• InnerScientist@lemmy.world
    link
    fedilink
    English
    arrow-up
    1
    ·
    1 day ago

    All devices launching with Android 10 and higher are required to use file-based encryption.

    To use the AOSP implementation of FBE securely, a device needs to meet the following dependencies:

    • Kernel Support for Ext4 encryption or F2FS encryption.
    • Keymaster Support with HAL version 1.0 or higher. There is no support for Keymaster 0.3 as that does not provide the necessary capabilities or assure sufficient protection for encryption keys.   
      
    • Keymaster/Keystore and Gatekeeper must be implemented in a Trusted Execution Environment (TEE) to provide protection for the DE keys so that an unauthorized OS (custom OS flashed onto the device) cannot simply request the DE keys.   
      
    • Hardware Root of Trust and Verified Boot bound to the Keymaster initialization is required to ensure that DE keys are not accessible by an unauthorized operating system.

    https://source.android.com/docs/security/features/encryption/file-based?hl=en