As long as you meet the minimum speed requirements, that is.
Shortly after the announcement of iOS 8 in 2014, Googlemade headlines by saying that it would make full-device encryption mandatory for new Android devices running version 5.0. It then made more headlines several months later when we discovered that the company backed down, “strongly recommending” that Android device makers enable encryption but stopping short of actually requiring it.
Now Google has published an updated version of the Android Compatibility Definition Document (PDF) for Android 6.0, and it looks like mandatory encryption is back with a couple of exceptions. New devices that come with Marshmallow and have AES crypto performance above 50MiB-per-second need to support encryption of the private user data partition (/data) and the public data partition (/sdcard).
The relevant portion of the document, emphasis ours:
9.9. Full-Disk Encryption
If the device implementation supports a secure lock screen reporting “true” for KeyguardManager.isDeviceSecure(), and is not a device with restricted memory as reported through the ActivityManager.isLowRamDevice() method, then the device MUST support full-disk encryption of the application private data (/data partition), as well as the application shared storage partition (/sdcard partition) if it is a permanent, non-removable part of the device.
For device implementations supporting full-disk encryption and with Advanced Encryption Standard (AES) crypto performance above 50MiB/sec, the full-disk encryption MUST be enabled by default at the time the user has completed the out-of-box setup experience. If a device implementation is already launched on an earlier Android version with full-disk encryption disabled by default, such a device cannot meet the requirement through a system software update and thus MAY be exempted.
The new rule continues to exempt phones and tablets that were launched with older versions of Android and upgraded to Marshmallow later. It also doesn’t apply to devices that don’t meet the minimum crypto performance requirements. This will mostly cover cheap devices with low-end 32-bit SoCs that lack dedicated hardware acceleration for encryption and decryption (or the crypto speed boosts that come from using 64-bit hardware with the ARMv8 instruction set). And devices without lock screens (think Android Wear) that ship with Android 6.0 won’t require encryption by default, either.
All in all this is a step forward, though it includes a few too many loopholes for our liking and does nothing to protect users of most of the Android phones being sold and used today. There are many more changes in the CDD, and our own Ron Amadeo is comparing the new guide to the one for Android 5.1 in order to publish a more detailed report soon.
Source:https://arstechnica.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
