2

I am trying to piece together some information about the security system in Android. Particularly about how user's password/PIN is connected with encryption keys in file-based encryption mode. I'm doing this for my university project. I've found a lot of useful information on the Android source site. But some things are still unclear to me.

  1. How is passwords/PIN information connected with keys, which are used to encrypt files?

The stretched credential is the user credential after salting and stretching with the scrypt algorithm. The credential is actually hashed once in the lock settings service before being passed to vold for passing to scrypt. This is cryptographically bound to the key in the TEE with all the guarantees that apply to KM_TAG_APPLICATION_ID.

  1. Where does Android store this key: in hardware or some not accessible memory?

The secdiscardable hash is a 512-bit hash of a random 16 KB file stored alongside other information used to reconstruct the key, such as the seed

  1. What algorithm does Android use for reconstruction the key?
1

File Based Encryption (FBE) keys are bound to screen lock authentication. Unless user enters screen lock password, keys that decrypt FBE keys cannot be derived. Screen lock authentication and key derivation are executed inside Trusted Execution Environment (TEE) which is a separate secure environment that runs independently of android OS.

TEE has 3 components:

  1. Gatekeeper - It enrolls new screen lock password and authenticates existing user.

  2. Biometric - It enrolls new biometrics like fingerprint, face ID and Iris and authenticates enrolled biometrics.

  3. Keymaster - It handles cryptographic operations for the device.

Here's how authentication followed by FBE keys decryption works during first unlock after reboot:

Biometric authentication doesn't work in this state.

Authentication

Authentication

Start point is PIN pad.

  1. Invalid frequent password attempts are throttled by exponential timeout by Gatekeeper. Each attempt takes 100ms for verification so brute forcing a strong password is not feasible.

  2. HMAC key that generates HMAC on Auth Token is valid until next reboot. After reboot, Keymaster invalidates this HMAC key and generates a new one for the Gatekeeper. Gatekeeper cannot cache this key and it has to request this key every time authentication takes place.


FBE Keys Decryption

User Root Key Decryption

Start point is User Root Key.


Keymaster File Based Decryption

Two start points.


Cached FBE keys

FBE keys are re-encrypted by Keymaster using Ephemeral Key which is valid until next reboot. FBE keys are then cached in vold and the Linux kernel keyring. When the Linux kernel requires this key to read or write a file, it calls into the secure environment which decrypts FBE keys, derives a 64-byte AES-256-XTS key and programs it in into the Inline Crypto Engine. This ensures that FBE keys are never stored in plain-text when outside of TEE. FBE keys also undergo an additional key derivation step in the kernel in order to generate the subkeys actually used to do the encryption, for example per-file or per-mode keys.

Now user can use biometric to unlock screen.


Is this design secure enough from forensic extraction?

It's secure when the device hasn't been unlocked once after reboot. This is called Before First Unlock state. Once the device has been unlocked atleast once after reboot, the device goes to After First Unlock state and at some point FBE keys will have to come in memory for reading and writing data. Background apps like messages, emails, contacts, notes, reminders etc. can keep them in memory indefinitely from where they can be extracted.

That's how FBI might be Hacking Into Private Signal Messages


Qualcomm File Based Encryption (pdf)

File Based Encryption

Android 7 File Based Encryption and the Attacks Against It

Data Security on Mobile Devices: Current State of the Art, Open Problems, and Proposed Solutions

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.