data volumes looks like a very promising solution for security, negating the reliance on either physical security and/or third party solutions.  By building it deep into the OS stability issues should be a thing of the past as well (at least lets hope so).   It will be interewsting to see what the performance implications are,  but you can imagine this being a must have for portables that have a TPM chip (note to anyone specifying corporate laptops – make sure it has TPM 1.2 chip!!).  I assume this will kill off dual-boot and ironically might make Linux live distro’s acceptable, as they cann’t be mis-used.

Here is a bit more information from Microsoft, and the attachment provides further details:

Secure Startup – FVE prevents access to files on the system volume when the operating system is shut down by encrypting the system volume and storing the key required for decryption inside the Trusted Platform Module. During the startup process the Trusted Platform Module verifies the integrity of the Windows operating system before allowing it to access the key required to decrypt the system volume.

The integrity of the Windows operating system is verified by fingerprinting the operating system when it is assumed to be secure and only releasing access to an operating system with a matching fingerprint. If an attacker attempted to view the files on the system volume by starting another operating system from the CD drive, the fingerprint would not match, Secure Startup – FVE would not release access, and all files on the system volume would be unreadable. This includes operating system files, application data, documents, temporary files, hibernation files, the page file, and registry data stored on the system volume.

and a bit more on the positioning wrt EFS:

Secure Startup – FVE and the Encrypting File System (EFS) work together to enhance the security of Windows. Secure Startup – FVE does not replace EFS, but files encrypted with EFS are more secure on a system that uses Secure Startup – FVE.

Secure Startup – FVE can be used to encrypt data on the system volume before Windows is started. Data stored on other volumes is not encrypted by Secure Startup – FVE. To encrypt data on volumes other than the system volume, use the Encrypting File System (EFS). EFS encrypted data can be accessed only by using keys stored on the system volume. As a result, files encrypted with EFS are more secure on a system with Secure Startup – FVE enabled even when those files are not located on the system volume. EFS can also be used to encrypt data on the system volume after the operating system is running.