18 ms·
iMessage with PQ3 Cryptographic Protocol
- soxicywn 3y agoDoes anyone know if this is still vulnerable to the iCloud Backups problem? The only solution to that right now is for you and your contact to turn on Advanced Data Protection. Curious if that’s still required.
- etchalon 3y agoThat's still required.
- gjsman-1000 3y agoI don't anticipate this changing either - because, let's face it, losing all of your Photos and Messages is, to most people, a bigger deal than perfect security. I'm experienced with Apple products - but there was one time that I actually got stuck in an E2EE loop and was forced to reset all E2EE data on iCloud. I don't know what I did wrong - but if someone in tech, like myself, can get stuck in an E2EE lockout, I can't imagine other people.* *This was not Advanced Data Protection. This was stuff that was E2EE for all accounts - like passwords and health information. As such there's no recovery contact.
- mcny 3y agoI thought the fix was trivial - all I need to do is go to settings > my face >> icloud >>> show all >>>> messages and make sure the toggle is off? doesn't that stop iCloud syncing, at least on my end? I understand I can't control what happens on the other end of the conversation but that is all I need to do on my end, right?
- gjsman-1000 3y agoCorrect. I was referring to the OP asking if Apple would ever fix E2EE not protecting, by default, Photos and Messages and so forth.
- dwaite 3y agoE2EE refers to transporting protocols and not data at rest, so the phrasing here is wrong. If you choose to have some of your data in iCloud, it is transported and stored encrypted. However, one of the keys is escrowed in a HSM cluster for an audited recovery process. This is how you go request access be restored via technical support with Apple. This is also how surviving family members can get access to photos and the like (requiring a court order, at least in the US). Since they have the key, government entities can request access within the extent of their respective local laws. If you turn on the Advanced Data Protection feature, Apple no longer has that key escrowed, cannot help with account recovery, and can no longer give out a key they don't have.
- fh9302 3y agoYou either have to enable E2EE or disable both Messages in iCloud and device backups. Otherwise the device backups contain a copy of your messages.
- galad87 3y agoThe "Messages in iCloud" sync is end to end, so you can enable it and disable iCloud backup, or manually backup on your computer: https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651
- zchrykng 3y agoYeah, it is end to end encrypted, but the keys are part of your device's iCloud backup. So unless you turn on end to end encryption for that backup or disable it, Apple can access the keys required to decrypt the iMessage in iCloud messages.
- etchalon 3y agoI believe the reason iMessages aren't protected with iCloud Backup is because they're stored decrypted in the SQLite database iMessage uses, chat.db.
- sneak 3y agoiMessage’s practical lack of e2ee isn’t a matter of “perfect security”. It’s simply not e2ee because the keys are escrowed to the middle service. It’s not even a little bit secure. The encryption has been fully backdoored by sharing the endpoint keys off of the device. Apple turns over customer data on over 70,000 customers per year without a warrant under FISA/702 (prism) and NSLs. The number gets bigger every year. This isn’t a theoretical threat. The number is even bigger if you include all the search warrants, too. EDIT: Even if you enable their optional e2ee for backups (which nobody does), iMessage the platform is still vulnerable because the conversations you have with others are insecure because the other end of the conversation is escrowing their keys to Apple via non-e2ee backups. If you enable ADP iMessage only becomes secure for the case where you are only iMessaging yourself. It’s simply not private or secure. You can’t be “slightly encrypted” or “mostly private”.
- gjsman-1000 3y agoUnless you enable Advanced Data Protection, which escrows the keys solely on your device. This is hardly a secret or a scandal.
- etchalon 3y agoAs far as I know, iMessage keys are not escrowed to any middle service. What are you basing that belief on?
- sneak 3y agoApple’s own HT202303. It is quite clear on the matter, even going so far as to point out that the keys are rotated when you turn off iCloud Backup. Read the parts about Messages in iCloud, the service used to sync messages between devices. Those keys are included in the non-e2ee iCloud Backup. Both are enabled by default.
- etchalon 3y agoHT202303 refers to storing the keys for the Messages in iCloud feature.
- gruez 3y ago>The only solution to that right now is for you and your contact to turn on Advanced Data Protection or don't use icloud backup. Also, confusingly "messages in icloud" is end to end encrypted, and enabling it disables messages for being included in icloud backup.
