Help Phone Encryption on Android 8 (oreo) on Huawei Mate 10 Lite

[Anquietas]

Hello,

I have a rather interesting question, if someone (expert only please) can help, it would be very much appreciated

I have bought a new phone (Huawei Mate 10 Lite) which already has the preinstalled Android 7 OS.
After I turned it on, I've upgraded it to Android 8 (and EMUI 8) via the Software Updater.
So now, I am running Android 8 on Huawei Mate 10 Lite.

Until here, everything works like charm

The problem starts here: I'm used to having my ENTIRE user data partition (phone/device, call it as you wish) ENCRYPTED.
I am using my phone very much in different environments and if I accidentally loose it or it gets stolen, I want to ensure that nobody can access my private data by any possible means.

So, when I go to the classical place for encrypting phones: Settings -> Security & Privacy, I noticed that the "Encrypt Phone" option is MISSING.
I have only "Encrypt SD Card", but I do not have an SD Card, nor do I use one. I use only the internal flashdisk memory.

I even turned on the Developer mode and searched for that specific setting, but I cannot find it.

I googled about this problem and what I found even deepens the mystery, as there are some contradicting information and it doesn't paint a clear picture on how the hell encryption works on Android 7/8...

- In one place, it says that starting with Android 6 phones, the option of encrypting the entire phone is no longer available, as all phones with Android 6+ preinstalled are already encrypted !
Bump ! Really ?

- Somewhere else, someone says that the Full Disk Encryption (FDE) has been replaced with File Encryption and Google is slowly marking full disk encryption as obsolete...

I found the File Encryption on my phone and I have the possibility to create a file encryption "folder" or "vault" or what is that, but I do NOT want that, as I want the entire partition to be encrypted !

I am using VPNs, SSH keys, Pictures, E-mail accounts, Web browsers with stored passwords, basically the entire user partition contains secrets ! I cannot move everything to a secure container... maybe I forget something, and that something remains unencrypted ?
I cannot move everything to a secure SD Card or to put it in that encrypted "folder", because some secrets are files, some secrets are particular app settings or credentials.

Yes, I read about the fact that in Full Disk Encryption mode, a PIN is required for startup (as I had with my previous phone, which was great for me, by the way), and that PIN can prevent the booting of some basic functions of the device or the functioning alarms or something like that.

To tell you honestly, I don't care about those functions. I only want ENTIRE device encryption with one single PIN code.

I have already changed my SIM PIN (which is another thing, it doesn't relate to this), and I generated a phone PIN & Fingerprint on my phone, and set my phone to Lock after 15 seconds.

For everyday usage, the PIN/Fingerprint is enough to keep others from accessing my content, but what about plain disk access (using some other tools that read the flash disk) if I loose my phone or if my phone gets stolen ?
I liked the previous encryption method.

So, basically, I want to encrypt ENTIRE partition (FDE encryption) with one PIN, not SD Card encryption, not other file encryption solutions, not special vaults, not other stuff... I want my classic encryption back !

Please explain me:

1. Are all the new phones starting from Android 6 already encrypted ?
1.1. If so, why is there a file encryption tool to further encrypt particular files if the user partition is already encrypted ?
1.2. If so, what is the encryption key ? or what kind of encryption is that which does not require a PIN or something ? that means that the key is stored in plain text ? (if I don't offer it a PIN, it means that it must read the key from other places in order to decrypt the data (key that can be read by a thief, too?))

2. If Android 6+ phones are not encrypted, how can I implement full device encryption, and why the hell does Google abandon this kind of full, quick and not-giving-extra-security-thoughts encryption ?

I would kindly ask only experts to reply me.
If you are an expert or you know these things for sure, please reply.
I need a correct, documented (if possible), answer, because the security of my phone depends on it !

Thank you !

 

[Anquietas]

Well... anyone ??? Is this really such a hard question ???

 

[mikedt]

Didn't see your post earlier, but anyway...

1) Yes, I believe they do.
1.1) Possibly it's features provided by certain manufacturers, and/or third-party apps?
1.2) I've read that it's AES-256. The exact technical specs, security details etc. I don't know.
2) Don't know, better ask Google that one.

Maybe your questions were too technical?

 

[Anquietas]

Thank you mikedt, but, like I said, I want an expert opinion with proven facts....

With all due respect for you, all of your answers are not solid proof and are lacking certainty....

 

[mikedt]

Thank you mikedt, but, like I said, I want an expert opinion with proven facts....

With all due respect for you, all of your answers are not solid proof and are lacking certainty....

Well you can wait, and hopefully a real expert might just read this thread, and hopefully take the time to answer with the facts.

China phones and tablets are my interest and what I'm "expert" on.

 

[lunatic59]

Well, frankly, it is a hard question. We are, after all, a user support forum, not Android engineers. That said, we do have some pretty smart cookies in our forums so hopefully someone may be able to address your questions more in depth.


As far as my limited understanding of Android encryption policies go, you are correct that with Marshmallow (6.x) all Android devices are encrypted by default. The only exception there would be unencrypted devices that upgraded from 5.x > 6.x. In those cases users were given the option to remain unencrypted.

And again, Google moved from DE to FBE with Nougat (7.x) You can see that feature update here with a more detailed description here. Personally I think FBE encryption is more secure than a single key to unlock everything. And those keys are accessed by the Android system but aren't readable (without root) by anyone, especially thieves.

This is how Android generates and stores the key:

Upon first boot, the device creates a randomly generated 128-bit master key and then hashes it with a default password and stored salt. The default password is: "default_password" However, the resultant hash is also signed through a TEE (such as TrustZone), which uses a hash of the signature to encrypt the master key.

I hope that give you a little of what you are looking for.