1

Do android phones have hardware support for the OOTB full phone encryption or is it entirely done in software?

If there are phones which have hardware support for encryption then where could I find a list?

In case if it is purely software then what how much degradation I can expect in terms of performance and battery life?

This and this articles claim that encryption comes at a significant performance price.

And this XDA thread suggests that samsung phones might have dedicated encryption chips as part of their proprietary(?) On-Device Encryption. Is there a clear answer available as to which devices have what support?

Update

I have found a thorough explanation on the state of android hardware encryption support in this article, which says that google failed to introduce proper hardware support in Android 5.x, and then, for android 6.x they decided to go with 'software acceleration' whatever that means.

The article quotes Dave Burke, Google’s engineering lead as saying that:

“Encryption is software accelerated. Specifically the ARMv8 as part of 64-bit support has a number of instructions that provides better performance than the AES hardware options on the SoC.”

Yet, on the practical side: full disk encryption on android 7.x is faster than on 6.x but the performance hit can still be between 2x to 4x slower compared to an unencrypted phone.

Improve this question

1 Answer 1

Reset to default
1

The Android Open Source Project has a entire section on Security:

https://source.android.com/security/

As you asking about encryption the minimum standard for devices with Google Play services is defined by the Android Compatibility Definition Document:

https://source.android.com/compatibility/8.0/android-8.0-cdd#9_9_data_storage_encryption

While there doesn't appear to be any hardware mandates there, once you get to Keystore related items:

https://source.android.com/compatibility/8.0/android-8.0-cdd#9_11_keys_and_credentials

Provided solutions include Trusty which a separate microprocessor or virtualized instance separated from the rest of the Android OS and only accessible via a Hardware Abstraction Layer (HAL).

With regards to Full Disk/File Encryption, see:

https://source.android.com/security/encryption/full-disk

Improve this answer
5
  • Reading the links you provide it is still not clear if there is any hardware support present in any of the phones on the market. But according to the first link it appears that as of Android 5.0 Lollipop encryption is enabled by default, yet looking at settings in Android 7 I see that full device encryption is not enabled.
    – ccpizza
    Nov 20, 2017 at 21:27
  • @ccpizza well maybe someone disabled it because it comes in feature called 'forced encryption'. Also maybe just your SD card isn't encrypted. And one more thing if it's a custom ROM on the device then maybe it's not enabled by default. What is your device?
    – Једноруки Крстивоје
    Nov 21, 2017 at 1:01
  • @ЈеднорукиКрстивоје: it's a xiaomi redmi, made in china, running miui 9
    – ccpizza
    Nov 21, 2017 at 1:05
  • @ccpizza Xiaomi Redmi covers a number of different phones over the years (what you told us was the equivalent of Samsung Galaxy, but not saying if it was a 5, or 7 or a note). Internally the models can even differ between regions like North America and Asia. If you can find out what the CPU chipset is and what level of Android OS it started with, that may inform if hardware encryption support is available. I do recall though that the early version of Android with encryption didn't have hardware support so made normal operations slower.
    – Morrison Chang
    Nov 21, 2017 at 1:54
  • It's a relatively recent rooted redmi note 4 - it has the option for full phone encryption as it originally came with android 6, and I've been thinking of enabling the encryption vs using EDS lite which can mount truecrypt/veracrypt containers.
    – ccpizza
    Nov 21, 2017 at 9:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .