5 ms·
I see a lot of discussion about "Secure Enclave" and other hardware security features and such, and I'm not sure I see the relevance. Assuming that the data has
by rcthompson 11y ago
I see a lot of discussion about "Secure Enclave" and other hardware security features and such, and I'm not sure I see the relevance. Assuming that the data has already been properly encrypted, stored on disk, and purged from memory (by shutting down the phone) by a version of iOS that did not already contain a backdoor when the data was encrypted, there's no magic combination of hardware and software that can decrypt that data without the password, right? This seems to be supported by Apple's claim that the best they could possibly do is provide a channel for the FBI to brute force the password.
So am I missing something that makes the iPhone's internal security architecture relevant here?
- matthew-wegner 11y agoYes. The target phone, an iPhone 5C, lacks a Secure Enclave. The password retry delay, and subsequent deletion of keys, is enforced by iOS here. Apple could provide some kind of software to allow for unlimited attempts (and an interface to do so in an automated way, which the FBI is specifically asking for). On newer phones, the Secure Enclave contains the keys, and enforces both the retry delay and the deletion of its contents. There isn't a way around this without also upgrading/flashing the SE system (and it isn't even clear if Apple can do this in a way that preserves the keys).
- rcthompson 11y agoAh, I see, so with newer hardware it wouldn't even be possible for Apple to enable brute forcing with a software update. But even with older hardware, presumably allowing brute forcing is still the worst they can do, right? (Assuming no prior backdoor exists.)