5 ms·

Could someone ELI5 how this is even conceptually possible? I suppose that is exactly what the ACLU was trying to find out, but I thought something like AES-256

Could someone ELI5 how this is even conceptually possible? I suppose that is exactly what the ACLU was trying to find out, but I thought something like AES-256 should be impossible in principle to break. So what type of thing is most likely happening? Are hardware vendors secretly installing back doors? is there some sort of software encryption standard that's compromised? Or some kind of secret breakthrough in computation theory that easily "solves" encryption? Or maybe, bolstered by NSA surveillance, they just know passwords and unlock codes to devices? Again, I understand that that is the exact mystery here, but I would appreciate knowing if one or more of the possibilities is conceptually more likely than the others.

wmf 6y ago
Most PINs or passwords are so short that they would be easy to brute-force but phones have anti-brute-force mechanisms. So maybe there's a tool that does that.
bawolff 6y ago
Usually the weakest link in any crypto system is the code surounding it. AES-256 is very solid, but using it correctly can be hard. Apple knows what they are doing but they are still human. For example if this is a lock screen bypass (and not a bypass of say the start up process before the key is entered), maybe some memory corruption issue allows you to bypass the password check. Or another example, many people use short numeric pins to encrypt their phones. Apple then does a lot of complex stuff to take that and turn it into a high entropy key. Maybe this is an exploit in that part, allowing for a bruteforce attack. These are all just wild gueses, i have no idea what these capabilities are or for that matter, i dont really know very much about how iphone FDE works.
- aborsy 6y ago
  You can’t turn a low entropy key to a high entropy one by deterministic operations. It’s theoretically impossible.
  - Retric 6y ago
    Yes, what their doing is basically using a randomly generated key per device combined with the user generated key. So, it becomes a question of extracting the hidden key from the device or using the phone to brute force the decryption. However, without that key an attacker is stuck trying to brute force Apples high entropy key, which causes some confusion.
K0balt 6y ago
It is known in some cases and highly probable in others that randomness is compromised systemically in many products and therefore services.
_kbh_ 6y ago
They are likely using GreyShift or Cellbrites UFED or similar products. Most of them leverage exploits in the phone that are usable on the lock screen to either enable you to bypass the lock screen or to allow you to have unlimited password guesses then brute force the password. Thats my guess at least.
- _kbh_ 6y ago
  Im pretty sure its this now. https://twitter.com/matthew_d_green/status/1341746171220537344 https://twitter.com/matthew_d_green/status/13417461712205373...
aborsy 6y ago
The algorithms are secure. * The hdd in a phone that is not powered off is mounted. It takes an exploit in OS to pass the Lock Screen or read the RAM. * The vast majority of people don’t have long alphanumerical passwords. The short pins can be broken. * Some manufacturing companies don’t handle encryption keys properly. Synology NAS stores the keys next to the encrypted data for automatic access upon boot (unless you change the default and store the keys on an encrypted USB or enter keys manually upon boot). * There are sometimes bugs in algorithm implementations, especially if a company roles its own crypto with closed source software. * Sometimes encryption keys are not properly generated. Bad RNGs were a thing for a long time. * And of course there could be back doors for law enforcement.
- BrandoElFollito 6y ago
  Except for obvious pins, they cannot be brute forced due to the throttling built-into the hw vault.
  - aborsy 6y ago
    If you are referring to upper limits on password trials enforced by chips such as TPM, T2 or those in Yubikeys, these are software and hardware — but not fundamental algorithmic — limits. I wouldn't say an HSM such as a Yubikey is secure against a government agency. But apart from that, you can take out the hard drive and deal directly with random blubs, bypassing software limits. Of course these measures are effective against the majority of the attackers, but we are talking about FBI here.
- chirus 6y ago
  The RNG is the backdoor always. And as said above, how you criple the entropy.
- jmnicolas 6y ago
  > people don’t have long alphanumerical passwords Do you know how long is enough? Of course 64 chars would be dope but I'm not good at memorizing things. I know it's trainable but I'm lazy too :) My current password is a bit longer than 10 chars and I wonder if I should upgrade it.
lazulicurio 6y ago
According to this[1] Twitter thread, it's a matter of convenience outweighing security. Phones keep the encryption keys used for most apps in memory so the apps can do background work while the phone is locked. [1] https://twitter.com/matthew_d_green/status/1341746171220537344 https://twitter.com/matthew_d_green/status/13417461712205373...

