As far as I understand, the device's /data partition remains decrypted once an encrypted devices has been unlocked during boot up. Why does Android have to keep encryption keys within RAM if no "live" decryption / encryption is actually happening?

  • Even if it worked the way you imagined, you'd still need the key in RAM to encrypt the data and save it, right? Or do you imagine the user would get prompted for password at every shutdown (or lose data otherwise)? – Mehrdad Mar 11 '18 at 1:49

I think you understand the concept wrong. The encrypted partition will not be fully decrypted on mounting, then stored somewhere on the device and then encrypted again (to save the changes) whenever the partition gets unmounted. Instead the key is known the the kernel (i.e. it is in RAM) and it can thus decrypt and encrypt data on the fly.

  • 5
    if the partition was fully un-encrypted and you lost power the un-encrypted files would not be protected, every write uses the in ram key to encrypt and save the file. – Pieter Mar 10 '18 at 21:56
  • @Pieter: Not to mention the notorious difficulty of securely erasing anything on an SSD. If it wasn't encrypted when it hit the drive, it's effectively compromised for good. – Kevin Mar 11 '18 at 0:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.