6 ms·

If my phone is protected with a 4 digit pin, and someone has physical access to it, why is it so hard to decrypt? Can someone point me to an explanation of the

by snissn 11y ago

If my phone is protected with a 4 digit pin, and someone has physical access to it, why is it so hard to decrypt? Can someone point me to an explanation of the hardware that protects my data?

astrange 11y ago
https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf page 10.
- ludbb 11y ago
  The more relevant part about passcodes (4 or 6 digits) is described on page 12. It's not fully specified, but since the PDF mentions "iteration count" then Apple is using some sort of KDF after you enter your PIN to make brute force attacks harder to perform. It also mentions the following delays: Delays between passcode attempts Attempts Delay Enforced 1-4 none 5 1 minute 6 5 minutes 7-8 15 minutes 9 1 hour There's also an optional setting you can enable so that after 10 failed consecutive attempts the device's data is wiped.
  - Someone 11y ago
    Minor correction: "IOS supports six-digit, four-digit, and arbitrary-length alphanumeric passcodes" Also note how they mention "six-digit" before "four-digit". Six digits is the default on new installations now (http://arstechnica.com/apple/2015/06/apple-to-require-6-digit-passcodes-on-newer-iphones-ipads-under-ios-9/ http://arstechnica.com/apple/2015/06/apple-to-require-6-digi...)
    - ludbb 11y ago
      Sure, that correction is correct ;) but it's not mentioned in that section of the mentioned documented. It leads me to believe that the restrictions described do not apply to them.
      - scintill76 11y ago
        > It leads me to believe that the restrictions described do not apply to them. Which restrictions? The table of delays is on the same page as "six-digit, four-digit, and arbitrary-length alphanumeric passcodes", about 3 paragraphs away. If this is what you're referring to, I see no reason to believe PINs vs. passwords are treated differently.
        ludbb 11y ago
        Right, my bad, I missed it.
klodolph 11y ago
Key stretching combined with hardware security (i.e., it's hard to extract the encryption key from the chip). https://en.wikipedia.org/wiki/Key_stretching https://en.wikipedia.org/wiki/Key_stretching

by snissn 11y ago

If my phone is protected with a 4 digit pin, and someone has physical access to it, why is it so hard to decrypt? Can someone point me to an explanation of the hardware that protects my data?

astrange 11y ago

https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf page 10.

ludbb 11y ago
The more relevant part about passcodes (4 or 6 digits) is described on page 12. It's not fully specified, but since the PDF mentions "iteration count" then Apple is using some sort of KDF after you enter your PIN to make brute force attacks harder to perform. It also mentions the following delays: Delays between passcode attempts Attempts Delay Enforced 1-4 none 5 1 minute 6 5 minutes 7-8 15 minutes 9 1 hour There's also an optional setting you can enable so that after 10 failed consecutive attempts the device's data is wiped.
- Someone 11y ago
  Minor correction: "IOS supports six-digit, four-digit, and arbitrary-length alphanumeric passcodes" Also note how they mention "six-digit" before "four-digit". Six digits is the default on new installations now (http://arstechnica.com/apple/2015/06/apple-to-require-6-digit-passcodes-on-newer-iphones-ipads-under-ios-9/ http://arstechnica.com/apple/2015/06/apple-to-require-6-digi...)
  - ludbb 11y ago
    Sure, that correction is correct ;) but it's not mentioned in that section of the mentioned documented. It leads me to believe that the restrictions described do not apply to them.
    - scintill76 11y ago
      > It leads me to believe that the restrictions described do not apply to them. Which restrictions? The table of delays is on the same page as "six-digit, four-digit, and arbitrary-length alphanumeric passcodes", about 3 paragraphs away. If this is what you're referring to, I see no reason to believe PINs vs. passwords are treated differently.
      - ludbb 11y ago
        Right, my bad, I missed it.

klodolph 11y ago

Key stretching combined with hardware security (i.e., it's hard to extract the encryption key from the chip). https://en.wikipedia.org/wiki/Key_stretching https://en.wikipedia.org/wiki/Key_stretching