wmf 6y ago

Most PINs or passwords are so short that they would be easy to brute-force but phones have anti-brute-force mechanisms. So maybe there's a tool that does that.

bawolff 6y ago

Usually the weakest link in any crypto system is the code surounding it. AES-256 is very solid, but using it correctly can be hard. Apple knows what they are doing but they are still human. For example if this is a lock screen bypass (and not a bypass of say the start up process before the key is entered), maybe some memory corruption issue allows you to bypass the password check. Or another example, many people use short numeric pins to encrypt their phones. Apple then does a lot of complex stuff to take that and turn it into a high entropy key. Maybe this is an exploit in that part, allowing for a bruteforce attack. These are all just wild gueses, i have no idea what these capabilities are or for that matter, i dont really know very much about how iphone FDE works.

aborsy 6y ago
You can’t turn a low entropy key to a high entropy one by deterministic operations. It’s theoretically impossible.
- Retric 6y ago
  Yes, what their doing is basically using a randomly generated key per device combined with the user generated key. So, it becomes a question of extracting the hidden key from the device or using the phone to brute force the decryption. However, without that key an attacker is stuck trying to brute force Apples high entropy key, which causes some confusion.

K0balt 6y ago

It is known in some cases and highly probable in others that randomness is compromised systemically in many products and therefore services.

_kbh_ 6y ago

They are likely using GreyShift or Cellbrites UFED or similar products. Most of them leverage exploits in the phone that are usable on the lock screen to either enable you to bypass the lock screen or to allow you to have unlimited password guesses then brute force the password. Thats my guess at least.

_kbh_ 6y ago
Im pretty sure its this now. https://twitter.com/matthew_d_green/status/1341746171220537344 https://twitter.com/matthew_d_green/status/13417461712205373...

aborsy 6y ago

The algorithms are secure. * The hdd in a phone that is not powered off is mounted. It takes an exploit in OS to pass the Lock Screen or read the RAM. * The vast majority of people don’t have long alphanumerical passwords. The short pins can be broken. * Some manufacturing companies don’t handle encryption keys properly. Synology NAS stores the keys next to the encrypted data for automatic access upon boot (unless you change the default and store the keys on an encrypted USB or enter keys manually upon boot). * There are sometimes bugs in algorithm implementations, especially if a company roles its own crypto with closed source software. * Sometimes encryption keys are not properly generated. Bad RNGs were a thing for a long time. * And of course there could be back doors for law enforcement.

BrandoElFollito 6y ago
Except for obvious pins, they cannot be brute forced due to the throttling built-into the hw vault.
- aborsy 6y ago
  If you are referring to upper limits on password trials enforced by chips such as TPM, T2 or those in Yubikeys, these are software and hardware — but not fundamental algorithmic — limits. I wouldn't say an HSM such as a Yubikey is secure against a government agency. But apart from that, you can take out the hard drive and deal directly with random blubs, bypassing software limits. Of course these measures are effective against the majority of the attackers, but we are talking about FBI here.
chirus 6y ago
The RNG is the backdoor always. And as said above, how you criple the entropy.
jmnicolas 6y ago
> people don’t have long alphanumerical passwords Do you know how long is enough? Of course 64 chars would be dope but I'm not good at memorizing things. I know it's trainable but I'm lazy too :) My current password is a bit longer than 10 chars and I wonder if I should upgrade it.

lazulicurio 6y ago

According to this[1] Twitter thread, it's a matter of convenience outweighing security. Phones keep the encryption keys used for most apps in memory so the apps can do background work while the phone is locked. [1] https://twitter.com/matthew_d_green/status/1341746171220537344 https://twitter.com/matthew_d_green/status/13417461712205373...