3 ms·

Anyone know how it works? Currently messages are encrypted with the public key of every target device and dispatched directly to the device who decrypts it with

Anyone know how it works? Currently messages are encrypted with the public key of every target device and dispatched directly to the device who decrypts it with keys in the hardware, but that means a new device which comes on won't be able to receive older messages. Now that a new device can receive older messages, and assuming apple doesn't have the keys to your messages, who does the sending? Does one of your existing devices have to relay all the messages by downloading, decrypting, and re-encrypting for the target?

chillaxtian 8y ago
Likely with 'CloudKit End to End Encryption', see page 57 here: https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf > CloudKit end-to-end encryption > Apple Pay Cash, User keywords, Siri Intelligence, and Hey Siri use CloudKit end-to-end encryption with a CloudKit service key protected by iCloud Keychain syncing. For these CloudKit containers, the key hierarchy is rooted in iCloud Keychain and therefore shares the security characteristics of iCloud Keychain—the keys are available only on the user’s trusted devices, and not to Apple or any third party. If access to iCloud Keychain data is lost (see “Escrow security” section later in paper), the data in CloudKit is reset, and if data is available from the trusted local device it is re-uploaded to CloudKit.