0

In Android 6, you could change the disk encryption key using the vdc command with

vdc cryptfs changepw NEWPW

In Android 9, you get a message, that raw commands are no longer supported.

During rooting and installing Lineage OS 16 and installing different stuff, I got different PIN and encryption keys. This means, that when I change the lockscreen PIN, the encryption key is no longer changed.

In principle, this is what I wanted to achieve, but the problem is that I currently do not know how to change the encryption key at all. I would like to have a rather short lockscreen pin and a longer encryption key, that I can change from time to time. On Android 6 this was no problem on the shell and with different Apps, but the Apps seem to depend on the vdc command as well.

I already tried to change the lockscreen PIN back to the current encryption password in the hope, that the next change of the PIN then would change the encryption as well, because I thought maybe the encryption was not changed because the new API needs a correct old password before changing the key to the new password. But this did not work as well.

Is there any App, command line tool or function in Lineage OS 16, that can change the encryption key?

  • 1
    I assume your device uses File Based Encryption (FBE) right? – Robert May 12 at 10:15
  • No, it uses block based encryption. I just verified it using the adb command. That's fine for me, but in previous android version, i.e., marshmellow, I were able to use vdc to change the password and now the method is deprecated. – allo May 12 at 12:42
  • I am not sure if the FDE tools are still included. According to Google "Support for full-disk encryption is going away. If you're creating a new device, you should use file-based encryption.". – Robert May 12 at 14:19
  • I encrypted it using the UI interface of Lineage OS 16 (Android 9.0) and now it is FDE. I do not really case about the mechanism, as long as it works properly after the phone is booted (A prompt at boot time is okay). But I would like to be able to change the password. Guides to set up FBE are welcome, but some help to change the FDE password would be sufficient. I already tried if I can use vdc binaries from other android versions, but this does not seem to work. – allo May 12 at 15:05
0

I was able to set an encryption password again, be removing the lockscreen by removing some files related to the lockscreen and then setting a new passphrase. To use a different lockscreen password then, you need to restore the original files.

Source on XDA: https://forum.xda-developers.com/showpost.php?p=78699812&postcount=58

As a workaround on Android Pie, you can do the following (on your own risk):

  1. set the desired password for the screen lock
  2. backup lockscreen files:
    1. all files under /data/system_de/0/spblob/
    2. files containing "_synthetic_password_" in /data/misc/keystore/user_0/
    3. /data/system/locksettings.db
  3. set the desired password for the device encryption
  4. restore / replace all lockscreen files

If something went wrong, sqlite into /data/system/locksettings.db and set the values of sp-handle and lockscreen.password_type to 0 to reset the screen lock.

Afterwards I enabled the lockscreen using the settings app and used the current boot password as password. When changing the lockscreen, the boot password was changed as well.

To have separate lockscreen and boot passwords again, you can either restore the previous files, or remove the new ones and set a fresh lockscreen password, that does not overwrite the encryption key.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.