Section 2.15 deals with the conditions under which the Keychain should be considered secure: - Items are stored with a protection class that makes them only av

Section 2.15 deals with the conditions under which the Keychain should be considered secure: - Items are stored with a protection class that makes them only available when the device is unlocked. (see Section 2.14) - A strong passcode of 6 alphanumeric digits is enforced (reduces the risk of brute-force attacks) The second point is as relevant as the first. The paper goes on to say: according to [App10b]: ... The standard simple code of 4 numeric digits would be brute-forced in less than 9 minutes. Based on the assumption that the counter for wrong tries in the iOS can be bypassed, as it is not hardware-based. [BS11b] provides a tool for passcode bruteforce attacks. Forensic toolkits, like the one from Elcomsoft (http://www.elcomsoft.com/eift.html http://www.elcomsoft.com/eift.html), are able to recover numeric pass codes and extract data in less than an hour, even on newer devices. With a weak passcode, which most people use, the keychain does not offer much protection against dedicated attackers with device access.