4

I am using an Samsung S7 edge; together with IBM Maas360; and I ran into a an interesting situation.

Prior last week, my S7 was running Android 6.

Android can be configured to ask for your password before the system starts. By default, the device will start the OS, and later on, when the OS is up and running ask first for PIN; then for your Android password.

Anyway, last week Maas360 recognized my device to have an "encryption status" of active.

Then I received the long awaited upgrade to Android 7. Everything works nicely ... but the next morning, upon restarting the device ... I realize at some point that I lost the Wifi certificates for my companies intranet. Why? Because now, Maas sees "encryption status" as unknown.

I then turned into the settings; and changed the device to ask for the password directly after start. I restart ... and as expected - I am asked for the password, and then there is this "unlock" icon indicating that my device gets "unlocked" during OS startup. Checking encryption status again; I now get active. (which will hopefully fix my Maas/wifi certificate problem)

But beyond that; I am pretty confused by now: why can Android 6 give me "encryption is active"; although the OS starts up without my password? How can it decrypt all the encrypted data ... when it doesn't have my password?

( for the record: I used this app to actually check the encryption status of the device )

Improve this question

1 Answer 1

Reset to default
1

The method of encryption changed in Android 7 (Nougat).

In previous versions of Android, the OS used a simplistic full-disk encryption scheme, similar to that common for desktop and laptop computers. This required a password at boot to be able to access pretty much anything. A side effect was that the phone had to keep everything decrypted while the phone was locked, or else it couldn't do normal smartphone functions like receive push notifications.

This was a pretty major problem, so in Android 7 Google changed Android to use a more sophisticated (but still less sophisticated than iOS's) encryption system, in which files that are determined to be sensitive are individually encrypted. The effect you'll see as a user is that certain things will now work from a boot before you've given the OS the information necessary to derive your encryption key.

Improve this answer
3
  • I understand that A7 introduced a different style of encryption. I am wondering why A6 reports "active" without asking for a password. How could it decrypt things when ... the user didnt provide a password?
    – GhostCat
    Commented Jan 31, 2017 at 16:07
  • Without knowing about the specifics of how that tool generates its reports of active/not active, it's difficult to say.
    – Xiong Chiamiov
    Commented Feb 4, 2017 at 16:49
  • Well, the app is called "API demo"; thus I kinda assume that it simply calls openly available Android APIs to demo their usage; so I guess it simply using some "default" path like: stackoverflow.com/questions/12640708/…
    – GhostCat
    Commented Feb 5, 2017 at 19:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .