Samsung Android must be configured to require the user to present the Password Authentication Factor prior to decryption of protected data, encrypted DEKs, KEKs, and [selection: long-term trusted channel key material, all software-based key storage, no other keys] at startup.

The intent of this requirement is to prevent decryption of protected data before the user has authorized to the device using the Password Authentication Factor. The Password Authentication Factor is also required in order to derive the key used to decrypt sensitive data, which includes software-based secure key storage.

For devices with Full Disk Encryption (FDE) this is implemented by the Secure Startup feature. For devices with File Based Encryption (FBE) this is implemented by the Strong Protection feature.

Secure startup/Strong Protection protects the Samsung Android device by requiring the user password to be entered before the device starts up. When enabled, the default cryptographic keys are replaced with keys derived from the user password.

This feature must be enabled for a Samsung Android device to be in the NIAP-certified CC Mode of operation.

SFR ID: FMT_SMF_EXT.1.1 #47,
FIA_UAU_EXT.1.1