0

How can I setup Full Disk Encryption in Android 10?

According to the ASOP documentation, it is no longer possible to use FDE and the user is forced to use File-Based Encryption

Note: Devices running Android 7.0–9 support full-disk encryption. New devices running Android 10 and higher must use file-based encryption.

Though I understand the argument for convenience (morning alarms, updates, etc), there are several strong use-cases where it's better to have a FDE with a very long passphrase -- consider journalists, activists, political prisoners, etc crossing borders with oppressive governments. It's better to just turn the device off and rely on FDE to protect absolutely everything in these situations.

So the question is: how do at-risk folks use FDE in Android 10?

Note: creative answers that involve root, custom ROMS, apps, etc are welcome. I'm asking how this can be done on an Android 10 device. I'm not asking if Google "permits" it to be done.

Improve this question
5
  • 1
    Are you aware that the login password is no longer used for generating the encryption key? It now bases on the Trusted Execution Engine in the CPU. security.stackexchange.com/questions/196230/…
    – Robert
    Jul 1, 2021 at 7:53
  • holy crap they were using the login password to generate the encryption key?? Are you sure? It should be that the encryption key is randomly generated and symmetrically encrypted with the password, as most FDE systems use..
    – Michael Altfield
    Jul 1, 2021 at 8:15
  • No, my comment was a bit simplified of course on FDE the password was not directly used as key. But the important fact was not on how it was but how it is now on FBE: the user password has no impact on the encryption at all. Therefore the password length is now totally irrelevant as long as you can't guess it as the code in TEE slows down the entering process (brute-force prevention).
    – Robert
    Jul 1, 2021 at 10:23
  • screen log credentials still involved in FBE encryption (that's why TWRP ask for password) 5 digit pin is secure enough against bruteforce
    – alecxs
    Jul 4, 2021 at 17:23
  • on Poco F1 latest MIUI 12 doesn't even support secure startup anymore and uses FDE default_password, even if password is set while in unencrypted state, and encrypted later (which used to be workaround for MIUI 11 secure startup). see build.prop for Poco F1 Android 10 with forceencrypt= flag in /vendor/etc/fstab.qcom this is one of the devices one should keep bootloader locked for security reasons (or downgrade MIUI 11)
    – alecxs
    Jul 4, 2021 at 19:18

0

Reset to default

You must log in to answer this question.