[APP][ICS] EncPassChanger -- set different device encryption and lock screen password

Kibab · Jun 26, 2012

Android 3+ has a nice feature -- device encryption. You can encrypt the contents of your device with a password, and after that this password must be entered during device boot, otherwise the data is permanently lost.
The bad thing is that this password is set to the screen lock PIN / password. So you either set a short password or PIN, that you can enter quickly each time you unlock your phone from sleep (but this provides weak encryption), or set a long password and have to type it 20-30 times during the day.

This stupid behavior may be fixed easily. Android provides command-line tool called 'vdc', an interface to Android Volume Manager. As written in "Notes on the implementation of encryption in Android 3.0" [1], it has a command 'cryptfs changepw', that allows changing encryption password. Of course this command must be executed as root.
vdc has some other commands related to encryption, one of them is 'cryptfs verifypw', that allows to validate the supplied password.

I'm currently writing an application that will assist user with changing encryption password. This is my first public application for Android. You can find a source code on GitHub [2]. It is very simple, but maybe android gurus here may find what to make better.

Comments and pull requests are welcome

Thanks!

[1] http source.android.com/tech/encryption/android_crypto_implementation.html
[2] https github.com/kibab/encpasschanger

Kibab · Jun 29, 2012

Updated 30.06.2012: Added APK file!

uDroid · Jul 4, 2012

Kibab said:
Android 3+ has a nice feature -- device encryption. You can encrypt the contents of your device with a password, and after that this password must be entered during device boot, otherwise the data is permanently lost.
The bad thing is that this password is set to the screen lock PIN / password. So you either set a short password or PIN, that you can enter quickly each time you unlock your phone from sleep (but this provides weak encryption), or set a long password and have to type it 20-30 times during the day.

This stupid behavior may be fixed easily. Android provides command-line tool called 'vdc', an interface to Android Volume Manager. As written in "Notes on the implementation of encryption in Android 3.0" [1], it has a command 'cryptfs changepw', that allows changing encryption password. Of course this command must be executed as root.
vdc has some other commands related to encryption, one of them is 'cryptfs verifypw', that allows to validate the supplied password.

I'm currently writing an application that will assist user with changing encryption password. This is my first public application for Android. You can find a source code on GitHub [2]. It is very simple, but maybe android gurus here may find what to make better.

Comments and pull requests are welcome
Thanks!

[1] http source.android.com/tech/encryption/android_crypto_implementation.html
[2] https github.com/kibab/encpasschanger

Sorry im noob
What will change visualy?
Or screenshot?

Sent from my LT26i using XDA Premium HD app

randalla0622 · Jul 11, 2012

Thank you for this. I wanted a more simple password for the unlock, but a longer more complicated password for the decryption. You should put it on the market and charge $.99USD (or equivalent in your currency) as it's quite useful. I'd buy it

Kibab · Jul 17, 2012

Thank you!
Actually I have registered myself as Google Play Developer, now I'm waiting for approval. As soon as my registration is approved, I will update this thread

Although I'm going to make a free and donate versions, because I believe that will help to make Android better, and people who want to say "Thank you" will buy Donate version anyway

Kibab · Jul 18, 2012

uDroid said:
Sorry im noob
What will change visualy?
Or screenshot?

Sent from my LT26i using XDA Premium HD app

Nothing will change visually, hence no screenshot. What's important is that you may set strong password for decrypting the internal storage, but keep using simple password (or PIN) to unlock the screen.

P.S. I have verified that my app works on Jelly Bean too.

Kibab · Aug 18, 2012

I have finally published an application on Google Play! Currently there is a free version, Donate version will come a bit later

The link is: https:// play.google.com/store/apps/details?id=com.kibab.android.EncPassChanger

Enjoy!

zurchpet · Aug 21, 2012

Thanks for that app, that is also what annoyed me

tijuanacartel · Aug 21, 2012

Thanks for this. I've been trying to work out why encryption wont work on any ROM on my HOX (dies with unable to get size of block device cryptfs), and you have given me a good lead to investigate with vdc. Information on encryption in android is sparse, and almost all threads here on XDA get no replies.

Thanks again.

pulser_g2 · Aug 21, 2012

I've been tempted to use device encryption recently, but there is a distinct lack of information about it, particularly on custom ROMs...

