I was wondering if one can select different passwords for device encryption in ICS?
Having the same password for encryption and unlocking the screen isn't quite that secure...
Thanks for hints.
No. A quote from http://support.google.com/android/bin/answer.py?hl=en&answer=1663755:
EDIT: I found this on xda, but I think it might be risky and not worth the effort. http://forum.xda-developers.com/showthread.php?t=1680857
The encryption password does not have the be the same as the screen unlock PIN. In fact, you can encrypt your device with a password without having any screen locking password/PIN at all. (this was initially the case with my newly installed device).
If you think of a possible secure implementation it makes sense. The encryption passphrase is not directly used to encrypt your data. First, a key derivation function is applied to the passphrase. The resulting key is then used to encrypt the master key. (This master key is used for disk encryption.)
Changing the master key is not possible without re-encrypting all data which takes quite some time. What is possible, and much faster, is changing the passphrase that protects the master key. Unlike the GPLv2-licensed LUKS software, you can only specify one passphrase.
I found these arguments by looking in the source code of vold, in particular CommandListener.cpp. This command has always been available since the introduction of disk encryption in ICS:
Yes, you are able to set a different password for device encryption to the one you choose for screen unlock.