I was wondering if one can select different passwords for device encryption in ICS?
Having the same password for encryption and unlocking the screen isn't quite that secure...
Thanks for hints.
Yes, you are able to set a different password for device encryption to the one you choose for screen unlock.
No. A quote from http://support.google.com/android/bin/answer.py?hl=en&answer=1663755:
EDIT: I found this on xda, but I think it might be risky and not worth the effort. http://forum.xda-developers.com/showthread.php?t=1680857
The encryption password does not have the be the same as the screen unlock PIN. In fact, you can encrypt your device with a password without having any screen locking password/PIN at all. (this was initially the case with my newly installed device).
If you think of a possible secure implementation it makes sense. The encryption passphrase is not directly used to encrypt your data. First, a key derivation function is applied to the passphrase. The resulting key is then used to encrypt the master key. (This master key is used for disk encryption.)
Changing the master key is not possible without re-encrypting all data which takes quite some time. What is possible, and much faster, is changing the passphrase that protects the master key. Unlike the GPLv2-licensed LUKS software, you can only specify one passphrase.
I found these arguments by looking in the source code of vold, in particular CommandListener.cpp. This command has always been available since the introduction of disk encryption in ICS:
For phones that are already encrypted, the Android 5.x (Lollipop) the command has changed somewhat. Now instead of typing in the password in quotes, you must first encode the password as hexadecimal and issue the following commands after obtaining root:
Because the password is hex encoded, the resulting value doesn't need quotes surrounding it.
The other command mentioned
If I were to change my password to
If I wanted to change my password to something more exotic (which included special characters, quotes, and other punctuation e.g.
Now reboot the phone (you can issue a
If the device is not currently encrypted at all, you would issue the following command:
The phone will reboot itself automatically and being the encryption process which could take an hour or more.