7 ms·

This is actually how the protocol works, it uses the certificate burnt into the CPU; Apple claims that the private keys are known by no party including themselv

This is actually how the protocol works, it uses the certificate burnt into the CPU; Apple claims that the private keys are known by no party including themselves, probably generated by the chip fab with some some of SCEP exchange. I've been meaning to update the IMWiki page with my research, but here's the bit where you see that exchange: http://imfreedom.org/wiki/IMessage#Unknown2 http://imfreedom.org/wiki/IMessage#Unknown2 ["Apple iPhone Device CA" / "Mac OS Device Identity (Production)"]

andreyf 14y ago
> Apple claims that the private keys are known by no party including themselves Source? How can I add a new device (e.g. Messages on OSX) and get all the messages between my phone and friends?
- danielsju6 14y ago
  Private keys, not public; the messages are decryptable by anyone who's been added to the keybag, you've probably seen the pop up notifying you that another device (private keys burnt onto the chipset) is joining the keybag. Once you hit OK Apple pings you with encrypted communications from the other devices (them being the pipe and presumably not in the trust chain, this explains why sometimes it's a little iffy showing cross device messages.) The protocol hasn't been completely reverse engineered but enough to know it's likely decentralized like this, just MITM it (quite a bit is documented on the wiki I linked), Apple is the CA and the piping but it appears to be rather strong and decentralized in terms of chain-of-trust. Apple has put itself, probably without coincidence, in a position where they may not even be able to execute a court order to spy on a user. The Apple security white-papers detail their hardware level certificates, I've dealt with this a lot as a Apple MDM developer.
  - deleted 14y ago
    [deleted]
  - andreyf 14y ago
    I've seen the message notifying me that I've added a new device to the account, yes, but what does that have anything to do with the encryption? When someone sends me an iMessage, their client sends as many copies as I have devices?
    - wyager 14y ago
      >When someone sends me an iMessage, their client sends as many copies as I have devices? Generally how this works is that the sender encrypts the message with a symmetric encryption algorithm (like AES) and then encrypts the randomly-generated AES key with RSA with each of the receivers' private keys. So you only send out a single message, but it can be decrypted by any of the intended recipients.
      - andreyf 14y ago
        That makes a lot of sense. In that case, it seems the easiest way to wiretap an iMessage account would be to compromise one of the devices. Not surprising that the DEA doesn't have that kind of expertise/authority, though.
        sneak 14y ago
        Nope - all they have to do is get Apple to add another surveillance key to the list of device keys associated with your Apple ID. Then all future iMessages get encrypted to that one, too.
        sdoering 14y ago
        And apple would only have to make sure, that you get no warning, that another device was added to your keybag.
        sneak 14y ago
        They manufacture the hardware, design and produce the software, and are the intermediary between all device communication with all other devices. I have a feeling they could manage.
  - Groxx 14y ago
    Not sure I'm reading this correctly, so a quick check: When I have A, and want to add B, A ships its private key to B so it can decrypt the messages too? (and vise versa, obviously) Or does A get B's public key, and A then re-encrypts and re-sends messages it receives to B? Or is it something completely different?
    - andreyf 14y ago
      The messages don't always arrive in the same order between the devices, so it's definitely not passed from one to the other. I imagine the senders encrypt the message with every public key in your keybag. Someone who actually knows should weigh in, though. GP's understanding seems a bit murky to me.
      - Groxx 14y ago
        If that's the case though, where would this popup be appearing from? (I haven't seen it, not quite sure where it would be) I would guess they wouldn't be asking the sender to approve adding my multiple computers whenever I add one, since that would be a fairly crummy user experience. Seems like it should be something that I, the owner of the receiving devices, would approve or deny.
        andreyf 14y ago
        The popup (and e-mail) only notify you that a device has been added to your account. The approval is done by logging in with your Apple ID.
josho 14y ago
That begs the question: how does my private key securely get shared between my mac, iPhone, and iPad so that all of my devices can securely read messages delivered to me.
- danielsju6 14y ago
  The protocol appears to toss around the keybag, which causes the devices to re-sign payloads and toss them back up to Apple to pipe around—I've responded in more detail on a sibling.
wyager 14y ago
I'm trying to find more info about the certificate burnt into the CPU. Thus far, all I can find is the UID, which is an AES key burnt into the CPU and protected from cryptanalysis. However, I can't find anything about an asymmetric crypto key burnt into the CPU. Do you have any more info on that?
- glasshead969 14y ago
  http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf http://images.apple.com/ipad/business/docs/iOS_Security_May1... You can find more info here. Encryption and Data Protection section should be a good place to start.
  - wyager 14y ago
    I've already read that document. There's nothing about burned-in asymmetric crypto keys, only the burned-in symmetric AES key (the UID).

