1# Encrypted Storage 2 3Since Android U, AVF (with Microdroid) supports Encrypted Storage which is the storage solution 4in a VM. Within a VM, this is mounted at a path that can be retrieved via the [`AVmPayload_getEncryptedStoragePath()`][vm_payload_api]. 5Any data written in encrypted storage is persisted and is available next time the VM is run. 6 7Encrypted Storage is backed by a para-virtualized block device on the guest which is further 8backed by a disk image file in the host. The block device is formatted with an ext4 filesystem. 9 10## Security 11 12Encrypted Storage uses block level encryption layer (Device-Mapper's "crypt" target) using a key 13derived from the VM secret and AES256 cipher with HCTR2 mode. The Block level encryption ensures 14the filesystem is also encrypted. 15 16### Integrity 17Encrypted Storage does not offer the level of integrity offered by primitives such as 18authenticated encryption/dm-integrity/RPMB. That level of integrity comes with substantial 19disk/performance overhead. Instead, it uses HCTR2 which is a super-pseudorandom 20permutation encryption mode, this offers better resilience against malleability attacks (than other 21modes such as XTS). 22 23## Encrypted Storage and Updatable VMs 24 25With [Updatable VM feature][updatable_vm] shipping in Android V, Encrypted Storage can be accessed 26even after OTA/updates of boot images and apks. This requires chipsets to support [Secretkeeper HAL][sk_hal]. 27 28 29[vm_payload_api]: https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Virtualization/vm_payload/include/vm_payload.h;l=2?q=vm_payload%2Finclude%2Fvm_payload.h&ss=android%2Fplatform%2Fsuperproject%2Fmain 30[updatable_vm]: https://cs.android.com/android/platform/superproject/main/+/main:packages/modules/Virtualization/docs/updatable_vm.md 31[sk_hal]: https://cs.android.com/android/platform/superproject/main/+/main:system/secretkeeper/README.md 32