[Defy Android Development] Defier525:
Defyluks - System encryption for the Defy(+)​

Warning: This patch is only intended for people who are familiar with Linux and LUKS and know what they are doing. I take no responsibility for any damage whatsoever resulting from using this patch.​

Before applying this patch, I strongly recommend making a full backup of your device. Uninstallation is currently not supported, excepting via flashing back the Stock-ROM via sbf-flash and redoing everything.

Last update: 2012-12-02

== Motivation ==

Until now, there is no working solution for encryption the internal data partition and sdcard of a Defy(+). In theory, Android 3.x+ provides such a possibility, but (afaik) all currently available builds of CM9/CM10/CM10.1 etc. don't implement this feature yet. Apart from that, many users of the Motorola Defy share the opinion that Android 2.3 is more suitable for the device than Android 4.x due to a smaller memory footprint etc. Even in case the standard Android encryption shall become in newer CM releases in the near future, having an alternative for CM7 might be still desirable.

One general problem of the built-in encryption in Android 3.x+ is also the fact that you can't move the data partition on the sd card. In case of hardware damage, you don't have the possibility to pull out your data and send in the device for repairs. Also, you cna't easily mount the data partition from others systems using existing tools like LUKS for Linux or FreeOFTE in Windows.

== Related projects ==

There are a few related projects, but they only work for other devices like the HTC Wildfire or the Nexus One:

LUKS/LuksApp (https://github.com/guardianproject/LUKS)

Luksunlock (https://github.com/guardianproject/luksunlock)

Yaffsunlock (https://github.com/scintill/yaffsunlock)

== What does this patch do? ==

First of all, the patch adds a few new components to CM7:

- the cryptsetup binary (taken from GuardianProject's LUKS porting project)

- kernel modules which provide support for ext4 and jbd2 (taken from Quarx2k's custom kernel for CM10)

- a modified init.rc which is based on the one provided by CM7.2-stable (warning: it replaces the existing one!)

- (temporary) a sample encryption key

After installing this patch, the existing internal data partition in the mtd flash will be ignored during bootup and not mounted anymore! Instead, an encrypted data partion from the sd card will be used.

== Status ==

The patch is currently under heavy development. The current version 0.1 is intended only to give a first preview about this development. Currently, the patch only provides a rudimentary security enhancement in case the hardware breaks, not in case of theft (see the open TODOs below). The performance impact is high for write operations, but negligible for read operations, see the attached benchmark.

== Requirements ==

- Basic knowledge about LUKS

- rooted Defy with CWM and CM7.2-stable

- microSD card in your Defy

== Installation ==

Step 1: Create a key (on your desktop) which will be used for the encryption later on:

dd if=/dev/random of=lukskey bs=1 count=32

Step 2: Mount the sd card externally (via adapter or from CWM) and repartition it. In the following, I assume that the sd card is available as device /dev/sdb. Here is how to repartition it:

/dev/sdb1: the existing FAT32 file system (you can shrink your existing one)

/dev/sdb2: a new partition with fs type (82)

Step 3: Encrypt the second partition of your sd card with the key you created previously:

cryptsetup -c cipher=aes-cbc-plain luksFormat /dev/sdb2 /path/to/lukskey

Step 4: Crypto-mount the partition and create an ext4 fs on it:

cryptsetup --key-file /path/to/lukskey luksOpen /dev/sdb2 encrypteddata

mkfs.ext4 /dev/mapper/encrypteddata

cryptsetup luksClose /dev/mapper/encrapteddata

Step 5: Replace the keyfile in "system/etc/lukskey" in the supplied defyluks.zip archive by your key (that is: unpack the archive, replace the key, pack the archive again)

Step 6: Install the previously packed defyluks.zip archive via CWM on top of CM7.2-stable and boot your device.

== Version history ==

0.1 (02.12.2012): First pre-release

== TODOs (sorted by priority) ==

- cleanly luksClose the mounted data partition in order to prevent data loss

- allow for key entry via some minui (the hardcoded key does not really enhance security greatly. Of course, if someone steals only your sd card but not your phone or if your hardware breaks and you have to send it in it already helps, but apart from that?)

- support loopback-devices on top of the existing vfat filesystem on the sdcard (remove need for repartitioning the card)

- support a more secure cipher like aes-cbc-essiv (the Defy stock kernel lacks support for that, will have to add the proper module)

- make the installation process much easier (i.e. by providing a setup ui like LuksApp does)

- enhance the documentation (provide a real user manual)

- allow for using the internal nand flash (I see some cons here, but okay maybe some people still might want that)

- support other file systems like yaffs2 (does not make sense on sd card, but surely does when using the internal nand flash)

- encrypt the rest of the sd card as well

- support further Defy-ROMs

- replace the precompiled binaries by self-compiled binaries

- replace the current build script (a cruel hack) by a real build system

- support other CM7.2 devices

- make the first bootup faster (currently takes aprox 3 minutes)

:D Any feedback is warmly welcome!