[Xiaomi Poco X3 Pro] lordmd:
I found this older thread about the POCO X3 NFC: https://xdaforums.com/t/phone-says-its-encrypted-but-is-it-really.4167645/

I do not know if the info there is also valid for the X3 Pro ... or if it even was correct in the first place. (Cause just 1 other user mentioned this and no one else talked about it.)

In the 2nd post there is tha guy mentioning that MIUI is not changing the decryption keys when changing the password. Is this a problem?

I have bootloader unlocked and Magisk + LSposed installed. Using the latest stock MIUI. From what I have read online ... unlocking hte bootloader just allows to tamper more with the device - and allows an attacker to bypass the hardware security stuff to run brute force without using the phone (to bypass rate limits and run brute force very fast) - shouldn'd that still be safe with a long password?

Well Android allows at max 16 chars and I am using 16 chars letter, numbers, special chars now + biometrics for screen unlock. After the boot it seems it forces you to put in the password. (Biometrics not working.) TWRP decryption is working - and only works with the password I put. (Not with "default_password".) Even when adb is enabled (I usually leave USB debugging disabled) it seems not to work unless I also change the charging options to allow file transfer (not only charging battery) - which always seems to reset to recharging battery only after a reboot. (And not allow for changes unless passwort is put in once at least.)

I am talking mainly about attacks where you are able to power off your phone and someone else gets physical access to it. (Like police or NSA lol. After I got it back I would always completely wipe it to make sure they have not installed some keyloggers.) Unless the bootloader and internal keystore somehow (I do not have much knowledge about this) just checks your passwort but is still using "default_password" in the background (and TWRP also works using this) should not a strong password be safe?

I think the key generation with "default_password" itself still would have some random compoment (every time you reset the sytsem and it gets newly encrypted)? And it only matters if that "key encryption key" gets re-encrypted when changing the password. (And not only encrypted/hashed with "default_password".) As mentioned here by Elcomsoft: https://blog.elcomsoft.com/2018/05/demystifying-android-physical-acquisition/

"It still takes effort to decrypt the smartphone even if the data is encrypted with “default_password”. Much depends on the encryption implementation of a particular vendor. As an example, some vendors will not re-encrypt the KEK (Key Encryption Key) when the user changes their passcode; this in turn allows decrypting the data regardless of the current passcode by simply using “default_password”. The same situation occurs if, at the time of the initial setup, the vendor opts to start encrypting the phone before the user sets the passcode. According to Oxygen, this is exactly what happens on Motorola smartphones, which can be extracted and decrypted regardless of the lock screen password – but only if Secure Startup is not enabled."

(This info still seems to be for the old FDE but I think it should be similar fo file based encryption which is used in the POCO X3 Pro?)

If the TWRP only works with the correct password (otherwise showing encrypted stuff for the files that are supposed to be encrypted in th FBE - not everything like in the FDE but still enough I think) ... is it safe to say that this key encryption key is getting re-encrypted?