New Android Marshmallow devices must have default encryption, Google says

If you’ve ever wondered how device manufacturers like Samsung or LG know how to build their Android smartphones to support new versions of the OS, here’s your answer: an obscure document called the Android Compatibility Definition.

The document lays out all of the specifications for hardware and software compatibility, from device configurations, memory and power usage to application permissions and security.

Google just released these compatibility requirements for Android 6.0 (also known as Marshmallow), and there’s one new requirement that is justifiably getting a lot of attention – full-disk encryption must be enabled by default.

If the devices meet or exceed certain memory and performance figures, at any rate. (In other words, budget devices may still end up unencrypted.)

Google says encryption must be turned on by default, meaning devices are encrypted when a consumer has completed out-of-the-box setup:

For device implementations supporting full-disk encryption and with Advanced Encryption Standard (AES) crypto performance above 50MiB/sec, the full-disk encryption MUST be enabled by default at the time the user has completed the out-of-box setup experience.

You might remember that, last September, a Google spokeswoman declared that encryption would be enabled by default in all Android devices running Android 5.0 (Lollipop).

At the time, Google’s Android had fallen behind Apple’s iOS in data protection – iOS 8 had just been released, with encryption turned on by default.

The announcements that both Android and iOS devices would have default encryption kicked off a spat about encryption backdoors between Google, Apple and the law enforcement community that has been going on ever since.

Well, Google’s promise of default encryption in Lollipop devices didn’t come to fruition, and the ‘requirement’ for device makers to turn on encryption at setup was changed last March to a ‘strong recommendation’.

The problem, Google said, was poor performance on many devices.

Now that default encryption is once again being described by Google as a MUST for device manufacturers, it seems like the pro-encryption crowd can claim another victory.

Sort of.

Along with devices that have insufficient cryptographic performance, devices that were launched with earlier versions of Android are also exempted when upgrading to version 6.0:

If a device implementation is already launched on an earlier Android version with full-disk encryption disabled by default, such a device cannot meet the requirement through a system software update and thus MAY be exempted.

Devices without a lock screen are also exempt (such as wearables), because a device is encrypted when you set up a lock screen with a passcode, which is used to generate the encryption key.

Even if you don’t set up a lock screen with a passcode out of the box, encryption will still be set up with a default passcode.

Google also says device makers must not send the encryption key off the device, which means no one – not law enforcement, not a crook who nabs your phone, and not even Google – can decrypt your device without your passcode.

How to protect your Android

For advice on what to do when you review your phone’s security settings, please take a look at our article, Why you shouldn’t worry about privacy and security on your phone. (Covers iOS, Android and Windows Phone.)

– Phone v. Phone courtesy of Shutterstock –

Image of phone with marshmallows courtesy of Shutterstock.com.