4 ms·

> Where Apple provides overwhelming detail about their best security systems (file encryption, iOS, iMessage), they provide distressingly little technical detai

> Where Apple provides overwhelming detail about their best security systems (file encryption, iOS, iMessage), they provide distressingly little technical detail about the weaker links like iCloud encryption. Sounds like the author missed Apple's BlackHat 2016 talk. It goes into lots of technical detail on Cloud Key Vault.[1] Well worth watching -- and a very cool implementation of a secure backup system designed for "adversarial clouds". It's pretty cool how it retains end-to-end encryption of your keychain while also backing it up to untrusted clouds. Basically it employs Hardware Security Modules that limit recovery attempts to 10 tries before destroying the data, thus protecting against backend brute forcing and allowing you to use your relatively weak device passcode to encrypt the backup. And here's the kicker -- they put the HSM firmware signing keys in a blender so even an adversarial government can't force them to modify them. Update: I guess he did watch the video (he previously wrote a whole post on it). So I'm not sure what he thinks is missing, or maybe I misunderstood and he's only complaining about non-keychain data encryption. [1] https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be&t=25m43s https://www.youtube.com/watch?v=BLGFriOKz6U&feature=youtu.be...

JoachimSchipper 9y ago
The author, in fact, has specifically written an article on the talk you mention: https://blog.cryptographyengineering.com/2016/08/13/is-apples-cloud-key-vault-crypto/ https://blog.cryptographyengineering.com/2016/08/13/is-apple.... Matthew Green is a capable cryptographer who engages with the wider security community and practical encryption a lot (e.g. https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple-imessage/); https://blog.cryptographyengineering.com/2016/03/21/attack-o... if you're interested in this kind of thing, I'd recommend following him more closely (e.g. on Twitter.)
Buge 9y ago
This is covered in the blog post: >With one major exception — iCloud Keychain, which I’ll discuss below — iCloud fails the mud puddle test. That’s because most Apple files are not end-to-end encrypted. The blog post is saying that iCloud backups are not protect from Apple, except keychain backups. So your files, messages, etc are not protected from Apple. And the video you posted seems to only be about keychain backups.
kodablah 9y ago
I think the author is looking for written documentation and reference material, not a presentation that may be outdated and not apply to this situation. I concur with the author, this should be available in clear unambiguous docs. Instead, many are unfortunately forced to point to old videos and depositions as reference material.
- abalone 9y ago
  August 2016 is not that old, it clearly applies to this situation (“adversarial clouds”), and also the salient points are documented in the iOS security white paper which is updated annually: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - sandworm101 9y ago
    And why should we assume that every cloud is the same? The china cloud might be different in tiny but important ways. Or all the clouds might have 'evolved' a few minutes ago to comort with some new apple policy. This is all about trusting a corporation. I still prefer to handle my own encryption, keeping my keys how and where i like.
    - abalone 9y ago
      Nobody is assuming that. The whole point is it can store secrets on adversarial clouds. The key stays with the client.
ec109685 9y ago
Apple still could release a software update that would update the HSM firmware to remove the limit of ten tries before the keys are lost. Mentioned here: https://9to5mac.com/2016/02/25/apple-working-on-stronger-icloud-backup-encryption-and-iphone-security-to-counter-fbi-unlock-requests/ https://9to5mac.com/2016/02/25/apple-working-on-stronger-icl...
- eridius 9y ago
  You're confusing the behavior of the device with the behavior of the HSM modules used for iCloud storage.
  - abalone 9y ago
    eridius is right. Apple cannot update the firmware of the backend HSM clusters without data loss. (If you believe what they say.) They literally throw the signing keys into a blender. The article refers to device firmware not the iCloud backend.
    - ec109685 9y ago
      Yeah, I got confused by HSM and Secure Enclave. I still think it is crackable given it is all secured by a user’s pin which can be verified on device by software Apple controls.
      - abalone 9y ago
        Of course Apple controls the software. Apple or any manufacturer could push an update overnight that disables all encryption and transmits your data to Donald Trump or whoever they want the next time you enter your passcode. There’s exactly zero “security researcher insight” in observing that. The question is, if you trust that iOS and iCloud work the way Apple says they do (under oath), how vulnerable are they to an adversarial cloud. They have designed a system to keep your keychain safe under these conditions.
        9y ago

JoachimSchipper 9y ago

The author, in fact, has specifically written an article on the talk you mention: https://blog.cryptographyengineering.com/2016/08/13/is-apples-cloud-key-vault-crypto/ https://blog.cryptographyengineering.com/2016/08/13/is-apple.... Matthew Green is a capable cryptographer who engages with the wider security community and practical encryption a lot (e.g. https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-apple-imessage/); https://blog.cryptographyengineering.com/2016/03/21/attack-o... if you're interested in this kind of thing, I'd recommend following him more closely (e.g. on Twitter.)

Buge 9y ago

This is covered in the blog post: >With one major exception — iCloud Keychain, which I’ll discuss below — iCloud fails the mud puddle test. That’s because most Apple files are not end-to-end encrypted. The blog post is saying that iCloud backups are not protect from Apple, except keychain backups. So your files, messages, etc are not protected from Apple. And the video you posted seems to only be about keychain backups.

kodablah 9y ago

I think the author is looking for written documentation and reference material, not a presentation that may be outdated and not apply to this situation. I concur with the author, this should be available in clear unambiguous docs. Instead, many are unfortunately forced to point to old videos and depositions as reference material.

abalone 9y ago
August 2016 is not that old, it clearly applies to this situation (“adversarial clouds”), and also the salient points are documented in the iOS security white paper which is updated annually: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
- sandworm101 9y ago
  And why should we assume that every cloud is the same? The china cloud might be different in tiny but important ways. Or all the clouds might have 'evolved' a few minutes ago to comort with some new apple policy. This is all about trusting a corporation. I still prefer to handle my own encryption, keeping my keys how and where i like.
  - abalone 9y ago
    Nobody is assuming that. The whole point is it can store secrets on adversarial clouds. The key stays with the client.

ec109685 9y ago

Apple still could release a software update that would update the HSM firmware to remove the limit of ten tries before the keys are lost. Mentioned here: https://9to5mac.com/2016/02/25/apple-working-on-stronger-icloud-backup-encryption-and-iphone-security-to-counter-fbi-unlock-requests/ https://9to5mac.com/2016/02/25/apple-working-on-stronger-icl...

eridius 9y ago
You're confusing the behavior of the device with the behavior of the HSM modules used for iCloud storage.
- abalone 9y ago
  eridius is right. Apple cannot update the firmware of the backend HSM clusters without data loss. (If you believe what they say.) They literally throw the signing keys into a blender. The article refers to device firmware not the iCloud backend.
  - ec109685 9y ago
    Yeah, I got confused by HSM and Secure Enclave. I still think it is crackable given it is all secured by a user’s pin which can be verified on device by software Apple controls.
    - abalone 9y ago
      Of course Apple controls the software. Apple or any manufacturer could push an update overnight that disables all encryption and transmits your data to Donald Trump or whoever they want the next time you enter your passcode. There’s exactly zero “security researcher insight” in observing that. The question is, if you trust that iOS and iCloud work the way Apple says they do (under oath), how vulnerable are they to an adversarial cloud. They have designed a system to keep your keychain safe under these conditions.
      - 9y ago