1

In the past, with older Samsung devices, whenever I have enabled Secure Startup to fully encrypt a device, I have gotten an instruction to charge it to at least 80% and leave it plugged in, as it would reboot and take about an hour for this procedure to finalize (maybe not word for word, but iirc that was pretty much what it would say).

I've a used stock ROM Galaxy S9 here and I enabled Secure Startup, and it simply said that it is enabled... No restart, not an ~hour long activation process... Nothing, it just says it is enabled. When I restart the phone, it does ask for my password, but I suspect it just might be a UI/visual thing and that it does not really encrypt the device.

I checked if the Knox fuse was tripped and it wasn't. Also, because I had the phone heavily debloated, I suspected maybe I have uninstalled a crucial Secure Startup related system app, so I hard reset it and tried again with no default apps being uninstalled. But still the same thing. It says it is enabled, but did not say anything about charging the phone to 80% and that it would take about an hour, or prompt me to reboot, etc.

Again, this is a Galaxy S9 and I'm definitely sure it uses Full Disk Encryption (FDE) as its encryption method (I googled this). The reason why that is relevant, is because if it was File Based Encryption (FBE), I'd suspect it would be normal to enable Secure Startup instantly—as it seems to be doing it now—and not have to reboot and take about an hour to encrypt the entire phone.

What am I missing here?

1 Answer 1

0

It doesn't matter if it uses FBE or FDE. The reason why it is so fast when you activated encryption is that all Android devices come nowadays encrypted by default. Therefore all your user data were already encrypted when ever you write it to flash (even without a PIN or password set).

Therefore if you enable secure startup all files are already encrypted. The only part that has to be updated is the master encryption key (and may be some managing data). As such a key has only a few bytes activating secure startup is done in less than a second.

CPUs often contain hardware encryption/decryption commands which work pretty fast and require very little battery. This makes it possible to have it enabled all the time. This also has the positive effect that a factory reset is very fast (just eliminate the master key) and very secure as without the key all data is gone.

5
  • If it is enabled by default, then when I would disable it, and then later on enable it again, wouldn't it then go through the hour long process of actual encrypting? (Or rather a few minutes, since it is so fast) Or are you suggesting that the device is encrypted by default and you cannot unencrypt it anyway? In that case why would it let you enable/disable Secure Startup as pleased? In fact, why is there this Secure Startup feature in the first place, when everything is encrypted by default? Is it some form of UI psychological reassurance for the less tech savvy users? Jun 24, 2021 at 20:23
  • @miraqolo6689 Yes that is what I told you all files are always encrypted. The only thing you can change is when the Gatekeeper system (the security manager of Android) allows to use the encryption keys. When it comes to FBE Android has the possibility to allow decryption before the first login (for some essential user files). Note: even if all files are always encrypted this does not mean they are always highly secured. As each file is encrypted with a different key if or if not a file is stored secure depends on who can access the key. And this the part where Sec. startup can enhance.
    – Robert
    Jun 24, 2021 at 20:49
  • I see. So, Secure Startup disabled → all files encrypted regardless (on a per file basis). Secure Startup enabled → same thing plus master key at boot. Correct? Jun 24, 2021 at 21:11
  • 1
    @miraqolo6689 From: docs.samsungknox.com/admin/knox-platform-for-enterprise/kbas/… Section on FDE: If the user sets a PIN, password, or pattern on the device, and configures Secure Startup via Settings > Biometrics and Security, the Primary Key is re-encrypted by the Keymaster using the user's credentials and stored. If Secure Startup is not enabled after being configured, the Primary Key is re-encrypted using the default password instead of the user's credentials. Jun 25, 2021 at 11:54
  • Interesting read, thanks. To sum up, (a) my device is supposed to not reboot and take the hour long process to encrypt, as it already is encrypted and (b) enabling/disabling Secure Startup basically adds/removes a master key at boot; other than that the user files are encrypted regardless. Correct? Jun 26, 2021 at 20:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .