How to set distinct boot and lockscreen passwords in Android 10 (full disk encryption)

Question

How can I set a distinct password for:

1. The Full Disk Encryption password (used to boot the device)
2. The Lock Screen password (used to unlock the device)

For security reasons, I use a 25-50 character password to protect my devices when off and a shorter password for the lock screen.

This was previously possible using apps such as:

1. EncPassChanger or
2. Cryptfs Password

I just upgraded my phone, and neither of these apps appear to work in Android 10.

How can I set a distinct password for [a] the boot password and [b] the lockscreen password in Android 10?

Answer 1

Solution: Primary & Secondary account, distinct passwords

This doesn't answer your question directly, but you can probably achieve what you want by using multiple profiles with distinct passwords.

Set the "owner" profile to a very long "boot" passphrase.

Then create a new user profile (Settings -> System -> Advanced -> Multiple users -> Add user). Switch to this user and set a shorter "lockscreen" password.

Now when you boot the phone, in order to access the secondary user's data and apps, you must type the long "boot" passphrase for the "owner" user first, then you must type the shorter "lockscreen" password for the secondary user.

After switched to the secondary user (thereby necessarily having authenticated with both passwords), your lockscreen will be unlocked with the shorter "unlock" password.

If you reboot the device, then you must type both passphrases again. This achieves almost the same end as having FDE with a distinct boot & lockscreen password.

Issue: FDE removed in Android 10

Unfortunately, the solution you're looking for does not appear to be possible because it's not possible to use FDE in Android since Android 10.

According to the ASOP documentation, it is no longer possible to use FDE and the user is forced to use File-Based Encryption

Note: Devices running Android 7.0–9 support full-disk encryption. New devices running Android 10 and higher must use file-based encryption.

More issues: Backups

Unfortunately, the biggest issue with the dual-user approach is backups.

As far as I can tell, both users have distinct files (encrypted with distinct keys that are not shared), apps, and app data.

Moreover, secondary users in Android cannot use adb or become root. Therefore, adb backup and tools like oandbackups will not work because the "owner" user (the only user who can become root) cannot see the secondary user's files/apps/data.

So, if you're google-free, then this solution probably means you cannot backup your phone anymore :(

Update: I was successfully able to restore backups of apps taken on my old phone's "owner" account in oandbackups and restore them to my new phone's secondary user's account with oandbackups following this procedure:

1. first, uninstall the app if already present
2. open oandbackup (as the secondary user, needs root)
3. find the package you want to restore, long-click it -> click "uninstall"
4. when finished, long-click it again -> restore -> apk (only)
5. open the app as the secondary user
6. after opening it, run ls -lah /data/user/10/xyz.tld and make a note of all the owner:group perms of the files
7. back in oandbackups, choose "restore -> data" for the package
8. run mv /data/user/10/xyz.tld /data/user/10/xyz.tld.fresh
9. run mv /data/user/0/xyz.tld /data/user/10/
10. run chown abc:xyz -R /data/user/10/xyz.tld to match the permissions of the freshly-installed app for this user
11. run restorecon -R /data/user/10/xyz.tld to fix SELINUX permissions
12. reboot the phone (if you don't do this, opening the app will immediately crash)