4 ms·

Removing the flash chips wouldn't do anything for you. The encryption key is combined with a UID value stored in the Secure Enclave (assigned during manufactor

Removing the flash chips wouldn't do anything for you. The encryption key is combined with a UID value stored in the Secure Enclave (assigned during manufactoring). The Secure Enclave is a blackbox which receives values, combines them with its secret key and then spits out the final value. [0] A high iteration count is also used which also makes this process take around 80ms. Cracking of the passcode must be done "on device" unless someone can extract the UID from the Secure Enclave. Additionally, any device using an A7 or newer has incorrect passcode rate limits enforced by the Secure Enclave as well. As to what is different between iOS7 vs iOS8/9, I'm not entirely sure. Matthew Green speculates[1] that they may load special firmware that bypasses the "lock" screen which is purely a UI hack. Apparently before iOS8 only a subset of user data was being encrypted compared to what is being encrypted now. [0] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf [1] http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app...

pflanze 11y ago
What I'm taking away from this is: 1. re encryption: > Apparently before iOS8 only a subset of user data was being encrypted compared to what is being encrypted now. Which leaves my question unanswered: in that case the government could still unsolder the flash chip and access that data. Your link [1] mentions that this would include pictures and SMS messages, which is probably what they were after. 2. Custom firmware from Apple will help to access encrypted parts since it would allow to run the OS under the cracker's control, who then only needs to brute force the password and not the UID. According to [1] this is still slowed down to 12.5 attempts per seconds (80 ms) and newer iPhone hardware additionally contains hardware enforced rate or number of guesses limits. Edit: custom firmware would of course also help in case 1 in the sense that it makes it unnecessary to unsolder the flash. But my estimate for the effort needed to do the latter would be around USD 1000 if done exceptionally, perhaps USD 100 if done often enough. I wonder if Apple's unlocking service would be any cheaper. So perhaps the reason it's not being done is psychological (Apple complying is offloading the question whether it's OK), or the law, or worries about the constitution.
- wyldfire 11y ago
  Apple still brokers the key exchange, so they can be used to facilitate a lawful interception at that point.
  - pflanze 11y ago
    What key exchange? Are you talking about SSL or software signing keys? These wouldn't give the DoJ access to the data on the device in this case. It would only help while the user is still using it, unsuspectingly entering the password.

pflanze 11y ago

What I'm taking away from this is: 1. re encryption: > Apparently before iOS8 only a subset of user data was being encrypted compared to what is being encrypted now. Which leaves my question unanswered: in that case the government could still unsolder the flash chip and access that data. Your link [1] mentions that this would include pictures and SMS messages, which is probably what they were after. 2. Custom firmware from Apple will help to access encrypted parts since it would allow to run the OS under the cracker's control, who then only needs to brute force the password and not the UID. According to [1] this is still slowed down to 12.5 attempts per seconds (80 ms) and newer iPhone hardware additionally contains hardware enforced rate or number of guesses limits. Edit: custom firmware would of course also help in case 1 in the sense that it makes it unnecessary to unsolder the flash. But my estimate for the effort needed to do the latter would be around USD 1000 if done exceptionally, perhaps USD 100 if done often enough. I wonder if Apple's unlocking service would be any cheaper. So perhaps the reason it's not being done is psychological (Apple complying is offloading the question whether it's OK), or the law, or worries about the constitution.

wyldfire 11y ago
Apple still brokers the key exchange, so they can be used to facilitate a lawful interception at that point.
- pflanze 11y ago
  What key exchange? Are you talking about SSL or software signing keys? These wouldn't give the DoJ access to the data on the device in this case. It would only help while the user is still using it, unsuspectingly entering the password.