Google launches new encryption mode for entry-level smartphones

Google has created new encryption mode for entry-level smartphones called Adiantum which would be an optional part of Android distributions going forward.

Android runs on a wide range of devices. This includes not just the latest flagship and mid-range phones, but also entry-level Android Go phones sold primarily in developing countries, along with smartwatches and TVs," Google said.

On these devices, AES is so slow that it would result in poor user experience; apps would take much longer to launch, and the device would generally feel much slower. So while storage encryption has been required for most devices since Android 6.0 in 2015, devices with poor AES performance (50 MiB/s and below) are exempt.

We've been working to change this because we believe that encryption is for everyone, it said.

Currently Android supports AES-128-CBC-ESSIV for full-disk encryption and AES-256-XTS for file-based encryption.

However, when AES performance is insufficient there is no widely accepted alternative that has sufficient performance on lower-end ARM processors.

To solve this problem, we have designed a new encryption mode called Adiantum. Adiantum allows us to use the ChaCha stream cipher in a length-preserving mode, by adapting ideas from AES-based proposals for length-preserving encryption such as HCTR and HCH. On ARM Cortex-A7, Adiantum encryption and decryption on 4096-byte sectors is about 10.6 cycles per byte, around 5x faster than AES-256-XTS.

Android device manufacturers can enable Adiantum for either full-disk or file-based encryption on devices with AES performance less than or equal to 50 megabits per second (MiB/sec) and launching with Android Pie," Google mentioned.