- tsunamifury 3y agoNothing is secure that goes to a server. Period. Apple turned over iMessage conversations between journalists and senators at Trumps request. They encrypt but give away the keys in many jurisdictions.
- gruez 3y ago>Apple turned over iMessage conversations between journalists and senators at Trumps request. source?
- modeless 3y ago> "messages in icloud" is end to end encrypted, and enabling it disables messages for being included in icloud backup. This is misleading at best. Careful reading of Apple's disclosures reveals that the "messages in iCloud" encryption keys are still included in iCloud backups, giving Apple the capability to decrypt your messages on demand for law enforcement or for any other reason of their choosing. The messages may not be in your "iCloud backups", but that's just because they are stored on Apple's "Messages in iCloud" servers instead. Apple still has them and the keys to decrypt them. https://support.apple.com/guide/security/security-of-icloud-backup-sec2c21e7f49/1/web/1 https://support.apple.com/guide/security/security-of-icloud-... > When iCloud Backup is turned on, the backup includes a copy of the Messages in iCloud encryption key so Apple can help the user recover their messages even if they have lost access to iCloud Keychain and their trusted devices.
- snowwrestler 3y agoJust a bit lower on the same page: > When iCloud Backup is turned on, everything inside it is end-to-end encrypted, including the Messages in iCloud encryption key. Meaning that Apple does not actually have access to that key, because it is encrypted before being saved to their servers.
- xoa 3y ago>Does anyone know if this is still vulnerable to the iCloud Backups problem? The only solution to that right now is for you and your contact to turn on Advanced Data Protection. This is such a strange two sentences as a "problem". E2EE security, as it says in the name, is about the protection of dara transmission between two trusted end points. That's it. What the trusted end points themselves choose to do with that data before and after is completely out of scope, and has nothing whatsoever to do with the data transmission aspect. This is true of everything ever. No communication service stops people from backing up with encryption or not, local or remote, or from copy/pasting or for that matter taking photos of the screen ("analog hole"). If you want to "protect" the data from the trusted owners themselves now we're in the realm of DRM. In this case what you wrote is "do non-e2ee remote backups still occur if users do not enable e2ee remote backups or backup locally?" to which the answer is yes. I definitely do blame Apple for not having APIs for backing up to arbitrary network servers when it comes to iDevices, but it's still orthogonal. And remember iMessage is on the Mac as well where people may be backing up anywhere.
- AnonC 3y ago> No communication service stops people from backing up with encryption or not, local or remote, or from copy/pasting or for that matter taking photos of the screen ("analog hole"). At least for the first part on backing up without copy pasting or using the “analog hole”, Signal expressly prohibits and doesn’t allow any kind of backup — encrypted or not — on iOS/iPadOS/macOS.
- zchrykng 3y agoThis lack of backups makes Signal less appealing to anyone who isn't a security/privacy enthusiast/nut. 99+% of people want their messages to work and not lose them when their phone is broken.
- codedokode 3y agoNo I do not agree with you. Majority of people never read their message history, want their messages to self-detruct and don't want to get into a situation like when a new partner reads chat history with all previous partners. Majority of people do not record their conversations and do not need this. And most messaging applications are designed countrary to what people need - they preserve history specially for that curious new partner. Or maybe for a marketing department to analyze user's interests.
- tw04 3y agoThat will always be the case with Apple. Their default behavior is to cater to a user that will shoot themselves in the foot anytime they have the opportunity. I applaud them for giving users the option to be secure, but I don't blame them in the least for making you turn on the thing that can make grandma lose all of her message history.
- jacobgorm 3y agoWill the code be available?
- deleted 3y ago[deleted]
- xxmarkuski 3y agoDavid Basin and his team have done really cool work in the past. I was lucky enough to see a talk by him about EMV Race, which are exploits in the EMV protocol used by credit cards. Their approach included modeling this protocol in Tamarin. Its website [0] shows demonstrative videos. [0] https://emvrace.github.io/ https://emvrace.github.io/
- helf 3y ago[dead]
- yesimahuman 3y agoPretty great advertisement for Signal, as the sole cross-platform option in the PQC bucket. Does it seem likely they will match Apple here eventually?
