I've been reading about how File-Based Encryption and Direct Boot work. There's one thing I don't understand.
Device encrypted (DE) storage contains data encrypted with a key that is only available after a device has performed a successful verified boot.
If I understand correctly, if an application stores data in DE areas, that data is available after the device boots up even prior to any user authentication (i.e prior to the device being unlocked).
Then, according to https://source.android.com/security/encryption/file-based
Each user in a multi-user environment gets a separate encryption key. Every user gets two keys: a DE and a CE key.
An application may be able to interact freely across the DE areas, but one user unlocked does not mean that all the users on the device are unlocked".
Question: If an application has access across the DE areas, what is gained by generating a separate DE key for each user?
Initially I assumed that user in the above quoted sections refers to a physical user as described here
User. Each user is intended to be used by a different physical person.
But user can also refer to an application user as described here
The Android operating system is a multi-user Linux system in which each app is a different user.
So I'm thinking:
When an application stores data in DE storage, the data is encrypted using the application user's DE key.
When an application stores data in CE storage, the data is encrypted using the currently active physical user's CE key.
If the above is correct, A physical user's DE key and an application user's CE key is never used.
I don't know if the above makes any sense so it would be great if someone with the appropriate knowledge would chime in.