There are built-in functionalities to encrypt a storage on OS X (FileVault) and Android.
On OS X: to enable encryption current user must have a password protected account. After enabling the encryption, recovery key is generated (something like
HHWj-Y8DK-ODO4-BQEN-FQ4V-M4O8). After the encryption is finished (and in all probability before that as well) user is able to change his password, without the need to re-encrypt the storage.
On Android: user is required to set lockscreen protection to either pin or password. After storage encryption is done (again, probably before that as well), user is able to change password, and even switch from password to pin and vice versa.
Now here is what puzzles me: my understanding is that when storage is encrypted, it is done with current user password (sort of like encrypting an archive) and if password is changed — the whole storage must be re-encrypted. This (apparently incorrect) understanding brings me to following questions:
- Based on what "key" (since it is not the password itself) encryption is done then?
- For OS X, I am guessing, it's the recovery key, but how is it connected to the user's password then?
- If password is not the basis for encryption, why is it required to set one before encrypting your storage?
- How is ability to decrypt storage is maintained (without re-encrypting) after password is changed?