0

I am trying to understand how FBE and metadata encryption works.

I read a lot of pages on FBE that it encrypts each file with different keys, and that those keys are encrypted and hashed with the Lock Screen Pin entered by the user.

My question is What if the user does not set the pin. How are the keys generated and how secure they are ?

How are the keys decrypted when there is no Pin set on a bootup of a device?

What is the role of Metadata Encryption from Android 11 to FBE Keys.

Improve this question
7
  • Lock screen PIN is never directly used. It is only used to authenticate against gatekeeper service.
    – Robert
    Commented Sep 29, 2022 at 13:00
  • how are those keys generated and how much secure they are? Does anyone know the AOSP code for reference which does this key generation
    – Lavyansi
    Commented Sep 29, 2022 at 13:04
  • For a detailed diagram on Android keys please see security.stackexchange.com/a/247954/1204
    – Robert
    Commented Sep 29, 2022 at 13:57
  • I have already gone through the diagram and its a wonderful explanation, I am just concerned what if a User has not set any password at lockscreen, will the device be secure?
    – Lavyansi
    Commented Sep 29, 2022 at 15:24
  • 2
    As you can see the Device Unique Key is always involved additionally to the PIN. To my understanding this is a random generated key that is erased on factory reset. So even with default PIN the actual encryption master key is random.
    – Robert
    Commented Oct 3, 2022 at 16:35

1 Answer 1

Reset to default
1

A lot of details on Andorid´s File based Encryption ans how the different keys are related to each other can be found in the answer to the question Connection between PIN/password and encryption keys in Android on our sister site Security Stackexchange.

The only part that is not explained in detail is how the encryption meta data is stored in e.g. ext4 file-system. These details are presented in this presentation from 2021: One Key to Rule Them All: Recovering the Master Key from RAM to break Android's File-Based Encryption (presentation) - see see page 7 and 8:

page 7 page 8

See also the full scientific paper: One Key to Rule Them All: Recovering the Master Key from RAM to break Android's File-Based Encryption

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .