4 ms·
> but it still can't brute force faster than ~8 tries per second on a 5S Yes you can. You image the phone and brute force in parallel. Edit: thanks for lettin
by nodata 13y ago
> but it still can't brute force faster than ~8 tries per second on a 5S
Yes you can. You image the phone and brute force in parallel.
Edit: thanks for letting me know this information is wrong!
- zaroth 13y agoIf that works, then something is incredibly broken... The encryption key, just some random 256-bits, is protected by the rate-limited HSM, which can be unlocked by the passcode. Imaging the flash of another phone with the ciphertext is futile, because that other phone has neither the same key or passcode hash in it's HSM. A different HSM wouldn't be able to decrypt the ciphertext even given the correct passcode. The whole point of the HSM is that pulling the key or the passcode hash out of it should be quite difficult... certainly not as easy as imaging the phone!
- rdl 13y agoRight; that's the difference between Apple's hardware and (almost all) Android phones right now -- a dedicated hardware security element. Blackberry has this, too. Old Windows Phone didn't; I'm not sure if WP8 does. It was broken pre-iPad 2/iPhone 4S, though.
- oleganza 13y agoApple claims that the KDF uses salt fabricated into secure conclave in the CPU. You cannot realistically bruteforce password outside the device since you don't know high-entropy salt. So you have to type in pin code by hand and have your phone erased after N times.
- wyager 13y agoThe Apple encryption specification claims to use a combination of: A)The encryption key burned into the chip's internal HSM B)A randomly generated encryption key in effaceable storage C)The user's passcode Each passcode attempt is protected by 250,000 rounds of some key stretching function (can't remember what exactly) using the device's internal crypto acceleration hardware. To successfully parallelize an attack on an iPhone's passcode, you would have to A) get the key out of effaceable storage (can probably be done with a root 0day) and B) extract the HSM's burned-in crypto key (would require a decapping or maybe differential power analysis). And even then, you're still stuck with a few hundred thousand rounds of hashing per try, which is pretty brutal.
- brigade 13y agoA link to said spec / whitepaper (it's quite informative!): http://images.apple.com/ipad/business/docs/iOS_Security_Feb14.pdf http://images.apple.com/ipad/business/docs/iOS_Security_Feb1...
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]