Everything you need to know about Android encryption

Encryption for Androids can be a confusing subject, with a broad set of manufacturers and tons of device models out in the market. Depending on the operating system of the device, each of these models may follow different methods when it comes to Android encryption.

In this blog, we’ll blog provide a basic overview of the encryption technologies used on Android, the need for Android encryption, and the best practices to follow when encrypting Android devices.

What is Android encryption?

Once an Android device is encrypted, the system automatically encodes all user data on the device lock. Depending on the type of encryption, the device decrypts this data only after it successfully boots up, or after the user unlocks it with the correct password/touch ID/face ID/screen lock.

Why must you encrypt your phone?

Be it personal or corporate data, when using your Android device to store and access sensitive information, it is crucial to ensure that the device is encrypted. In today’s corporate environment, data breaches are on the rise. According to a 2020 data breach report by RiskBased security, almost 36 billion corporate records were breached in the first half of 2020.

Also, with employees gaining access to corporate files on their mobile devices, it becomes even more crucial to encrypt these devices. According to a 2021 financial data risk report from Varonis, nearly two-thirds of organizations have more than 1,000 sensitive files open to every employee. These figures point out the importance of setting up encryption policies in the enterprise.

Is it safe to encrypt my Android device?

It is generally safe to encrypt your Android devices. For the older device models, encrypting your Android can result in a drop in system performance. However, this performance drop becomes unnoticeable in the newer Android models. Also, it is worth mentioning that the encryption process is irreversible. Once performed, it can only be removed by a complete factory reset of the device.

What are the types of encryption used on Androids?

Android encryption generally falls under two categories. Full-disk encryption (FDE) and file-based encryption (FBE).

Full disk encryption

Full-disk encryption (FDE) requires encoding all the data on your device, including essential apps and services, and transforming it into illegible code. This data can then be decrypted only after the user successfully unlocks the Android device after booting up. The highlight when it comes to this technique is that all the data is encrypted using a single key.

In the case of full-disk encryption, the core functionalities of your Android device – including the alarms, accessibility services, and the ability to view caller IDs when receiving calls – are restricted until the device is unlocked with the correct credentials. When compared to file-based encryption, this technique provides greater security, at the cost of user convenience.

File based encryption

File-based encryption (FBE) on the other hand, ensures that the essential and non-essential apps and data are separated and encrypted with different keys. When it comes to FBE, the Android system provides two types of locations for storing encrypted data.

Device encrypted storage ensures that access to essential apps and services are made available as soon as the device is successfully booted up.

Credential based encrypted storage ensures that until the device is unlocked with the proper credentials, the user apps and data on the device remain encrypted.

Overall, file-based encryption is usually preferred over FDE for commercial Androids due to the better convenience it offers for the users.

Is my Android device encrypted out-of-the-box?

Encryption for Android devices was introduced with Android OS version 3. However, for older models, Android encryption would have to be enabled manually. This was usually done because the encryption process for the older models would considerably reduce device performance.

With the introduction of newer models, Android devices began to be encrypted out-of-the-box. Today, any Android device with an OS version above 6, that has a legal license of GMS (Google Mobile Services), will always be encrypted out-of-the-box. These devices also support enrollment in the Android Enterprise program.

It is worth noting that any device enrolled in the Android Enterprise program must have encryption enabled mandatorily. If the device is not encrypted, the encryption process will automatically be enforced when enrolling in Android Enterprise.

Also, Android Enterprise devices with OS versions above 7, set in Profile Owner mode have the option to set up separate encryption keys for the personal and work container. This can be done by setting up a work profile password for the device.

How do I manually enable Android encryption?

Morden Android devices are always encrypted out-of-the-box. However, in the case of older Android models, the device may or may not be encrypted. You can check the encryption status for Android devices by navigating to Settings > Security > Encryption. This tab shows whether the device is encrypted or not. In case the Android device is not encrypted, you can enable encryption from the same tab.

Before enabling encryption, there are a few things that the user must note to maintain a smooth encryption process.

How do I choose between FDE and FBE on my Android?

Android devices with OS versions 7 to 9, comes equipped with the feature that allows users to choose between full-disk encryption and file-based encryption techniques to implement on their device.

To choose between full-disk encryption and file-based encryption methods, you will first need to enable ‘Developer options’ on your Android mobile.

Once you are at Developer options, select the tab, ‘Convert to file encryption’, and tap on ‘Wipe and convert’. The conversion process will take about 1-2 hours to complete.

Is it necessary to set a password to encrypt your Android device?

Unlike its desktop encryption counterparts like BitLocker for Windows and FileVault for macOS,

When it comes to encrypting Android devices, it is not mandatory to set up a device password.

However, the lack of a password will reduce the effectiveness of encryption on your Android device, and it is generally not advisable to set up encryption without a password.

For further clarity, let’s observe the effect of setting up a password on an encrypted Android device. We’ll consider the case for both full-disk encryption and file-level encryption solutions.

When enabling encryption using FDE, if a password is not set, the Android device is encrypted by a randomly generated key, hashed by a default password (“default_password”). This key is also signed by a trusted execution environment (TEE).

But, if a password/pattern/PIN is later set up by the user, the master key gets re-encrypted. However, no change in encryption occurs on any of the apps and user data.

In the case of FBE, files are encrypted with different keys that are unlocked separately. This includes the files in – device encrypted storage and credential-based encrypted storage.

In case a password is not set by the user, the data in credential-based encrypted storage is encrypted by a similar randomly generated key, signed by a TEE. When a password/PIN/pattern is set, this key is re-encrypted, ensuring that the encryption for apps and data remains unchanged.

What are the best practices for Android encryption

When enforcing encryption for Android devices, following certain practices will ensure that your Androids are secured and managed in the best possible way.

Use strong passwords

Enforcing a strong password on your Android device is a crucial factor when setting up Android encryption. Protecting your device with a password/PIN/pattern/touch ID/face ID further strengthens the security on your Android. Hexnode’s UEM solution enables you to enforce strong password policies on your managed Android devices, thereby protecting your data from potential breaches.

Monitor and manage encrypted devices

Once encryption has been completed, it is necessary for enterprises to manage these encrypted devices and monitor their status periodically. With Hexnode’s UEM solution, enterprises can easily manage and view all their encrypted devices from a remote centralized console. IT can also force encryption via Hexnode when enrolling devices in Android Enterprise, and mark unencrypted devices as incompliant.

Regularly back up data

Backing up your data at regular intervals ensures that the data remains safe even in the case of a corrupted drive or a device malfunction.