I have a Samsung Galaxy S6 with device encryption enabled. I unlock my device with a secure password upon booting it, and then use a fingerprint afterwards. When I first enabled encryption (Lollipop), my device would ask for a decryption password as soon as it began booting. Since upgrading to Marshmallow, the phone boots up completely, but will not accept a fingerprint to unlock the device until the password is entered once.
The secure startup settings allow me to choose to require a password before boot (like it was previously), or not to require the password until the device has booted (the default now). The description on the settings page states:
In addition to using your fingerprint to unlock your device, you can further protect the device by requiring a password be entered before the device starts up. This helps protect data on lost or stolen devices.
What is the difference, from a security standpoint, between the two options?
I at first assumed that data at rest would be encrypted the same for both options, but the description seems to indicate that a pre-boot password increases security. Since the setting is easily switched back and forth I assume no underlaying changes are occuring to the device encryption when the setting is changed, but something must be changing if security is improved.
The fact the phone can fully boot without my password seems to indicate the data on the phone is actually decrypted without my password, and the password is merely protecting my fingerprints and access to the phone. In this case, how is the device encryption functioning as anything other than a lock screen if the phone is lost while powered on?