TL;DR: bitlocker does not like grub
Full story:
Months ago I installed fedora on my desktop, dual booting Windows 11.
In all this time I never had the need to boot into windows. I remembered that it worked fine after install, good, and then I forgot about that.
Today I needed a specific windows only software, so at grub I chose the microsoft bootloader and… BITLOCKER.
Huh? Bitlocker? Me? What? Searched frantically for that decryption password in my keepass, did not find. What?? How???
After a few minutes staring at that screen I thought, ok let’s just wipe that shit and reclaim the space. I went back to linux, opened the partition manager, then remembered that i had something important in single copy over there. Noooooo
Went back to the boot screen to try again, still failed password.
Then I notice the error:
e_fve_pcr_mismatch
that mismatch lets me think that maybe I had something wrong in my booting.
I try to put windows first in the bios and it works! WHAT THE…???
So, if i put linux first, then launch windows from grub, bitlocker takes the windows partition under ransom, i can only access if windows is first. And of course in windows 11 x64 is no longer possible add linux partitions in their boot manager (previously it was possible)
Incompetence or maliciousness?
IMO, this does nothing because it only gives Microsoft full access to your device. And if you’re special enough to get the attention of someone capable and willing to physically steal your laptop, install a bootkit on it and give it back to you without you even noticing, then it’s just easier to just download the decryption keys from Microsoft at this point. It could have made all of this local like storing it in the TPM, a secure area of the CPU.
Full disk encryption is cool, but not when tethered to Microsoft. With that, they brought themselves into a nasty position even if they didn’t want to. Just like when Apple made themselves the sole source of installing programmes on the iPhone devices. China gladly used that and is gladly using that.