4 ms·

Unless its running iOS 7 or earlier, good luck with that one.

harryh 11y ago
Why? I'm no particular expert on iOS internals but ultimately the data on the disk is encrypted with a pretty weak (often just 4 digit) key. Shouldn't that be pretty trivial to brute force? Is there something I'm missing?
- skwirl 11y ago
  I think you have it right. They are looking for a way to try PINs until they are in without the feature being invoked that wipes the phone after X incorrect PIN entries. I can't think of a technical reason why this shouldn't be possible.
- melted 11y ago
  IOS 8 does not allow a 4 digit key IIRC. And it has rate limiting against brute force enumeration.
  - ceejayoz 11y ago
    iOS 8 and 9 allow four digit passcodes. I've got one myself.
- dguido 11y ago
  Page 11 of the iOS Security Guide should help explain a lot: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf The user passcode is combined with the UID Key embedded in the Secure Enclave to create an encryption key used for the filesystem (Apple calls this "tangling"). That means you can only crack the key for the filesystem as fast as the Secure Enclave lets you crack it, since every guess is composed of Passcode+Secure_Enclave_Access. And boy, does the Secure Enclave not like to go fast. Every incorrect guess gets fed back to the SE and it gets slower and slower until you can only try 1 guess an hour or, if the user set it, total device erasure after a certain number of failed attempts. See the table on page 12 of the iOS Security Guide. This is why disk crypto on iOS is far better than comparable alternatives on Android. Having a hardware crypto chip with a key embedded at manufacture time on every single phone they produce is something that only Apple can really do. The top poster is correct: in iOS7 and prior there were many default apps that did not use the Data Protection API (aka file encryption). Post-iOS7, most default apps and many 3rd party apps have defaulted to using Data Protection. This means you get very little if you're trying to forensically acquire a disk, as the FBI is, without access to the phone passcode. Sidenote: My company released a crypto abstraction library for interacting with the Secure Enclave last week. It lets mobile app developers instruct the SE to create an ECC private key on their behalf and then sign things with it. This way, you can make passwordless authentication and device binding on iOS possible for your app, potentially improving UX, increasing security, and simplifying your server-side code. Check it out at https://www.passwordlessapps.com https://www.passwordlessapps.com -- we couldn't have made these kinds of security guarantees without the Secure Enclave. We'll eventually support Android, but we'll have to give up some security benefits to do so. EDIT: I've been informed the device in question is an iPhone 5C (no TouchID == no Secure Enclave). This should make things a lot simpler for the FBI. Now I actually do wonder why they're having trouble?
  - ggreer 11y ago
    That's good info, but the device in question is an iPhone 5C. The 5C uses the A6 SoC, which has no secure enclave. I'm not 100% sure what security features it does have, but it sounds as if Apple could load a custom version of iOS that lacks the erasure feature. Even then, decryption is not certain. Files are encrypted with a combination of the passcode and the SoC's unique key.[1] That means unlock attempts have to be done on the phone hardware. If you imaged the device for parallel cracking, you'd need to figure out the 256-bit AES key in addition to the passcode. Still, a 4-digit PIN would certainly be broken. An 8-digit PIN would probably take months to crack (100ms * 10^8 == 116 days). An actual passphrase? Good luck. 1. See the Encryption and Data Protection section of Apple's 2014 iOS security guide, starting on page 9 of https://s3.amazonaws.com/s3.documentcloud.org/documents/1302613/ios-security-guide-sept-2014.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1302...
  - harryh 11y ago
    Oh interesting! I didn't realize that iPhones had this kind of secure hardware. It still seems to me that it might be possible to bypass this though ya definitely much harder. Reading the linked doc. Thanks!
  - netheril96 11y ago
    Can you break the Secure Enclave physically and read out the key embedded?

Why? I'm no particular expert on iOS internals but ultimately the data on the disk is encrypted with a pretty weak (often just 4 digit) key. Shouldn't that be pretty trivial to brute force? Is there something I'm missing?

skwirl 11y ago
I think you have it right. They are looking for a way to try PINs until they are in without the feature being invoked that wipes the phone after X incorrect PIN entries. I can't think of a technical reason why this shouldn't be possible.
melted 11y ago
IOS 8 does not allow a 4 digit key IIRC. And it has rate limiting against brute force enumeration.
- ceejayoz 11y ago
  iOS 8 and 9 allow four digit passcodes. I've got one myself.
dguido 11y ago
Page 11 of the iOS Security Guide should help explain a lot: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf The user passcode is combined with the UID Key embedded in the Secure Enclave to create an encryption key used for the filesystem (Apple calls this "tangling"). That means you can only crack the key for the filesystem as fast as the Secure Enclave lets you crack it, since every guess is composed of Passcode+Secure_Enclave_Access. And boy, does the Secure Enclave not like to go fast. Every incorrect guess gets fed back to the SE and it gets slower and slower until you can only try 1 guess an hour or, if the user set it, total device erasure after a certain number of failed attempts. See the table on page 12 of the iOS Security Guide. This is why disk crypto on iOS is far better than comparable alternatives on Android. Having a hardware crypto chip with a key embedded at manufacture time on every single phone they produce is something that only Apple can really do. The top poster is correct: in iOS7 and prior there were many default apps that did not use the Data Protection API (aka file encryption). Post-iOS7, most default apps and many 3rd party apps have defaulted to using Data Protection. This means you get very little if you're trying to forensically acquire a disk, as the FBI is, without access to the phone passcode. Sidenote: My company released a crypto abstraction library for interacting with the Secure Enclave last week. It lets mobile app developers instruct the SE to create an ECC private key on their behalf and then sign things with it. This way, you can make passwordless authentication and device binding on iOS possible for your app, potentially improving UX, increasing security, and simplifying your server-side code. Check it out at https://www.passwordlessapps.com https://www.passwordlessapps.com -- we couldn't have made these kinds of security guarantees without the Secure Enclave. We'll eventually support Android, but we'll have to give up some security benefits to do so. EDIT: I've been informed the device in question is an iPhone 5C (no TouchID == no Secure Enclave). This should make things a lot simpler for the FBI. Now I actually do wonder why they're having trouble?
- ggreer 11y ago
  That's good info, but the device in question is an iPhone 5C. The 5C uses the A6 SoC, which has no secure enclave. I'm not 100% sure what security features it does have, but it sounds as if Apple could load a custom version of iOS that lacks the erasure feature. Even then, decryption is not certain. Files are encrypted with a combination of the passcode and the SoC's unique key.[1] That means unlock attempts have to be done on the phone hardware. If you imaged the device for parallel cracking, you'd need to figure out the 256-bit AES key in addition to the passcode. Still, a 4-digit PIN would certainly be broken. An 8-digit PIN would probably take months to crack (100ms * 10^8 == 116 days). An actual passphrase? Good luck. 1. See the Encryption and Data Protection section of Apple's 2014 iOS security guide, starting on page 9 of https://s3.amazonaws.com/s3.documentcloud.org/documents/1302613/ios-security-guide-sept-2014.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1302...
- harryh 11y ago
  Oh interesting! I didn't realize that iPhones had this kind of secure hardware. It still seems to me that it might be possible to bypass this though ya definitely much harder. Reading the linked doc. Thanks!
- netheril96 11y ago
  Can you break the Secure Enclave physically and read out the key embedded?