Android Pattern Lock

A pattern lock is a graphical authentication method used on Android to control access to a device.

The principle involves connecting a set of dots arranged on a grid, most often 3x3, to form a unique pattern.

This pattern constitutes a form of knowledge-based authentication (KBA) and can replace or complement a PIN, an alphanumeric password, or biometric authentication (fingerprint, facial recognition).

When a pattern is defined, the Android system encodes the sequence of dots into a number, then applies a cryptographic hash function (historically SHA-1).

The hash result is stored in a secure area of the system, such as the gesture.key file on older versions of Android.

Each time the device is unlocked, the entered pattern is transformed in the same way and then compared to the stored hash.

If the two values match, access is granted.

Recent versions of Android strengthen this mechanism by using Trusted Execution Environments (TEEs) and more robust key derivations.

Decoding a lock pattern relies on a brute-force attack.

The principle involves extracting the file containing the pattern hash (for example, gesture.key on older systems), then calculating the hash of all possible patterns to find a match.

For a 3x3 grid, the total number of valid patterns is close to one million.

The dots in the Android lock pattern are not explicitly numbered on the screen, but they follow a logical convention.

The 3x3 grid is typically numbered from left to right and top to bottom, like a matrix.

The top-left dot corresponds to the number 0, then the numbering progresses horizontally to dot 2, before continuing to the next row.

The storage of the Android lock pattern has evolved significantly over the years to enhance security.

On older versions of Android (up to Android 4.x), the pattern is stored in the system file gesture.key. The pattern is first converted into a sequence of bytes representing the order of the selected points, and then this sequence is hashed using the SHA-1 algorithm. Only the hash result is saved in the file, never the pattern in plain text.

Starting with Android 5.0 (Lollipop), Android introduced the Gatekeeper service. The pattern is no longer simply compared via a static hash, but integrated into a key derivation mechanism with an associated attempt counter. The derived data is stored in system files such as gatekeeper.pattern.key, with a progressive slowdown after several failed attempts.

On recent versions of Android, the pattern is protected by the phone's secure hardware, via the Trusted Execution Environment (TEE) or a dedicated chip (StrongBox). The scheme is then used to unlock an internal cryptographic key, without its derived representation being directly accessible to the operating system. This architecture prevents hash extraction and makes offline attacks virtually impossible.