a question about the duress password

elbarto

Well, I don't understand much about the system yet, but please answer a question I have.

Theoretically, I don't have anything considered illegal, but I do have private information in my life, passwords, conversations, and other things that I don't want anyone to see.

If authorities seize electronic devices in my house and I hear someone saying "police" at the door and I quickly type the duress password, the device becomes unrecoverable, or is it possible to somehow reverse this? From what I've read, part of the decryption keys are erased, so it doesn't erase, it just gets corrupted, meaning the data is still there. I don't want to know anything related to evidence destruction and such. I just want to understand how this function works, which I found quite interesting.

de0u

elbarto Given the way that flash storage works, there isn't a way to reliably delete data stored in flash, except:

Melt the flash storage, or grind it to dust, or
Encrypt the data from the beginning and store the encryption key in one place outside of flash storage. Then it is possible to "delete" the data all at once by scrubbing the key.

I lied a little bit in my description of #2, but fundamentally that is what GrapheneOS does. Details: https://grapheneos.org/faq#encryption

I recommend reading the rest of the FAQ as well.

Blastoidea

It is my understanding that without the key, it cannot be decrypted, in any reasonable time.

elbarto

Blastoidea

If I have several user profiles, is this process also valid for the profiles or does each one have to have different passwords? In fact, I want to know if this duress password process is irrecoverable, even after that, you don't even care about what might happen.

other8026

elbarto is this process also valid for the profiles or does each one have to have different passwords?

User profiles each have their own unique, randomly generated disk encryption key and their own unique key encryption key is used to encrypt it.

Even if you use the same passphrase for multiple profiles, each of those profiles still ends up with a unique key encryption key and a compromise of the OS while one of them is active won't leak the passphrase.

Both quotes from https://grapheneos.org/faq#encryption

de0u

elbarto A duress PIN/password "will irreversibly wipe the device" (source). It wipes all of the Weaver slots and all of the eSIMs. What remains are the bootloader, the firmware, the AVB key, and the GrapheneOS system partition (all of which are public, thus not encrypted).

I have done this. The device powers off, and then attempts to reboot, but the boot fails into Recovery when it isn't possible to mount the user data partition. A "factory reset" in Recovery reinitializes the user data partition.