4 ms·
The users password goes through a password based key derivation function, that function spits out an key that is use for the AES crypto used for the file system
by X-Istence 11y ago
The users password goes through a password based key derivation function, that function spits out an key that is use for the AES crypto used for the file system.
Now, the PBKDF requires a secret that is only stored within the iPhone itself (within the CPU even, where it can't be read out directly). So if we instead grab a copy of the data, all we get is an AES encrypted file system.
We have 2 choices. 1. We can attack AES directly, and attempt to brute force the AES key, or 2. We can attempt to get the AES key somehow by bruteforcing the users password.
2 is infinitely simpler compared to 1. However, 2 becomes more difficult (but still less so than just cracking AES itself) when you need to run your brute force guesses through the CPU within the iPhone.
- peeters 11y agoI guess that's my question...is there really no way to get the secret off of the hardware so that the function can be reproduced "offline".
- X-Istence 11y agorestating your question: Has Apple been lying to its customers for years?
- ascorbic 11y agoThis is exactly the threat model this was designed to defeat, so I would imagine not. At the very least, if there is a way to do it Apple is probably unaware. If they are aware, they'll probably open themselves to a class action suit, as its one of the core features that they advertised.