Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

I was wondering if one can select different passwords for device encryption in ICS?

Having the same password for encryption and unlocking the screen isn't quite that secure...

Thanks for hints.

share|improve this question
add comment

4 Answers 4

The encryption password does not have the be the same as the screen unlock PIN. In fact, you can encrypt your device with a password without having any screen locking password/PIN at all. (this was initially the case with my newly installed device).

If you think of a possible secure implementation it makes sense. The encryption passphrase is not directly used to encrypt your data. First, a key derivation function is applied to the passphrase. The resulting key is then used to encrypt the master key. (This master key is used for disk encryption.)

Changing the master key is not possible without re-encrypting all data which takes quite some time. What is possible, and much faster, is changing the passphrase that protects the master key. Unlike the GPLv2-licensed LUKS software, you can only specify one passphrase.

Requirements:

  • Superuser privileges.
  • Either a terminal application on your device or a computer which has adb.
  • A good passphrase.

Instructions:

  1. Enter the shell. This can be done by opening the Terminal app or by running adb shell on your computer. (see also 2)
  2. Obtain root privileges by running su
  3. Assuming your password to be Give Mom batteries, execute the following command:

    vdc cryptfs changepw 'Give Mom batteries'
    

    If you have chose exotic characters for your passphrase, be sure to properly escape those.

  4. The passphrase has immediately changed, replacing the old one. You can reboot to check it yourself.

I found these arguments by looking in the source code of vold, in particular CommandListener.cpp. This command has always been available since the introduction of disk encryption in ICS:

$git log -n1 --oneline 70a4b3fd7a84a84bbe6e9d6d4ca3ee2098259fd 
70a4b3f Change cryptfs changepw to only require a new password.
$ git branch --contains 70a4b3fd7a84a84bbe6e9d6d4ca3ee2098259fd -a
* cm-10.1
  remotes/origin/HEAD -> origin/cm-10.1
  remotes/origin/cm-10.1
  remotes/origin/cm-9.0.0
  remotes/origin/cm-9.1.0
  remotes/origin/ics
  remotes/origin/ics-release
  remotes/origin/jellybean
  remotes/origin/jellybean-stable
  remotes/origin/mr1.1-staging
share|improve this answer
add comment

EncPassChanger claims to do this, haven't tested it though.

share|improve this answer
add comment

No. A quote from http://support.google.com/android/bin/answer.py?hl=en&answer=1663755:

Note that this is the same PIN or password that you use to unlock your phone without encryption, and cannot be set independently.

EDIT: I found this on xda, but I think it might be risky and not worth the effort. http://forum.xda-developers.com/showthread.php?t=1680857

share|improve this answer
add comment

Yes, you are able to set a different password for device encryption to the one you choose for screen unlock.

share|improve this answer
    
What evidence do you have for this? Yes/No answers aren't very helpful without any "How" element. –  Andrew Lott Jun 30 '13 at 14:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.