8
$\begingroup$

If I encrypt my SDCard on my android phone using the built-in encryption software, and my phone dies for whatever reason, would I be able to easily by just using the pin/password to access that data later on my desktops [OS X, Windows and Linux]?

$\endgroup$
  • 1
    $\begingroup$ Let me know if you think this is more of an Android question perhaps? $\endgroup$ – McGafter Feb 17 '16 at 9:26
  • 1
    $\begingroup$ If you are interested in whether the encryption is possible to decrypt without the phone (as opposed to the key/similar being stored on the phone), that seems on topic. If you are interested in how to do it, that would be better asked elsewhere. $\endgroup$ – otus Feb 17 '16 at 11:29
  • 1
    $\begingroup$ Disk encryption depends on android version. $\endgroup$ – Vadym Fedyukovych Jan 8 '18 at 23:43
6
$\begingroup$

The Android developers page on Full Disk Encryption seems like it has all the info you want, and more! It talks about encryption on the main internal disk (/data), I will assume that it uses the same mechanism for encrypting the external SD Card.

In a nutshell:

When your turn Android Disk Encryption on, it generates an AES-128 key which it uses to encrypt the drive (called the master key). It then takes your Pattern / PIN / Password and uses that to derive a second AES-128 key which it uses to encrypt and store the master key on disk. You know how the first thing Android does during boot-up is ask for your PIN / Password? That's because it needs it to decrypt the master key so that it can decrypt and mount the main filesystem. The reason for having two AES-128 keys is that if you change your Pattern / PIN / Password, it just has to re-encrypt the master key file, not the whole disk.

Is it decryptable on a desktop?

Theoretically, yes.

The location of the master key file is no secret, so if you know the PIN / Password, and you know which key stretching function Android uses to turn this into an AES-128 key then you should be able to decrypt the master key, and then dercrypt the disk. Whether there is freely-available desktop software to do this, or you would have to write your own, I have no idea.

(One possible hitch is that I don't know if it stores a copy of the master key file on the external SD Card, or if there is just one copy on the internal flash memory chip. Finding a way to access the internal flash memory on the dead phone might prove to be the hard part here. You could probably check pretty easily if there's a key file on the encrypted SD Card by popping it into your laptop and looking.)

$\endgroup$
  • $\begingroup$ "master key file" located on the same card would make it possible, otherwise it well might die with the phone. This page is for android 5 and later. $\endgroup$ – Vadym Fedyukovych Jan 8 '18 at 23:47
4
$\begingroup$

If it is done properly, you shouldn't be able to do that. The key itself is randomly generated at first boot / factory reset and it is stored (derived) on the device itself. PIN / password is used only to lock the key.

$\endgroup$
1
$\begingroup$

It could be that this functionality on your Android phone is implemented in the kernel as device mapper, depending on Android version.

$\endgroup$
  • $\begingroup$ ...and if that is the case, does that mean it is easily decryptable on a desktop? $\endgroup$ – otus Feb 17 '16 at 14:28
  • $\begingroup$ it was never specific enough how much easy it is expected and what is Android version or, at least, kernel options enabled. So, here's a fishing rod. $\endgroup$ – Vadym Fedyukovych Feb 18 '16 at 12:20
1
$\begingroup$

I know for a fact that android stores its keys on the system storage, not the sd card. I was just factory resetting my phone a moment ago and I got a message warning me that any encrypted files on the sd card will become unreadable for precisely this reason. So what I did was I made a backup of the entire sd card through android file transfer which has permission to read the encrypted card. However, not sure if this applies to any apps that have their own encryption (banking apps, password managers etc.).

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.