Why can't Apple decrypt your iPhone? • Hacker News Board

Re: Why can't Apple decrypt your iPhone?

#31

Post by avn2109 » Sat, Oct 04, 2014, 10:24 PM UTC

weinzierl wrote: post #13

lisper wrote: post #9

Earlier quoted context omitted.

This is the fundamental problem: unless you are rolling your own silicon, at some point you have to take some big corporation's word for it that a chip does what they say it does. This fundamental problem is the reason that nuclear launch codes are protected by a relatively low-tech solution: http://en.wikipedia.org/wiki/Gold_Codes

But if this is the case, why bother with bullet point 1. to 4. The chip is probably manufactured in China, why spend a thought about whether US law enforcement can somehow via Apple decrypt the data of my phone when the Chinese Government can do it anyways?

I fear the American government's totalitarian/police state leanings far more than I fear the PRoC.

Though the Chinese government is undoubtedly an enthusiastic squasher of political dissent, and their secret police are surely quite brutal, and I hate commies with a passion, I am hardly ever likely to have a conflict with the Chinese state.

An Unconstitutional American surveillance state is a far more immediate problem. The NSA can break down my door tomorrow after reading my politically unpalatable text messages, and there's nothing I can do to stop them. So if I had to pick someone to have the keys to my phone's backdoor, I'd pick a "hostile" foreign power any day. Though of course it would be better to have no backdoors at all :)

Re: Why can't Apple decrypt your iPhone?

#32

Post by pasta_1 » Sat, Oct 04, 2014, 10:25 PM UTC

comex wrote: post #27

> The Secure Enclave is designed to prevent exfiltration of the UID key. On earlier Apple devices this key lived in the application processor itself, and could (allegedly) be extracted if the device was jailbroken and kernel patched. Speaking as a jailbreaker, this is actually incorrect. At least as of previous revisions, the UID key lives in hardware - you can ask the hardware AES engine to encrypt or decrypt using…

Is jailbreaking becoming more difficult and would that be a sign of iOS/iPhone becoming more secure?

Re: Why can't Apple decrypt your iPhone?

#33

Post by Spearchucker » Sat, Oct 04, 2014, 10:27 PM UTC

opendais wrote: post #30

icebraining wrote: post #25

Earlier quoted context omitted.

As far as I know, it can install an app but not run it (EDIT: on Android, that is). So it shouldn't be able to do any such decryption.

The problem is the attack surface for an app on a device vs. in the wild is much, much larger and much, much less secure. Once its on your phone, it can just screenshot things if nothing else.

I wrote myself a database that I use for passwords and the like. I get around this by masking text until I tap a button, and then waiting a random number of ticks before decrypting the value and progressively unmasking the text. It takes between ½ and two seconds. The problem I've yet to solve is hiding the text. Leaving it on-screen for, say 10 seconds before re-masking and encrypting is fine for now but sometimes that's not long enough.

The other thing it does is with a tap and waiting for the same random number of ticks is to copy the value to the clipboard so that I can paste it into a browser.

Not perfect but its a version 1 at least.

Re: Why can't Apple decrypt your iPhone?

#34

Post by jsmeaton » Sat, Oct 04, 2014, 10:28 PM UTC

philip1209 wrote: post #14

> (Apple pegs such cracking attempts at 5 1/2 years for a random 6-character password consisting of lowercase letters and numbers. PINs will obviously take much less time, sometimes as little as half an hour. Choose a good passphrase!) Do not use simple pin passwords on your phone. In particular, if you use fingerprint access, there is no reason not to have a long, complex password.

Your advise is good, I'm not trying to dismiss or counter it.

> In particular, if you use fingerprint access, there is no reason not to have a long, complex password.

Very, very often my fingerprint isn't recognised properly and I have to type in my password. It has been getting better as of the last few updates, but I still need to input my password multiple times per day.

Re: Why can't Apple decrypt your iPhone?

#35

Post by rosser » Sat, Oct 04, 2014, 10:33 PM UTC

SynchrotronZ wrote: post #28

I wonder, is it in the realms of possibility for big-budget organizations like the NSA to simply read the UID from the silicon by means of physical analysis (e.g. a scanning tunneling microscope)?

It's very probably within the realms of possibility, yes.