- adamtaylor_13 3y agoIn my experience, these markets can overlap but don’t necessarily always do so. I message everyone via iMessage, and while I enjoy the feeling of security from the blue bubble it’s not a must-have for me. Signal on the other hand seems like a must-have for many people living under oppressive regimes or whose data is significantly more valuable than mine. I am one data point, but that’s what I’ve noticed in my bubble.
- yesimahuman 3y agoFor me, Signal is so much better for my friend or work group chats. My friends are on a mix of devices and platforms, and Signal is a lot nicer for embedded media sharing. And the auto disappearing feature is a must!
- adamtaylor_13 3y agoHmm… Does signal only really work when everyone uses it? Or can you include people who are just using regular SMS?
- Yesway 3y ago[flagged]
- fallat 3y agohttps://xkcd.com/538/ https://xkcd.com/538/
- lapetitejort 3y agoAdvanced encryption, until it comes time to text 70% of the phones in the world, in which case it defaults to a protocol released 32 years ago.
- tsunamifury 3y agoYes but that would have meant giving up sales in exchange for actually backing up their words. They aren’t even going to use the developed encrypted RCS protocol. Apple, when it comes to their values, is all lip service. I have intimate experience here with them both openly lying and purposefully deceiving their user base in this case.
- Jtsummers 3y agoWhat word? They never said they'd open iMessage. FaceTime is what they intended (or at least Jobs announced the intent) to open, and then that got caught up in a patent dispute.
- tsunamifury 3y agoNo, they could have shipped a product on android, or they could have used secure RCS, or several other things. FaceTime is not really true either. This was a convenient mistruth. There were several way to remedy that situation. Also your misremembering iMessage there was no such issue.
- sandyarmstrong 3y agoThis is pretty fascinating. For easier reading, the Signal blog post [0] they link to is great. Both Signal and Apple went with CRYSTALS-Kyber [1] as their post-quantum algorithm. If you're interested in the math, and maybe learned at some point about how classic public key cryptography is built on the idea that it's easy to multiply two primes, but hard to factor them, and how this (or other math problems) can be used as a one-way function to make encryption hard to break, the hard math problem that backs Kyber is the "learning-with-errors" [2] problem. [0] https://signal.org/blog/pqxdh/ https://signal.org/blog/pqxdh/ [1] https://pq-crystals.org/kyber/ https://pq-crystals.org/kyber/ [2] https://en.wikipedia.org/wiki/Learning_with_errors https://en.wikipedia.org/wiki/Learning_with_errors
- gjsman-1000 3y agoWas the CRYSTALS-Kyber name intentionally, or accidentally, a reference to Kyber Crystals (I.e. The Lightsaber energy source?)
- ZeWaka 3y agoAbsolutely a reference. Dilithium (from Star Trek) is name of their signature algorithm.
- throw0101c 3y agoThe trick to naming things is to first find a cool word/reference, and then 'reverse engineer' it as an acronym second: * https://en.wikipedia.org/wiki/Backronym https://en.wikipedia.org/wiki/Backronym
- ryukafalz 3y agoThough you can easily take it too far; I think US legislators have been running out of reasonable backronyms :)
- saagarjha 3y agoI'm amused by the Padmé reference as well.
- InsomniacL 3y agoI wonder if Apple will use this as an excuses to not comply when it comes to providing cross platform messaging in the EU.
- jitl 3y agoThe EU already decided that under the DMA, iMessage is too small to qualify for the interoperability requirement. Apple is however adding (unencrypted) RCS support to comply with Chinese government law, which requires that all 5G phones support RCS.
- deleted 3y ago[deleted]
- olliej 3y agoYou don’t need (unencrypted) in this. RCS is not encrypted. It never has been. Google has a proprietary extension that puts encrypted blobs into RCS messages, but that would be no different from apple shoving iMessage blobs into RCS and calling it RCS.
- madeofpalk 3y agoApple already has cross platform messaging in the EU. SMS! Besides, the EU doesn't care about iMessage.
