Is it possible to back up the encryption key of Android?

Question

Is it ever possible to get a backup of my Android smartphone's decryption key (I have my /data partition encrypted) in case something goes wrong?

My phone is rooted. I have Galaxy Note 4 SM-N910C.

Answer 1

You didn't specify in your question whether you're looking for the FDE, Full Disk Encryption, key or the FBE, File-Based Encryption, key. Technically they can both can have their keys recovered (so long as the FBE key is not hardware wrapped), but I've only needed to find a practical method for FDE so far.

Full Disk Encryption

The way to get the FDE that should work across devices and android versions is using the cold-boot method, you don't even need root. I suspect this isn't the answer you're looking for as I don't consider it in the practical realm for most even technically advanced people.

The easiest way, that I've discovered, to get the FDE userdata encryption key is to ask for it, and you might be lucky enough to get it. I've tested with on a Nexus5 Android 6 device, but other devices or android versions may have a kernel that prevents this. You'll need root for this to work.

They way to ask the system for the key to perform the command: dmsetup table --showkeys. Just as you would on a linux desktop with a dm-crypt device loaded. The 4th field of the output will be the encryption method used, aes-cbc-essiv:sha256 in my case, and the 5th field will be the hex encoded key. If the 5th field is not a 32 or 64 character character hexidecimal string that looks random (ie. not all zeroes), then this method won't work. It could be that some android phones use the kernel keyring service, which may be configured to not allow showing the key.

The trouble is that you'll need the dmsetup binary, which is not distributed with android. So you'll need to find a binary compiled for your architecture. Ideally there would be a statically compiled binary that one could download, but I've yet to find one. Or using termux would be nice, but at the time of writing this termux has no package which installs dmsetup. For my test, I used Debian's armhf binary packages instead of building my own dmsetup binary. I haven't looked up your device, but if its 64-bit RM, you'll need to download the arm64 versions.

One gotcha with this approach is that you must also install the libc6 package because the dmsetup binary can not be loaded with the android dynamic linker. You also must set the appropriate LD_LIBRARY_PATH for dmsetup to find the dynamically linked libraries it needs to start. Furthermore, you'll need to download all the packages that the dmsetup package depends on an their dependencies. It's about 7 packages total. And since you can't install Debian deb packages on android, the paths are right, you'll have to unpack them manually using dpkg-deb -X <pkgs> <install dir>. In the end, the command I needed to use to run dmsetup looked like this, assuming my current working directory is the <install dir>:

LD_LIBRARY_PATH=$PWD/lib/arm-linux-gnueabihf \
  $PWD/lib/arm-linux-gnueabihf/ld-linux-armhf.so.3 \
  $PWD/sbin/dmsetup table --showkeys

File-Based Encryption

There is also an updated cold-boot attack for retrieving FBE encryption keys, but again not in the realm of practical for most people. I suspect that there is a way to get the FBE keys via user-space if you have root and the keys are not hardware wrapped (and may be if they are), but I'm not currently aware of how to do so.

The FBE implementation that stock android uses is fscrypt and seems to only be using raw protectors. In order to unlock the FBE on a linux desktop you'll need to make sure your kernel has the proper support for it. There are 2 fscrypt keys per user, a Credential Encryption (CE) key and Device Encryption (DE) key. Once you have the raw key for the directory you're wanting to decrypt you should be able to unlock the fscrypt'd directory using google's fscrypt program. The trick will be in getting the raw key for the particular directory you want to unlock. The data used to construct the raw key and fscrypt parameters are in /data/misc/vold/user_keys. The android docs give some clues as to how to create this raw key and suggest that the creation of the key must be done on the phone (needs a special master key from the TEE). Ultimately, vold will get this raw key and use it to setup the fscrypt instance. So I think the easiest way to get the key(s) will be to hack vold to output them to a file. Here seems like a good candidate because vold just did the kernel call to setup fscrypt, so we have the raw key and the directory that the raw key goes to. If its a hardware wrapped key, then the key data from that ioctl won't likely do us any good unless its known how to "unwrap" the key, which, if even possible without hardware hacking, would likely involve interfacing with the TEE.