TL;DR: bitlocker does not like grub
Full story:
Months ago I installed fedora on my desktop, dual booting Windows 11.
In all this time I never had the need to boot into windows. I remembered that it worked fine after install, good, and then I forgot about that.
Today I needed a specific windows only software, so at grub I chose the microsoft bootloader and… BITLOCKER.
Huh? Bitlocker? Me? What? Searched frantically for that decryption password in my keepass, did not find. What?? How???
After a few minutes staring at that screen I thought, ok let’s just wipe that shit and reclaim the space. I went back to linux, opened the partition manager, then remembered that i had something important in single copy over there. Noooooo
Went back to the boot screen to try again, still failed password.
Then I notice the error:
e_fve_pcr_mismatch
that mismatch lets me think that maybe I had something wrong in my booting.
I try to put windows first in the bios and it works! WHAT THE…???
So, if i put linux first, then launch windows from grub, bitlocker takes the windows partition under ransom, i can only access if windows is first. And of course in windows 11 x64 is no longer possible add linux partitions in their boot manager (previously it was possible)
Incompetence or maliciousness?
PCR is the name of a registered value in your TPM module.
Did you disable or otherwise changed your Secure Settings in your BIOS? That would do it.
Any changes in the boot process should change various PCR registers. https://wiki.archlinux.org/title/Trusted_Platform_Module#Accessing_PCR_registers
Nah. Specific field registers for specific things, and something like Bitlocker doesn’t watch ALL of them.
From the few docs I can find, it looks like 0,2,4, and 11. Pretty common.
I suppose I could have phrased that better. The registers themselves correspond to particular applications/stages, but the values store in those registers should change based on how the application/stage was loaded. Switch the order or inject a new binary and the hash from that stage on should change.