It's very probably not within the realms of practicality just yet, however.

Re: Why can't Apple decrypt your iPhone?

#36

Post by bjornsing » Sat, Oct 04, 2014, 10:33 PM UTC

> Secure Enclave allows firmware updates -- but before doing so, the Secure Enclave will first destroy intermediate keys. Firmware updates are still possible, but if/when a firmware update is requested, you lose access to all data currently on the device.

Given that the end-user has entered the passcode it shouldn't be hard to retain the data: after upgrading the Secure Enclave firmware simply unencrypt all data using the old key and reencrypt it using the new key (derived from same passphrase but a new UID).

You can also use a "two stage" approach where the encryption key derived in hardware is only used to protect a secondary key. In this case you just reencrypt this secondary key which in turn protects the data.

Re: Why can't Apple decrypt your iPhone?

#37

Post by icebraining » Sat, Oct 04, 2014, 10:36 PM UTC

opendais wrote: post #30

icebraining wrote: post #25

Earlier quoted context omitted.

As far as I know, it can install an app but not run it (EDIT: on Android, that is). So it shouldn't be able to do any such decryption.

The problem is the attack surface for an app on a device vs. in the wild is much, much larger and much, much less secure. Once its on your phone, it can just screenshot things if nothing else.

Once its on your phone, it can just screenshot things if nothing else.

If it can't run, how can it screenshot things?

Re: Why can't Apple decrypt your iPhone?

#38

Post by vvhn » Sat, Oct 04, 2014, 10:36 PM UTC

higherpurpose wrote: post #10

Is Apple's "Secure Enclave" anything more than ARM's TrustZone? http://www.arm.com/products/processors/technologies/trustzon...

Contrary to speculation ( there are whole articles which "explain" the secure enclave to be ARM trustzone) secure enclave is documented ( only very recently) to be a _seperate_ chip inside the A7 chip running it's own L4 based microkernel. (From https://www.apple.com/privacy/docs/iOS_Security_Guide_Sept_2...)

" The Secure Enclave is a coprocessor fabricated in the Apple A7 or later A-series processor. It utilizes its own secure boot and personalized software update separate from the application processor. It provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has   been compromised.

The Secure Enclave uses encrypted memory and includes a hardware random number generator. Its microkernel is based on the L4 family, with modifications by Apple. Communication between the Secure Enclave and the application processor is isolated   to an interrupt-driven mailbox and shared memory data buffers. "

Re: Why can't Apple decrypt your iPhone?

#39

Post by scintill76 » Sat, Oct 04, 2014, 10:37 PM UTC

opendais wrote: post #30

icebraining wrote: post #25

Earlier quoted context omitted.

As far as I know, it can install an app but not run it (EDIT: on Android, that is). So it shouldn't be able to do any such decryption.

The problem is the attack surface for an app on a device vs. in the wild is much, much larger and much, much less secure. Once its on your phone, it can just screenshot things if nothing else.

Android requires root privilege and/or system-level app to take screenshots. iOS is probably similar. I don't think an app could spy like this without user enabling it (which is a valid but separate concern about how knowledgeable the average rooter/jailbreaker is.)

[0] http://android.stackexchange.com/questions/10930/why-do-we-n...

Re: Why can't Apple decrypt your iPhone?

#40

Post by click170 » Sat, Oct 04, 2014, 10:41 PM UTC

JoshTriplett wrote: post #23

Now if only it was possible to turn off remote installation of applications on both iOS and Android devices, this kind of security would actually mean something. Right now, you can do full disk encryption on an Android device (which seems likely to become hardware-assisted on future devices similar to the solution mentioned in the article). If you pick a sufficiently strong passphrase, that should keep your data secu…

On Android devices at least, you can use the always-on VPN functionality and a VPN Server and HTTP/S proxy to achieve this, it's actually not as hard as you might think.

For home users, Sophos has a Home Edition of their UTM that you can install on an old PC. The requirements are a bit high, there's an IP limit (that you could always overcome with a NAT) and it doesn't allow dual-homed ISPs, but the UI is better than anything else I've tried (not saying there aren't plenty of warts). Once installed, you can setup a VPN and HTTPS proxy within literally 2 minutes.

Disclaimer, I worked there for a short time.