Might need to give it a go, just the lack of backup abilities might be an issue...

zurchpet · Aug 21, 2012

pulser_g2 said:
I've been tempted to use device encryption recently, but there is a distinct lack of information about it, particularly on custom ROMs...

Might need to give it a go, just the lack of backup abilities might be an issue...

I use CM10 on the Galaxy Nexus (maguro). Encrypted. Actually, only /data is encrypted. /system stays unencrypted. And this App works as described.

For Backup use TWRP. It asks for your password to decrypt storage.
You can then backup, restore, flash, install whole ROMs, wipe and what not.

~~>> I would like to see this app in Play Store <<~~

I should read before I post:

Kibab said:
I have finally published an application on Google Play! Currently there is a free version, Donate version will come a bit later
The link is: https://play.google.com/store/apps/details?id=com.kibab.android.EncPassChanger

Enjoy!

Thanks for that

btw. The encrypted /data partition lets you have two boot animations, one that is shown before code has been entered (the one in /system/media) and one after the correct code entry (the one in /data/local).

pulser_g2 · Aug 21, 2012

zurchpet said:
I use CM10 on the Galaxy Nexus (maguro). Encrypted. Actually, only /data is encrypted. /system stays unencrypted. And this App works as described.

For Backup use TWRP. It asks for your password to decrypt storage.
You can then backup, restore, flash, install whole ROMs, wipe and what not.

>> I would like to see this app in Play Store <<

btw. The encrypted /data partition lets you have two boot animations, one that is shown before code has been entered (the one in /system/media) and one after the correct code entry (the one in /data/local).

Hmm... I have i9100 (S2), so I would need to see about putting TWRP onto it...

Yeah, only data and SD are encrypted... Can TWRP cope with encrypted SD btw?

renaud · Aug 21, 2012

Great, it's easier than to change on command line

This should just be default android behavior

zurchpet · Aug 21, 2012

pulser_g2 said:
Hmm... I have i9100 (S2), so I would need to see about putting TWRP onto it...

Yeah, only data and SD are encrypted... Can TWRP cope with encrypted SD btw?

Yes, SD is encrypted too. And TWRP can only read from it after correct code entry. Don't know about the external SD though (since the Galaxy Nexus doesn0t have one).

pulser_g2 · Aug 21, 2012

zurchpet said:
Yes, SD is encrypted too. And TWRP can only read from it after correct code entry. Don't know about the external SD though (since the Galaxy Nexus doesn0t have one).

Wish I had a second phone, then I could just research this

adrianblack · Aug 22, 2012

Quite awesome. Now, can I use a strong password for encryption and then pattern lock for normal day to day use? That would be my ideal situation. I heart pattern lock!

vegaman · Aug 22, 2012

Just trying to clarify how this works... so you keep your normal 'short' pin unlock code for unlocking the screen, but set a long code for decryption, and this code will only be requested once per boot, during bootup? Is this correct?

Thanks

rakeshdev · Aug 22, 2012

How it works

Yes Sir. You are correct.

Kibab · Aug 22, 2012

adrianblack said:
Quite awesome. Now, can I use a strong password for encryption and then pattern lock for normal day to day use? That would be my ideal situation. I heart pattern lock!

Unfortunately it's not possible to use pattern lock while using device encryption, Android forbids it. Patching Android framework will help, but this is completely another story and possible suggestion for ROM makers such as Cyanogenmod.

Ronaldo Forenucci · Aug 22, 2012

Is the 16 character Android limitation present, when using this tool? I currently use a 16 character device encryption/unlock pass phrase. I'd like to strengthen the device pass phrase some more.

I don't know if this is even possible during the device boot sequence, but being able to use a Yubikey with an OTG cable would be awesome!

RF

[APP][ICS] EncPassChanger -- set different device encryption and lock screen password

Member

Attachments

Member

Senior Member

Senior Member

Member

Member

Member

Senior Member

Senior Member

Admin Emeritus / Senior Recognized Developer

Senior Member

Admin Emeritus / Senior Recognized Developer

Inactive Recognized Developer

Senior Member

Admin Emeritus / Senior Recognized Developer

Senior Member

Senior Member

Member

Member

Senior Member

Similar threads

Top Liked Posts