@rogersb11,
@Lysergic Acid,
@Lanchon,
@cyril279
Hello again friends. I have been working on device encryption for a while since this device (as well as others) only encrypts the /data partition and leave /storage/sdcard0 open for the world to see. I've figured out a universal workaround that I've been using as my daily driver for over a year that has no noticeable performance impact**. I use
cryptsetup to build a LUKS volume on /storage/sdcard0 that fills most of the space on the partition, and then automount it via a startup script. The decryption key is located in plaintext on the /data partition (/data partition must first be decrypted/mounted by Android via startup passphrase, so the keyfile is secure despite the fact that it's stored in plaintext). The real advantage of this setup is that the LUKS volume can be mounted in any recovery (!!) using the cryptsetup binary. As far as I know recoveries cannot mount AOSP encrypted volumes yet (which makes offline backups/file retrieval a pain in the a$$).
So - two questions.
1) Do you guys know of any recovery (I'm still on TWRP 2.7) that's capable of mounting AOSP encrypted volumes? If so - I'll get to work on figuring out how to get Android to natively encrypt sdcard0.
2) If not - does anyone want my source for integration into your ROMs/kernels?
With love,
dimoochka
**There is probably a write-performance impact because the mmc blocks occupied by the LUKS volume cannot be FSTRIM'ed (xoxo
@Lanchon) despite the fact that the LUKS volume is not actually full.