New Android phones and tablets that ship with Marshmallow should enable full-disk encryption by default if their AES crypto perfomance exceeds 50 MiB/s
Android 6.0 re-implements mandatory storage encryption for new devices — As long as you meet the minimum speed requirements, that is.
Context & Ripple Effects
Google is re-imposing a rule it once backed away from: any phone or tablet shipping with Android 6.0 Marshmallow must come with full-disk encryption switched on, unless its AES throughput falls below 50 MiB/s. The Ars Technica Android 6.0 review frames this alongside the release's other changes — a tightened permissions system and adoptable SD-card storage — as part of Google's push to close the security gap with iOS.
The performance carve-out matters more than it looks. It quietly splits the device market into a compliant fast tier and an exempt slow tier, and the follow-on coverage shows both halves playing out: Google later ships file-based encryption in Nougat because full-disk encryption still leaves lock screen security years behind iOS, while the excluded low-end tier eventually forces Google to build Adiantum, an entirely different cipher for chips too weak to hit the AES bar.
First-order effects
- OEMs launching Marshmallow hardware now face a binary choice — certify their SoC above 50 MiB/s of AES throughput and ship encrypted by default, or launch unencrypted and wear the security gap.
- Buyers of compliant new devices get encrypted storage with no opt-in step, closing the long-standing default where encryption was something most Android users never enabled.
Second-order effects
- Making encryption universal on capable hardware raises the value of breaking it: within months, researchers demonstrate publicly available exploits that pull disk encryption keys from Qualcomm-chip devices running unpatched software (the Qualcomm key-extraction attacks) — the crypto is only as strong as the kernel holding its keys.
Third-order effects
- The 50 MiB/s threshold institutionalizes a two-speed security model: flagship-tier Android gets mandated full-disk encryption now, then file-based encryption in Nougat, while the sub-threshold tier stays unencrypted until Google designs a cheaper cipher around it — encryption policy becoming a function of silicon cost, not just policy will.
- If the pattern holds, default-on encryption becomes table stakes for new-device certification across Android's lineup, shifting the battleground from whether devices encrypt to how well keys are protected in hardware and how quickly patches reach them.
The trend: Mobile OS vendors are converting storage encryption from an optional feature into a shipping requirement, iterating the scheme itself — full-disk to file-based to lightweight ciphers — as hardware performance tiers diverge.