andreyf 14y ago

> Apple claims that the private keys are known by no party including themselves Source? How can I add a new device (e.g. Messages on OSX) and get all the messages between my phone and friends?

danielsju6 14y ago
Private keys, not public; the messages are decryptable by anyone who's been added to the keybag, you've probably seen the pop up notifying you that another device (private keys burnt onto the chipset) is joining the keybag. Once you hit OK Apple pings you with encrypted communications from the other devices (them being the pipe and presumably not in the trust chain, this explains why sometimes it's a little iffy showing cross device messages.) The protocol hasn't been completely reverse engineered but enough to know it's likely decentralized like this, just MITM it (quite a bit is documented on the wiki I linked), Apple is the CA and the piping but it appears to be rather strong and decentralized in terms of chain-of-trust. Apple has put itself, probably without coincidence, in a position where they may not even be able to execute a court order to spy on a user. The Apple security white-papers detail their hardware level certificates, I've dealt with this a lot as a Apple MDM developer.
- deleted 14y ago
  [deleted]
- andreyf 14y ago
  I've seen the message notifying me that I've added a new device to the account, yes, but what does that have anything to do with the encryption? When someone sends me an iMessage, their client sends as many copies as I have devices?
  - wyager 14y ago
    >When someone sends me an iMessage, their client sends as many copies as I have devices? Generally how this works is that the sender encrypts the message with a symmetric encryption algorithm (like AES) and then encrypts the randomly-generated AES key with RSA with each of the receivers' private keys. So you only send out a single message, but it can be decrypted by any of the intended recipients.
    - andreyf 14y ago
      That makes a lot of sense. In that case, it seems the easiest way to wiretap an iMessage account would be to compromise one of the devices. Not surprising that the DEA doesn't have that kind of expertise/authority, though.
      - sneak 14y ago
        Nope - all they have to do is get Apple to add another surveillance key to the list of device keys associated with your Apple ID. Then all future iMessages get encrypted to that one, too.
        sdoering 14y ago
        And apple would only have to make sure, that you get no warning, that another device was added to your keybag.
        sneak 14y ago
        They manufacture the hardware, design and produce the software, and are the intermediary between all device communication with all other devices. I have a feeling they could manage.
- Groxx 14y ago
  Not sure I'm reading this correctly, so a quick check: When I have A, and want to add B, A ships its private key to B so it can decrypt the messages too? (and vise versa, obviously) Or does A get B's public key, and A then re-encrypts and re-sends messages it receives to B? Or is it something completely different?
  - andreyf 14y ago
    The messages don't always arrive in the same order between the devices, so it's definitely not passed from one to the other. I imagine the senders encrypt the message with every public key in your keybag. Someone who actually knows should weigh in, though. GP's understanding seems a bit murky to me.
    - Groxx 14y ago
      If that's the case though, where would this popup be appearing from? (I haven't seen it, not quite sure where it would be) I would guess they wouldn't be asking the sender to approve adding my multiple computers whenever I add one, since that would be a fairly crummy user experience. Seems like it should be something that I, the owner of the receiving devices, would approve or deny.
      - andreyf 14y ago
        The popup (and e-mail) only notify you that a device has been added to your account. The approval is done by logging in with your Apple ID.

josho 14y ago

That begs the question: how does my private key securely get shared between my mac, iPhone, and iPad so that all of my devices can securely read messages delivered to me.

danielsju6 14y ago
The protocol appears to toss around the keybag, which causes the devices to re-sign payloads and toss them back up to Apple to pipe around—I've responded in more detail on a sibling.

wyager 14y ago

I'm trying to find more info about the certificate burnt into the CPU. Thus far, all I can find is the UID, which is an AES key burnt into the CPU and protected from cryptanalysis. However, I can't find anything about an asymmetric crypto key burnt into the CPU. Do you have any more info on that?

glasshead969 14y ago
http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf http://images.apple.com/ipad/business/docs/iOS_Security_May1... You can find more info here. Encryption and Data Protection section should be a good place to start.
- wyager 14y ago
  I've already read that document. There's nothing about burned-in asymmetric crypto keys, only the burned-in symmetric AES key (the UID).