5 ms·

So what's the deal with this? Isn't it just brute force? I would've expected the NSA to have something like that since iPhones first hit the market.

sp332 7y ago
The main trick is bypassing the increasing timeouts for multiple incorrect guesses.
- pingyong 7y ago
  Shouldn't you always be able to completely bypass that by taking out the chip or something and just probing it directly? I guess that might be a bit much for normal police work, but in terms of "can the government (read: NSA) get into this" this doesn't really seem to change anything.
  - kop316 7y ago
    Possibly, but that still defaults back to brute forcing a long passphrase with a salt. If guessing the passphrase goes above a certain entropy and Apple derives the password with a key stretching algorithm, then the timeouts won't matter.
    - pingyong 7y ago
      That's exactly what I mean - the usual key complexity rules apply, and have always applied.
      - testvox 7y ago
        But they shouldn't. The key you enter as a user is actually only half of the key needed to decrypt the data. The other half of the key is generated by the secure enclave when the device was first powered on. This part of the key alone should be impossible to brute force and is stored in tamper resistant flash memory on the secure enclave co-processor. So you would need to break open the co-processor without destroying its contents and read the secure enclave key before any brute forcing could happen directly on the encrypted data. And no you can't just try to brute force it by sending decryption requests to the secure enclave. The secure enclave itself implements a exponentially increasing lockout time and won't respond to decryption requests during it. [0] [0] https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...
        pingyong 7y ago
        If the secure enclave implements the time lockout (well, supposedly I guess considering it seems broken) then the device is indeed a game changer, thanks for that information!
  - sp332 7y ago
    The external interface of the chip does not let you just read its contents - that's the whole point of a secure enclave device. You'd have to decap it and make some extremely fine connections to the memory parts of the chip.
  - testvox 7y ago
    The lockout delay is implemented in the chip itself in newer iphones (I think starting with iphone 5S). So no, taking the chip out buys you nothing. > To further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode at the Lock screen. ...On devices with Secure Enclave, the delays are enforced by the Secure Enclave coprocessor. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...
throw0101a 7y ago
> I would've expected the NSA to have something like this since iPhones first hit the market. If they do, why would they reveal it for something as 'basic' as a single attacker? Or they may have broken it, and simply 'reverse engineered' the path to evidence with public means: * https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction Agencies don't want to reveal means and methods if they don't have to.

sp332 7y ago

The main trick is bypassing the increasing timeouts for multiple incorrect guesses.

pingyong 7y ago
Shouldn't you always be able to completely bypass that by taking out the chip or something and just probing it directly? I guess that might be a bit much for normal police work, but in terms of "can the government (read: NSA) get into this" this doesn't really seem to change anything.
- kop316 7y ago
  Possibly, but that still defaults back to brute forcing a long passphrase with a salt. If guessing the passphrase goes above a certain entropy and Apple derives the password with a key stretching algorithm, then the timeouts won't matter.
  - pingyong 7y ago
    That's exactly what I mean - the usual key complexity rules apply, and have always applied.
    - testvox 7y ago
      But they shouldn't. The key you enter as a user is actually only half of the key needed to decrypt the data. The other half of the key is generated by the secure enclave when the device was first powered on. This part of the key alone should be impossible to brute force and is stored in tamper resistant flash memory on the secure enclave co-processor. So you would need to break open the co-processor without destroying its contents and read the secure enclave key before any brute forcing could happen directly on the encrypted data. And no you can't just try to brute force it by sending decryption requests to the secure enclave. The secure enclave itself implements a exponentially increasing lockout time and won't respond to decryption requests during it. [0] [0] https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...
      - pingyong 7y ago
        If the secure enclave implements the time lockout (well, supposedly I guess considering it seems broken) then the device is indeed a game changer, thanks for that information!
- sp332 7y ago
  The external interface of the chip does not let you just read its contents - that's the whole point of a secure enclave device. You'd have to decap it and make some extremely fine connections to the memory parts of the chip.
- testvox 7y ago
  The lockout delay is implemented in the chip itself in newer iphones (I think starting with iphone 5S). So no, taking the chip out buys you nothing. > To further discourage brute-force passcode attacks, there are escalating time delays after the entry of an invalid passcode at the Lock screen. ...On devices with Secure Enclave, the delays are enforced by the Secure Enclave coprocessor. If the device is restarted during a timed delay, the delay is still enforced, with the timer starting over for the current period. https://www.apple.com/in/business-docs/iOS_Security_Guide.pdf https://www.apple.com/in/business-docs/iOS_Security_Guide.pd...

throw0101a 7y ago

> I would've expected the NSA to have something like this since iPhones first hit the market. If they do, why would they reveal it for something as 'basic' as a single attacker? Or they may have broken it, and simply 'reverse engineered' the path to evidence with public means: * https://en.wikipedia.org/wiki/Parallel_construction https://en.wikipedia.org/wiki/Parallel_construction Agencies don't want to reveal means and methods if they don't have to.