Gsyfuy

If I do not understand wrong from this post and Wikipedia page of the BitLocker and TPM, by default, BitLocker uses symmetric cryptography like AES. However, TPM is capable of performing RSA encryption.
Given that, the RSA key is stored in the TPM, why BitLocker does not use the asymmetric encryption (i.e., RSA)? By using such encryption technique, we might be able to defend against the cold boot attack or sniffing on LPC bus.

Asymmetric encryption is vastly inferior to symmetric encryption. That is, in all respects, except one -- being asymmetric. When that property is needed, there's no way around it, obviously.

Asymmetric encryption is much slower. It is much more susceptible to showing recognizable patterns of some kind given non-random input. You need much larger key sizes to provide an adequate level of protection, and the system is much more vulnerable in general with current and future technology (reasonably-sized quantum computers will basically mean instant death for RSA, but AES is pretty much "yeah, so what" in that respect).

That's the reason why asymmetric encryption is almost never used to encrypt bulk data.

Nothing prevents you from encrypting a terabyte of data with RSA using 2048 bit chunks, much like you encrypt a terabyte with AES in 128 bit chunks. Only just, it doesn't make sense to do that because it is several thousand times slower, and at the same time is much more insecure.

Asymmetric encryption like RSA is limited in that you can only use it to encrypt data the size of the key. With a 2048 bit key, you can only encrypt 2048 bits of information. For this reason RSA is unsuitable for bulk encryption like disks - and even for small files like email messages.

This is why almost all uses of asymmetric encryption involve "hybrid encryption". RSA is used to encrypt the key for a symmetric algorithm like AES, and AES is used to encrypt the bulk data. PGP is an example of a hybrid encryption application.

Correction - as @HenningMakholm points out in the comments, it isn't that asymmetric can't be chained to handle larger blocks of data the way symmetric algorithms do, it's that doing so is impractical from a performance point of view. The end effect is the same, but the mechanism is different.

The coldboot attack can be performed on any encryption scheme as long as the keys are residing on the memory. For full-disk encryption (FDE) with symmetric algorithms like AES , you will need to take out the key from the TPM, where you will be applicable to coldboot attack.

Though the TPM is capable of RSA encryption and decryptions, for FDE the RSA has problems, in short the speed;

1. RSA must use AOEP scheme to be secure which reduces the message size.


2. To speed up the public key encryption the public key is selected as 3, 5, ... However, the decryption to access one block will be much more slower even you use CRT to gain 4x speed.


3. Even the TPM can perform RSA encryption on the chip, it will be much slower for Full Disk Encryption (FDE).

Therefore, TPM based FDEs use TPM as a key storage.