Android L to be encrypted by default

[qwertywarrior]

http://www.washingtonpost.com/blogs/the-switch/wp/2014/09/18/newest-androids-will-join-iphones-in-offering-default-encryption-blocking-police/

 

 

my take :

since android 4.0 

you could actually fully encrypt the phone with AES-128 

its based of dm-crypt (with LUKS) the actual encryption used for the filesystem for first release is 128 AES with CBC and ESSIV:SHA256. The master key is encrypted with 128 bit AES via calls to the openssl library.

 

there is one flaw virtually all disk encryption systems store the encryption key in ram and its a big security hole 

(actual hack http://dx.eng.uiowa.edu/dave/luks.php  )

i really hope they fix that before implementing it

 

 

 

NEWS:

The next generation of Google’s Android operating system, due for release next month, will encrypt data by default for the first time, the company said Thursday, raising yet another barrier to police gaining access to the troves of personal data typically kept on smartphones.

Android has offered optional encryption on some devices since 2011, but security experts say few users have known how to turn on the feature. Now Google is designing the activation procedures for new Android devices so that encryption happens automatically; only somebody who enters a device's password will be able to see the pictures, videos and communications stored on those smartphones.

[Sexy Vanilla Freshness]

Sounds good, but how easy is it to crack?

[qwertywarrior]

Sounds good, but how easy is it to crack?

u dont need to crack ( http://dx.eng.uiowa.edu/dave/luks.php )

the masterkey is stored on ram when LUKS is mounted

its an issue that has been identified since  2008 and found on MANY other systems that use LUKS

https://citp.princeton.edu/research/memory/

 

 

i have no idea if google will fix this with android 5.0

[StingBull]

Wouldn't that slow down the phone?

[qwertywarrior]

Wouldn't that slow down the phone?

well android ART would speed that up since its on my default too

if it was too slow then u could turn it off

[LAwLz]

Wouldn't that slow down the phone?

Probably. Once we get ARMv8 it should have a negligible affect on performance.

The iPhone does it by default but I think they have had hardware accelerated encryption for ages (maybe on the eMMC level).

There are simple ways around the performance drop but all of them require new hardware (unless it's already common in Android phones).