Maintaining Operating System Secrets Across Resets

A computing device comprising:

• a reset resistant store configured to maintain one or more encrypted secrets associated with a particular operating system;
• a trusted key service including an encrypted key vault;
• the encrypted key vault configured to maintain an encrypted boot configuration key specific to a boot configuration used to run the particular operating system;
• and
• the trusted key service configured to decrypt the encrypted boot configuration specific key and use the boot configuration specific key to decrypt data associated with the particular operating system only if the particular operating system is being booted or is running on the computing device.

A computing device comprising:

• one or more processors;
• and
• a computer-readable storage medium having stored thereon multiple instructions that, responsive to execution by the one or more processors, cause the one or more processors to perform operations comprising:
• obtaining a master key associated with the computing device;
• identifying a current boot configuration of the computing device;
• obtaining an encrypted boot configuration specific key associated with the current boot configuration;
• using the master key to decrypt the encrypted boot configuration specific key;
• and
• using the decrypted boot configuration specific key to decrypt data associated with a current operating system of the computing device running from the boot configuration and maintained by the computing device across resets of the computing device.