diff --git a/cryptfs.c b/cryptfs.c
index 252be0a..93680e5 100644
--- a/cryptfs.c
+++ b/cryptfs.c
@@ -1188,8 +1188,9 @@
     unsigned char ikey[32+32] = { 0 }; /* Big enough to hold a 256 bit key and 256 bit IV */
     EVP_CIPHER_CTX e_ctx;
     int encrypted_len, final_len;
+    int rc = 0;
 
-    /* Turn the password into a key and IV that can decrypt the master key */
+    /* Turn the password into an intermediate key and IV that can decrypt the master key */
     get_device_scrypt_params(crypt_ftr);
 
     switch (crypt_ftr->kdf_type) {
@@ -1240,19 +1241,40 @@
         return -1;
     }
 
+    /* Store the scrypt of the intermediate key, so we can validate if it's a
+       password error or mount error when things go wrong.
+       Note there's no need to check for errors, since if this is incorrect, we
+       simply won't wipe userdata, which is the correct default behavior
+    */
+    int N = 1 << crypt_ftr->N_factor;
+    int r = 1 << crypt_ftr->r_factor;
+    int p = 1 << crypt_ftr->p_factor;
+
+    rc = crypto_scrypt(ikey, KEY_LEN_BYTES,
+                       crypt_ftr->salt, sizeof(crypt_ftr->salt), N, r, p,
+                       crypt_ftr->scrypted_intermediate_key,
+                       sizeof(crypt_ftr->scrypted_intermediate_key));
+
+    if (rc) {
+      SLOGE("encrypt_master_key: crypto_scrypt failed");
+    }
+
     return 0;
 }
 
 static int decrypt_master_key_aux(char *passwd, unsigned char *salt,
-                              unsigned char *encrypted_master_key,
-                              unsigned char *decrypted_master_key,
-                              kdf_func kdf, void *kdf_params)
+                                  unsigned char *encrypted_master_key,
+                                  unsigned char *decrypted_master_key,
+                                  kdf_func kdf, void *kdf_params,
+                                  unsigned char** intermediate_key,
+                                  size_t* intermediate_key_size)
 {
   unsigned char ikey[32+32] = { 0 }; /* Big enough to hold a 256 bit key and 256 bit IV */
   EVP_CIPHER_CTX d_ctx;
   int decrypted_len, final_len;
 
-  /* Turn the password into a key and IV that can decrypt the master key */
+  /* Turn the password into an intermediate key and IV that can decrypt the
+     master key */
   if (kdf(passwd, salt, ikey, kdf_params)) {
     SLOGE("kdf failed");
     return -1;
@@ -1274,9 +1296,18 @@
 
   if (decrypted_len + final_len != KEY_LEN_BYTES) {
     return -1;
-  } else {
-    return 0;
   }
+
+  /* Copy intermediate key if needed by params */
+  if (intermediate_key && intermediate_key_size) {
+    *intermediate_key = (unsigned char*) malloc(KEY_LEN_BYTES);
+    if (intermediate_key) {
+      memcpy(*intermediate_key, ikey, KEY_LEN_BYTES);
+      *intermediate_key_size = KEY_LEN_BYTES;
+    }
+  }
+
+  return 0;
 }
 
 static void get_kdf_func(struct crypt_mnt_ftr *ftr, kdf_func *kdf, void** kdf_params)
@@ -1294,15 +1325,18 @@
 }
 
 static int decrypt_master_key(char *passwd, unsigned char *decrypted_master_key,
-        struct crypt_mnt_ftr *crypt_ftr)
+                              struct crypt_mnt_ftr *crypt_ftr,
+                              unsigned char** intermediate_key,
+                              size_t* intermediate_key_size)
 {
     kdf_func kdf;
     void *kdf_params;
     int ret;
 
     get_kdf_func(crypt_ftr, &kdf, &kdf_params);
-    ret = decrypt_master_key_aux(passwd, crypt_ftr->salt, crypt_ftr->master_key, decrypted_master_key, kdf,
-            kdf_params);
+    ret = decrypt_master_key_aux(passwd, crypt_ftr->salt, crypt_ftr->master_key,
+                                 decrypted_master_key, kdf, kdf_params,
+                                 intermediate_key, intermediate_key_size);
     if (ret != 0) {
         SLOGW("failure decrypting master key");
     }
@@ -1549,14 +1583,18 @@
   void *kdf_params;
   int use_keymaster = 0;
   int upgrade = 0;
+  unsigned char* intermediate_key = 0;
+  size_t intermediate_key_size = 0;
 
   SLOGD("crypt_ftr->fs_size = %lld\n", crypt_ftr->fs_size);
   orig_failed_decrypt_count = crypt_ftr->failed_decrypt_count;
 
   if (! (crypt_ftr->flags & CRYPT_MNT_KEY_UNENCRYPTED) ) {
-    if (decrypt_master_key(passwd, decrypted_master_key, crypt_ftr)) {
+    if (decrypt_master_key(passwd, decrypted_master_key, crypt_ftr,
+                           &intermediate_key, &intermediate_key_size)) {
       SLOGE("Failed to decrypt master key\n");
-      return -1;
+      rc = -1;
+      goto errout;
     }
   }
 