- upofadown 3y ago>When iMessage launched in 2011, it was the first widely available messaging app to provide end-to-end encryption by default,... Until very recently, iMessage provided no way to verify that you and your correspondent were not both connected to the server, rather than each other. So guaranteed end-to end encryption wasn't possible. Even now, with a recent version of iOS, they allow the users to blithely exchange messages without any identity verification. The identity numbers used to do this are hidden behind menus. So not really E2EE in any practical sense.
- maqp 3y agoSame thing with Signal and most other messengers. Can you link to some documentation that shows iMessage even has the identity numbers?
- nicolas_17 3y agohttps://support.apple.com/en-us/HT213465#verify https://support.apple.com/en-us/HT213465#verify
- maqp 3y agoWonderful, thank you so much! Good to see Apple fix their app finally.
- upofadown 3y agoIsn't all this post quantum stuff a little premature? The standards haven't settled. We don't even know if there is a possible quantum threat to cryptography yet. The more we work on the problem the less likely it seems. Last I heard we were 1 or 2 orders of magnitude away from physical noise performance that would make such a threat possible. Edit, added: Harvest now, decrypt later applies to any encrypted data. There is nothing special about the quantum threat. This all only makes sense if we can predict what the actual threat is ... and so far we can't. This reminds me of Pascal's Wager[1] [1] https://en.wikipedia.org/wiki/Pascal%27s_wager https://en.wikipedia.org/wiki/Pascal%27s_wager
- dijit 3y agoYou'd be right except that anything encrypted now can be stored and cracked later. I remember as part of the snowden leaks there was documentation about this kind of delayed phase collection. Basically store as much signals data as you can and try to crack it later if there's a weakness discovered with the protocol or computing power starts being capable of wholesale attack. You might remember that hashes are significantly easier to crack with "rainbow tables", and so we added cryptographic "salts" to online password storage. We discovered that about 15 years ago and started salting all our passwords, but for a large window of time all of those old leaked databases were suddenly extremely easy to crack. Now, Imagine the NSA is 10 years ahead of us (and you might be close with that estimation), so even if they can't crack RSA right now they're much closer than we are, and even we get there we will likely have a large window of time before we fix it properly. (not that we're talking RSA here, but you get my point). https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked-nsa-doc-says-it-can-collect-and-keep-your-encrypted-data-as-long-as-it-takes-to-crack-it/ https://www.forbes.com/sites/andygreenberg/2013/06/20/leaked...
- therealmarv 3y agoWould be great if we could uninstall iMessage completely out of iPhone for security reasons or make it opt in by default. Unfortunately it's not possible and it will be a gateway for security issues and malware in the following years to come. Post quantum cryptography is nice but that's one of the smallest problems with iMessage.
- upget_tiding 3y agoYou can enable lockdown mode to decrease the attack surface. https://support.apple.com/en-us/105120 https://support.apple.com/en-us/105120
- dijit 3y agoYou can very easily disable iMessage completely
- cyclecount 3y agoiMessage can be disabled in Settings > Messages
- yosito 3y agoWouldn't SMS be more insecure?
- maqp 3y agoFor message security, absolutely. For endpoint security (iMessage as exploit surface), not so much.
- azinman2 3y agoJust as a reminder making crack-proof encryption standard everywhere is a trade off. It’s often discussed and presented in forums like this as the only and just choice (and I believe net it is), but in doing so WILL lead to bad outcomes. Terrible crimes, unsolvable murders, large scale terrorism, emboldened enemies attacking a country, more successful coups, etc. It would be nice as a community to acknowledge nothing comes for free and every technology is a double edged sword. I wish more of these double edge swords could be debated by the public it affects, although it’s out of the scope of comprehension and thoughtfulness by most. And yet we all make the choices that will affect generations…
- gjsman-1000 3y agoYeah, that’s what the NSA has said forever - but it turns out that all encryption has that human factor. Imagine I’m planning something malicious. If I literally do anything other than talk about it, there’s going to be evidence, and that evidence won’t be encrypted. Plus, crack-proof encryption existed at least back to Roman times - simply because making a secure code was fairly easy and we didn’t have codebreakers. We managed.
- kanbara 3y agopeople commit crimes with: cars, money, public transit, restaurants, food, bathrooms, roads, … why don’t we get rid of all that? we don’t remove all rights to privacy for people in their homes because criminals use homes too. tech should be no different
- QuizzicalCarbon 3y agoThose “bad outcomes” already existed pre encryption. If anything, it’ll be more of the same.
