5

When is the data on an Android phone encrypted? I am assuming here that the device is configured to have full disk encryption enabled.

  1. Is it only encrypted when the device is powered off and decrypted when powered up.
  2. Is it encrypted when the device is locked (equivalent to iOS NSFileProtectionComplete) and decrypted each time the device is unlocked

Also, how different is it between Lollipop and previous versions?

Improve this question

1 Answer 1

Reset to default
6

Android disk encryption is based on dm-crypt and is a full-disk encryption, meaning everything is encrypted using the same master secret. This is different from approach employed by iOS where different files are encrypted with different master secrets based on their protection classes. Effectively, all files on Android-encrypted disks share same protection class.

For older versions of Android (before 5.0) it was fairly easy to bruteforce the PIN so the protection wasn't great and I would rate it to be on-par with NSFileProtectionNone class in iOS.

5.0 introduced improvements to combat offline bruteforce and now whole thing is much closer to NSFileProtectionCompleteUntilFirstUserAuthentication. But please note that because Android's disk encryption is FDE and there's only one master key, it will never be equivalent to NSFileProtectionComplete — because Android won't be able to purge master secret from memory when user locks the device (otherwise none of background services will be able to access any data).

There is an excellent write-up on the Android FDE here (and if you're into Android security in general that blog offers tons of valuable information).

Improve this answer
1
  • Thanks Andrey, your response answers the question perfectly
    – rideintothesun
    Commented Jul 7, 2015 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .