3 ms·
They "just" need to break the users password. If it's a weak one, which is likely for most users, a simple dictionary attack would work.
by greiskul 11y ago
They "just" need to break the users password. If it's a weak one, which is likely for most users, a simple dictionary attack would work.
- deleted 11y ago[deleted]
- X-Istence 11y agoThe users password goes through a password based key derivation function, that function spits out an key that is use for the AES crypto used for the file system. Now, the PBKDF requires a secret that is only stored within the iPhone itself (within the CPU even, where it can't be read out directly). So if we instead grab a copy of the data, all we get is an AES encrypted file system. We have 2 choices. 1. We can attack AES directly, and attempt to brute force the AES key, or 2. We can attempt to get the AES key somehow by bruteforcing the users password. 2 is infinitely simpler compared to 1. However, 2 becomes more difficult (but still less so than just cracking AES itself) when you need to run your brute force guesses through the CPU within the iPhone.
- peeters 11y agoI guess that's my question...is there really no way to get the secret off of the hardware so that the function can be reproduced "offline".
- X-Istence 11y agorestating your question: Has Apple been lying to its customers for years?
- ascorbic 11y agoThis is exactly the threat model this was designed to defeat, so I would imagine not. At the very least, if there is a way to do it Apple is probably unaware. If they are aware, they'll probably open themselves to a class action suit, as its one of the core features that they advertised.