Android File Based Encryption specification allows encryption without user enrolled password. Full Disk Encryption which is a predecessor (and deprecated) of file based encryption used to have default_password
as the password to encrypt storage when the user did not enroll custom full disk encryption password from settings. This was a major inconvenience for the user because custom password used to be separate from the lock screen password if the user is using lock screen pattern. It was required only once after every reboot so it could be easily forgotten. It was a security issue as well because most users would not bother going through settings to set custom password for full disk encryption. Spyware agencies took advantage of this by creating exploits for Trusted Execution Environment (TEE) that could extract its secret key and together with default_password
, they were able to decrypt the whole storage.
File based encryption cryptographically ties user enrolled lock screen password with file based encryption keys which makes it infeasible to crack even if the secret key of TEE is known to the attacker. The current implementation supports null bytes to use if the user does not enroll password. This eliminated hardcoding of default_password
string as input to the Key Derivation Function. The keys that decrypt file based encryption keys are still derived by the key derivation function because key derivation will still output the key even if null bytes are used.
File based encryption optionally uses these inputs to derive keys:
- Auth Token
- Stretched Credential
If the user password is not enrolled, the authentication is skipped. TEE does not await for the user input and proceed to derive keys with non-user elements. Both of these optional elements are skipped during key derivation.
On factory reset, TEE clears existing file based encryption keys and regenerates them. The user is re-prompted to enroll password which can be skipped.
Every file stores a unique IV that is used to derive a sub-key which encrypts & decrypts the file.
In most cases, FBE keys also undergo an additional key derivation step in the kernel in order to generate the subkeys actually used to do the encryption, for example per-file or per-mode keys.
TrustyOS
Android File Based Encryption