3 ms·

This is also a great product move by Apple, as if they win it shows even the FBI can't access your locked phone.

by chrischen 11y ago

tosseraccount 11y ago
Sure they can't mill down the chip and probe it with some advanced microscope?
- andromeduck 11y ago
  It'd be difficult and expensive. There's also a good chance you'd meaa up and destroy the data.
  - salgernon 11y ago
    What about asserting write lock on the flash? By piggybacking a copied (but encrypted), identical flash part, or an ICE that allows reads from the original flash and writes to another part, the os wouldn't necessarily know there was anything nefarious going on. Besides, if this particular information is that valuable, they would have no problem paying for it. Which brings us back to: it isn't the device they want cracked, but governmental oversight of (civilian) encryption.
    - interpol_p 11y ago
      I'm not sure but I think the problem is that the data isn't just encrypted with the user's passcode, it's encrypted with the passcode entangled with the private key of the secure enclave chip (which, presumably, is unknown to anyone). So they can't just attempt to brute force the encrypted data, as the encryption key would be 256 bits or more rather than just a 4 or 6-digit numeric passcode. That's why they want Apple to open the OS up to brute force passcode attempts. Edit: there's no secure enclave chip on the phone in question, but it seems that iOS 8 and later encrypt the user data with a separate private key combined with the user passcode.
- hueving 11y ago
  If a component of the key is the pin the user inputs, probing the chip won't reveal much.
  - barsonme 11y ago
    I'm not a crypto expert so take what I say with a grain of salt, but... The password is tangled with the UID burned into the device at its creation, creating the 'passcode key' that secures the phone[0]. If extracting the UID is somehow possible, it doesn't sound impossible to try all 10,000 combinations (assuming the a 4-digit passcode is used) offline, on different software. [0] - http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app...
    - noselasd 11y ago
      One would hope that the part where this UID is stored at least have all the basic tamper proof protections so it self destructs if tampered with, such as e.g. many SIM cards does.
micwawa 11y ago
Yup. I just bought a new iphone.
- nicky0 11y ago
  Why didn't you just wipe the data from it and start again?
  - micwawa 11y ago
    I got my previous phone three years ago - the battery has gone to pot and Verizon has been telling me I'm reading for an upgrade - but I kept putting off going to the Verizon store to get a new one. I thought, sure, I'll go for the secure phone which is the product itself, and not the one that is created by companies that wish to make me the product.
onion2k 11y ago
Perhaps, but that would be a strong incentive for government to mandate that devices have to have a backdoor in the future, or that they can't use strong encryption so devices can be read without a backdoor. I doubt the FBI see losing this particular battle as the end of the war. There's also another possibility, albeit less likely, that the FBI know they'll lose but they don't care because they can already read the device and they want any terrorists to believe they don't have the information on it. That's a pretty full-on "tinfoil hat theory" though.
- Tepix 11y ago
  As has been pointed out by a study the other day, this would lead to people buying non-US phones. Strong crypto is out there. Worldwide. Subverting it in a single country will not make it go away.
- ubernostrum 11y ago
  Mandated backdoors are something that law enforcement wants, but something that the national-security complex probably doesn't want (they seem to feel they can get what they want without help, and don't want to make US personnel/corps easier targets for their overseas counterparts). And the national-security complex is likely to win that fight.

This is also a great product move by Apple, as if they win it shows even the FBI can't access your locked phone.

tosseraccount 11y ago

Sure they can't mill down the chip and probe it with some advanced microscope?

andromeduck 11y ago
It'd be difficult and expensive. There's also a good chance you'd meaa up and destroy the data.
- salgernon 11y ago
  What about asserting write lock on the flash? By piggybacking a copied (but encrypted), identical flash part, or an ICE that allows reads from the original flash and writes to another part, the os wouldn't necessarily know there was anything nefarious going on. Besides, if this particular information is that valuable, they would have no problem paying for it. Which brings us back to: it isn't the device they want cracked, but governmental oversight of (civilian) encryption.
  - interpol_p 11y ago
    I'm not sure but I think the problem is that the data isn't just encrypted with the user's passcode, it's encrypted with the passcode entangled with the private key of the secure enclave chip (which, presumably, is unknown to anyone). So they can't just attempt to brute force the encrypted data, as the encryption key would be 256 bits or more rather than just a 4 or 6-digit numeric passcode. That's why they want Apple to open the OS up to brute force passcode attempts. Edit: there's no secure enclave chip on the phone in question, but it seems that iOS 8 and later encrypt the user data with a separate private key combined with the user passcode.
hueving 11y ago
If a component of the key is the pin the user inputs, probing the chip won't reveal much.
- barsonme 11y ago
  I'm not a crypto expert so take what I say with a grain of salt, but... The password is tangled with the UID burned into the device at its creation, creating the 'passcode key' that secures the phone[0]. If extracting the UID is somehow possible, it doesn't sound impossible to try all 10,000 combinations (assuming the a 4-digit passcode is used) offline, on different software. [0] - http://blog.cryptographyengineering.com/2014/10/why-cant-apple-decrypt-your-iphone.html http://blog.cryptographyengineering.com/2014/10/why-cant-app...
  - noselasd 11y ago
    One would hope that the part where this UID is stored at least have all the basic tamper proof protections so it self destructs if tampered with, such as e.g. many SIM cards does.

micwawa 11y ago

Yup. I just bought a new iphone.

nicky0 11y ago
Why didn't you just wipe the data from it and start again?
- micwawa 11y ago
  I got my previous phone three years ago - the battery has gone to pot and Verizon has been telling me I'm reading for an upgrade - but I kept putting off going to the Verizon store to get a new one. I thought, sure, I'll go for the secure phone which is the product itself, and not the one that is created by companies that wish to make me the product.

onion2k 11y ago

Perhaps, but that would be a strong incentive for government to mandate that devices have to have a backdoor in the future, or that they can't use strong encryption so devices can be read without a backdoor. I doubt the FBI see losing this particular battle as the end of the war. There's also another possibility, albeit less likely, that the FBI know they'll lose but they don't care because they can already read the device and they want any terrorists to believe they don't have the information on it. That's a pretty full-on "tinfoil hat theory" though.

Tepix 11y ago
As has been pointed out by a study the other day, this would lead to people buying non-US phones. Strong crypto is out there. Worldwide. Subverting it in a single country will not make it go away.
ubernostrum 11y ago
Mandated backdoors are something that law enforcement wants, but something that the national-security complex probably doesn't want (they seem to feel they can get what they want without help, and don't want to make US personnel/corps easier targets for their overseas counterparts). And the national-security complex is likely to win that fight.