- robjan 3y agoWidely used unbreakable encryption has been available in chat apps for at least a decade and hasn't led us down that slippery slope yet. PQ3 is just future proofing what we already have.
- sunnybeetroot 3y ago
- maqp 3y agoDid anyone figure out how MITM attacks are handled? How does the key transparency work and does it replace public key fingerprints?
- m3kw9 3y agoReplace this question with “how competent is the Apple security team”
- honzaik 3y agoThis (and Signal's solution as well) does not protect against active MITM attackers with quantum computers. They would need to incorporate post-quantum signatures into it as well. The reason why it is missing (but seemingly planned in the future) is because it is not as critical as this change. This change prevents attackers from recording conversations now and decrypting them when (in the next ?? years/decades) they get access to an actually powerful quantum computer. On the other hand, you can do MITM only after you factorized RSA key (or solved discrete log). The additional reason I presume is that this typically requires a change to the whole public key infrastructure (certificates, OCSP, etc.) which is a lot of additional work.
- maqp 3y agoI'm a bit puzzled. Suppose you do single Kyber key exchange, and you then hash the shared secret with a domain separator to get a fingerprint, wouldn't that mean you now have a shared secret that you can verify wasn't under MITM. You then can build post quantum future secrecy / key rotation on top of that, by mixing in new key material and it remains secure from MITM, as long as the internal state of the endpoint isn't compromised. The endpoint compromise is outside networked TCB threat model, as such compromise could also be used to exfiltrate long term post-quantum identity keys for undetectable MITM).
- Retr0id 3y agoKey exchange (whether it's a PQ scheme or more classical DH) does not prevent active-MITM on its own, you need authentication too.
- m3kw9 3y agoIs this country dependent?
- nan60 3y agoNo. This will be rolled out to everyone in iOS 17.4, iPadOS 17.4, macOS 14.4, and watchOS 10.4, and is already in the corresponding developer preview and beta releases[1]. [1] https://security.apple.com/blog/imessage-pq3/ https://security.apple.com/blog/imessage-pq3/
- hax0r0x01 3y ago[dead]
- damnloveless 3y ago[dead]
- RenThraysk 3y agoCan't a MITM tell when a PQC rekeying is happening due to the larger size, and just not deliver it?
- bedros 3y agoWould syncing to iCloud would compromise E2E encryption?
- nan60 3y agoFair question, and it actually depends on how iMessage is being backed up to iCloud (sorta). By default, iMessage is included in your iCloud device backup, which when Advanced Data Protection is disabled, is NOT E2E encrypted. That said, if Messages in iCloud is enabled, which instead syncs your messages to iCloud, They are always E2E encrypted, regardless of if ADP is enabled [1]. Even more confusingly, if ADP is off, the keys for Messages in iCloud are still stored in your iCloud backup [2]. So essentially, the only way to use iMessage E2E encrypted is with Advanced Data Protection enabled, regardless of if you're using Messages in iCloud or not. [1] https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651 [2] https://support.apple.com/guide/security/security-of-icloud-backup-sec2c21e7f49/1/web/1 https://support.apple.com/guide/security/security-of-icloud-...
- walterbell 3y ago> the only way to use iMessage E2E encrypted is with Advanced Data Protection enabled If iMessage backup relies on ADP encryption, will ADP move to PQ3 Cryptographic Protocol?
- dwaite 3y agoIt is data at rest which is different from the exchange of messages themselves. I believe the backups are protected via AES.
- walteweiss 3y agoThe only question that I have, will it break my old devices, so they would be forced out of the iMessages ecosystem? I believe that would happen. I don’t use it heavily, but that’s one of the reasons I keep an iPhone these days. The other reason is FaceTime support, so I could easily connect with those with iPhones. I do use not very modern iPhones (the very first SE currently), as that’s what I need my iPhones for: to make a call (via FaceTime most times) and to send a message (via iMessage, sometimes). If Apple breaks that for me, I’m either forced to buy a newer iPhone (which I’m not sure I want, considering I’m all in Linux and Android). Or they force me to rethink my priorities and just leave this. I can live with that, it’s just less convenient.