Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I know the basic idea that device encryption would encrypt all data and decrypt it on the fly as it is used when authorised.
However i do not know how this makes phone more secure than s standard screen lock ?
Device encryption asks me a password at startup and similarly the screen lock is enabled and locks phone right after startup so in this case both should be equally restrictive since both use the same pin.
Finally why fingerprint cannot be used for device encryption and has to be a pin?
In laymans terms, its the difference between having a guard, and a locked vault.
When you have only a lockscreen, its just like having a human guard that will ask you for a password/PIN. If this can be circumvented or bypassed - either via a vulnerability - which would be equvalient with social engiinering the guard into giving you access without knowing the password/PIN, or if the lockscreen can be forcefully removed, would be equvalient with killing the guard, access is subsuquently granted.
If you instead have the device encrypted, its like a locked vault. No matter who you kill or bypass, you can't get into the vault without the correct code or key.
Using device-encryption while off, along with screen lock while its on, is more equvalient with the bank vault being closed and locked during closing hours, and a human guard during opening hours. The guard is more convient during daytime since you dont have to open and close the heavy vault door all the time.
The reason you can't use fingerprint authentication with encryption, is because a encryption key cannot be derived from a fingerprint. Instead, you have to have some hardware that performs an authentication - like the guard - and releases the key upon correct authentication. A fingerprint authentication isn't like providing a password, since everytime you place the finger, you are not placing it exactly like you did when enrolling. Instead, a very complicated mathematical calculation needs to be made, to judge if the fingerprint is enough similiar to the enrolled fingerprint, to be accepted.
Imagine like taking a photo of your house. Next day you see a house and want to know if its yours. You take a new photo. If you would hash these photos or compare them bitwise, you would always come out to a false decision, because the photos will be slightly different lightning and angles.
Thats why you cannot derive an encryption key out of a biometric authentication.
Screen lock prevents someone from accessing your device without tampering with it.
Drive encryption prevents someone from accessing the data on your device, even if they tamper with it.
Essentially, if you have a lock screen and an encrypted drive, I can pop the hard drive out of your cellphone, plug it into another computer, and pull whatever data I want from it one way or another. With an encrypted drive I can do that, but all I have is an encrypted drive image which can take centuries or longer to guess the encryption key for.
Fingerprints can't be used to unlock freshly booted encrypted devices for unrelated but important reasons. http://fabianstiehle.com/Touch-ID is a good read on what types of security Apple employs for their TouchID. Android vendors will have different, varying implementations, but how Apple does it is how Android vendors SHOULD do it. Some don't (HTC, I'm looking at you).
Essentially, the Fingerprint information is securely cordoned off from the rest of the phone. When your phone needs to confirm your fingerprint, it sends a message to the fingerprint processor which replies back with whether or not the fingerprint is accepted. It does this through a secure channel. This channel is initially secured using your PIN or Password. When you restart your phone you need to supply the PIN or Password in order to establish the initial connection.
