I was wondering if one can select different passwords for device encryption in ICS?
Having the same password for encryption and unlocking the screen isn't quite that secure...
Thanks for hints.
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It only takes a minute to sign up.Sign up to join this community
No. A quote from http://support.google.com/android/bin/answer.py?hl=en&answer=1663755:
Note that this is the same PIN or password that you use to unlock your phone without encryption, and cannot be set independently.
EDIT: I found this on xda, but I think it might be risky and not worth the effort. http://forum.xda-developers.com/showthread.php?t=1680857
For phones that are already encrypted, the Android 5.x (Lollipop) the command has changed somewhat. Now instead of typing in the password in quotes, you must first encode the password as hexadecimal and issue the following commands after obtaining root:
vdc cryptfs changepw password HEX_ENCODED_PASSWORD_HERE
Because the password is hex encoded, the resulting value doesn't need quotes surrounding it.
The other command mentioned
vdc cryptfs changepw 'plaintext password here' has no effect on Android 5.x and later releases.
If I were to change my password to
testing, I would issue this command after obtaining root:
vdc cryptfs changepw password 74657374696e67
If I wanted to change my password to something more exotic (which included special characters, quotes, and other punctuation e.g.
What's up "Doc"? I would issue the following command in the
adb shell after obtaining
vdc cryptfs changepw password 5768617427732075702022446f63223f
Now reboot the phone (you can issue a
reboot command) and you'll be prompted for the new password.
If the device is not currently encrypted at all, you would issue the following command:
vdc cryptfs enablecrypto inplace HEX_ENCODED_PASSWORD_HERE
The phone will reboot itself automatically and being the encryption process which could take an hour or more.
EncPassChanger claims to do this, haven't tested it though.
The encryption password does not have the be the same as the screen unlock PIN. In fact, you can encrypt your device with a password without having any screen locking password/PIN at all. (this was initially the case with my newly installed device).
If you think of a possible secure implementation it makes sense. The encryption passphrase is not directly used to encrypt your data. First, a key derivation function is applied to the passphrase. The resulting key is then used to encrypt the master key. (This master key is used for disk encryption.)
Changing the master key is not possible without re-encrypting all data which takes quite some time. What is possible, and much faster, is changing the passphrase that protects the master key. Unlike the GPLv2-licensed LUKS software, you can only specify one passphrase.
adb shellon your computer. (see also 2)
Assuming your password to be
Give Mom batteries, execute the following command:
vdc cryptfs changepw 'Give Mom batteries'
If you have chose exotic characters for your passphrase, be sure to properly escape those.
I found these arguments by looking in the source code of vold, in particular CommandListener.cpp. This command has always been available since the introduction of disk encryption in ICS:
$git log -n1 --oneline 70a4b3fd7a84a84bbe6e9d6d4ca3ee2098259fd 70a4b3f Change cryptfs changepw to only require a new password. $ git branch --contains 70a4b3fd7a84a84bbe6e9d6d4ca3ee2098259fd -a * cm-10.1 remotes/origin/HEAD -> origin/cm-10.1 remotes/origin/cm-10.1 remotes/origin/cm-9.0.0 remotes/origin/cm-9.1.0 remotes/origin/ics remotes/origin/ics-release remotes/origin/jellybean remotes/origin/jellybean-stable remotes/origin/mr1.1-staging