@@ -1565,7 +1603,8 @@
   if (create_crypto_blk_dev(crypt_ftr, decrypted_master_key,
                             real_blkdev, crypto_blkdev, label)) {
     SLOGE("Error creating decrypted block device\n");
-    return -1;
+    rc = -1;
+    goto errout;
   }
 
   /* If init detects an encrypted filesystem, it writes a file for each such
@@ -1580,25 +1619,37 @@
   if (fs_mgr_do_mount(fstab, DATA_MNT_POINT, crypto_blkdev, tmp_mount_point)) {
     SLOGE("Error temp mounting decrypted block device\n");
     delete_crypto_blk_dev(label);
-    crypt_ftr->failed_decrypt_count++;
+
+    /* Work out if the problem is the password or the data */
+    unsigned char scrypted_intermediate_key[sizeof(crypt_ftr->
+                                                   scrypted_intermediate_key)];
+    int N = 1 << crypt_ftr->N_factor;
+    int r = 1 << crypt_ftr->r_factor;
+    int p = 1 << crypt_ftr->p_factor;
+
+    rc = crypto_scrypt(intermediate_key, intermediate_key_size,
+                       crypt_ftr->salt, sizeof(crypt_ftr->salt),
+                       N, r, p, scrypted_intermediate_key,
+                       sizeof(scrypted_intermediate_key));
+    if (rc == 0 && memcmp(scrypted_intermediate_key,
+                          crypt_ftr->scrypted_intermediate_key,
+                          sizeof(scrypted_intermediate_key)) == 0) {
+      SLOGE("Right password, so wipe");
+      rc = -1;
+    } else {
+      SLOGE(rc ? "scrypt failure, so allow retry" :
+                 "Wrong password, so allow retry");
+      rc = ++crypt_ftr->failed_decrypt_count;
+      put_crypt_ftr_and_key(crypt_ftr);
+    }
   } else {
-    /* Success, so just umount and we'll mount it properly when we restart
-     * the framework.
+    /* Success!
+     * umount and we'll mount it properly when we restart the framework.
      */
     umount(tmp_mount_point);
     crypt_ftr->failed_decrypt_count  = 0;
-  }
 
-  if (orig_failed_decrypt_count != crypt_ftr->failed_decrypt_count) {
-    put_crypt_ftr_and_key(crypt_ftr);
-  }
-
-  if (crypt_ftr->failed_decrypt_count) {
-    /* We failed to mount the device, so return an error */
-    rc = crypt_ftr->failed_decrypt_count;
-
-  } else {
-    /* Woot!  Success!  Save the name of the crypto block device
+    /* Save the name of the crypto block device
      * so we can mount it when restarting the framework.
      */
     property_set("ro.crypto.fs_crypto_blkdev", crypto_blkdev);
@@ -1636,6 +1687,11 @@
     }
   }
 
+ errout:
+  if (intermediate_key) {
+    memset(intermediate_key, 0, intermediate_key_size);
+    free(intermediate_key);
+  }
   return rc;
 }
 
@@ -1768,7 +1824,7 @@
         /* If the device has no password, then just say the password is valid */
         rc = 0;
     } else {
-        decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr);
+        decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr, 0, 0);
         if (!memcmp(decrypted_master_key, saved_master_key, crypt_ftr.keysize)) {
             /* They match, the password is correct */
             rc = 0;
@@ -2603,7 +2659,7 @@
         }
     }
 
-    decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr);
+    decrypt_master_key(passwd, decrypted_master_key, &crypt_ftr, 0, 0);
     create_crypto_blk_dev(&crypt_ftr, decrypted_master_key, real_blkdev, crypto_blkdev,
                           "userdata");
 
diff --git a/cryptfs.h b/cryptfs.h
index e765847..0b4cda6 100644
--- a/cryptfs.h
+++ b/cryptfs.h
@@ -41,6 +41,7 @@
 
 #define MAX_KEY_LEN 48
 #define SALT_LEN 16
+#define SCRYPT_LEN 32
 
 /* definitions of flags in the structure below */
 #define CRYPT_MNT_KEY_UNENCRYPTED 0x1 /* The key for the partition is not encrypted. */
@@ -115,11 +116,28 @@
                                                     set, hash of first block, used
                                                     to validate before continuing*/
 
-  /* key_master key, used to sign the derived key
+  /* key_master key, used to sign the derived key which is then used to generate
+   * the intermediate key
    * This key should be used for no other purposes! We use this key to sign unpadded 
    * data, which is acceptable but only if the key is not reused elsewhere. */
   __le8 keymaster_blob[KEYMASTER_BLOB_SIZE];
   __le32 keymaster_blob_size;
+
+  /* Store scrypt of salted intermediate key. When decryption fails, we can
+     check if this matches, and if it does, we know that the problem is with the
+     drive, and there is no point in asking the user for more passwords.
+
+     Note that if any part of this structure is corrupt, this will not match and
+     we will continue to believe the user entered the wrong password. In that
+     case the only solution is for the user to enter a password enough times to
+     force a wipe.
+
+     Note also that there is no need to worry about migration. If this data is
+     wrong, we simply won't recognise a right password, and will continue to
+     prompt. On the first password change, this value will be populated and
+     then we will be OK.
+   */
+  unsigned char scrypted_intermediate_key[SCRYPT_LEN];
 };
 
 /* Persistant data that should be available before decryption.