Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple's 'Unbreakable' iOS Device Encryption Highlighted

MacRumors

MacRumors

macrumors bot
Original poster
Apr 12, 2001
63,483
30,719



apple_security_icon-150x168.jpg


Technology Review takes a look at the evolution of security on the iPhone, noting how Apple has been able to gain acceptance in government and enterprise by overcoming its initially lax stance on device security to roll out industry-leading encryption options that can defeat essentially all attempts at accessing properly protected devices.
At the heart of Apple's security architecture is the Advanced Encryption Standard algorithm (AES), a data-scrambling system published in 1998 and adopted as a U.S. government standard in 2001. After more than a decade of exhaustive analysis, AES is widely regarded as unbreakable. The algorithm is so strong that no computer imaginable for the foreseeable future--even a quantum computer--would be able to crack a truly random 256-bit AES key. The National Security Agency has approved AES-256 for storing top-secret data.
Click to expand...
As Apple highlights in a recent white paper (PDF) on iOS security, this hardware security involves the incorporation of a unique AES-256 key fused into each iOS device and which can not be directly read.

Access to the device's software can be restricted with a PIN passcode, and while the default passcode option for iOS is a four-digit number, users can opt to use significantly longer and more complex passcodes. And with brute-force attacks required to break iOS passcodes needing to be run on the device itself at a speed of 80 milliseconds per attempt, a device with an eight-digit passcode could take up to 15 years to compromise.
"There are a lot of issues when it comes to extracting data from iOS devices," says Amber Schroader, CEO of Paraben, a supplier of forensic software, hardware, and services for cell phones. "We have had many civil cases we have not been able to process ... for discovery because of encryption blocking us."
Click to expand...
Most of the information included in this report is not particularly new, and Apple's white paper goes into more detail on the company's efforts to address security on iOS devices, but the report offers an overview of the layers of security Apple has built into its products.

Article Link: Apple's 'Unbreakable' iOS Device Encryption Highlighted
 
Article Link
https://www.macrumors.com/2012/08/13/apples-unbreakable-ios-device-encryption-highlighted/
C

chainprayer

macrumors 6502a
Feb 10, 2008
638
2
Will Apple phone tech support tell you your key if you give them your home address and last 4 digits of your credit card number?
 
D.T.

D.T.

macrumors G4
Sep 15, 2011
11,050
12,460
Vilano Beach, FL
Unfortunately, the backdoor for the encryption system is the last four digits of your App Store credit card ...


chainprayer said:
Will Apple phone tech support tell you your key if you give them your home address and last 4 digits of your credit card number?
Click to expand...


Hahaha, good timing :D
 
G

GQB

macrumors 65816
Sep 26, 2007
1,196
109
Not to be picky, but "a device with an eight-digit passcode could take up to 15 years to compromise" does not equal 'unbreakable'.
And the security/complexity of the lock-screen password is inversely proportional to the likelyhood that one will actually be used.
Still, good that they're using strong AES.
But passwords aren't the solution.
 
BC2009

BC2009

macrumors 68020
Jul 1, 2009
2,237
1,393
Amazing Iceman said:
So the best approach would be to hack the user instead of the device...
Click to expand...

*Phone Rings*

Hi this is Tom calling from Apple. We noticed some recent activity on your iTunes account potentially originating from your iPhone and we need your iPhone device passcode to verify whether or not these charges for $45,912 are fraudulent so we can refund your money.

...
 
G

gjwfoasfsaevg

macrumors newbie
Jun 12, 2007
25
0
So Apple is using AES. Big deal. Most systems are not cracked by breaking the encryption algorithm, but by exploiting weaknesses in key management. XBOX, PS3, Bluray, iCloud, FileVault are notable examples where the best encryption algorithm in the world wouldn't have changed anything.
 
B

BigBeast

macrumors 6502a
Mar 6, 2009
643
39
GQB said:
Not to be picky, but "a device with an eight-digit passcode could take up to 15 years to compromise" does not equal 'unbreakable'.
And the security/complexity of the lock-screen password is inversely proportional to the likelyhood that one will actually be used.
Still, good that they're using strong AES.
But passwords aren't the solution.
Click to expand...

Couldn't have said it better myself!

Yes, 256 AES is nearly impossible to crack in a timely fashion, that only addresses brute force attacks. The main weakness to encryption is humans-- through other programs installed on the systems which contain weaknesses (looking at you Adobe), not updating patches in a timely manner, phishing, and social engineering. No one needs to crack AES, they just need you, the user, to show your weakness-- a much simpler way to get what they want.

So update the grey fatty mass between your ears, and learn how to keep your 1's and 0's private. Also, hope that those who take care of your info are doing the same (looking at you Apple, Google, Microsoft, Sony, Chinese take-out receipts [credit card info], etc.)

It may just be easier to put your head between your legs and kiss your ass goodbye.
 
Last edited:
S

schmidm77

macrumors member
Jun 15, 2004
56
0
And yet Apple still can't figure out how to prevent a website from allowing the device to be jailbroken.
 
C

commander.data

macrumors 65816
Nov 10, 2006
1,057
183
KnightWRX

KnightWRX

macrumors Pentium
Jan 28, 2009
15,046
4
Quebec, Canada
Security works in layers. Implementing a layer is as important as implementing the whole. People saying this is useless are only looking at it at the layer level.

Sure the passkey can be gotten from social engineering. However, this is not what this layer of security protects. This protects someone from accessing what is on the NAND memory if they have physical access to the device itself, but not the user (stolen/lost iPhone). This is a requirement for enterprises as they do not want their secrets to fall into the wrong hands.

As such, Blackberries were highly regarded.
 
M

Mikey7c8

macrumors regular
Sep 15, 2009
185
3
Montreal, Canada
GQB said:
Not to be picky, but "a device with an eight-digit passcode could take up to 15 years to compromise" does not equal 'unbreakable'.
Click to expand...

True, but the value of the data decreases over time and depending on that data may make it economically unfeasible to do so.

GQB said:
And the security/complexity of the lock-screen password is inversely proportional to the likelyhood that one will actually be used.
Click to expand...

Very true. Mine doesn't have one - but that said, it doesn't store company/state secrets ;)
 
B

Bezetos

macrumors 6502a
May 18, 2012
739
0
far away from an Apple store
Big deal. Most smartphones use encryption.

Moreover:

MacRumors said:
(...) a device with an eight-digit passcode could take up to 15 years to compromise.
Click to expand...
That's not true.

Direct quote from Apple's white paper:
The iteration count is calibrated so that one attempt takes approximately 80 milliseconds. This means it would take more than 5½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers, or 2½ years for a nine-digit passcode with numbers only.
Click to expand...

An eight-digit passcode would "only" take 92 days to compromise. A four-digit passcode (from my experience the most popular one) would only take 13 minutes to compromise.
 
velocityg4

velocityg4

macrumors 604
Dec 19, 2004
7,329
4,717
Georgia
I thought the device goes into permanent lock down requiring it to be wiped if the wrong password is used too many times. So how could you brute force the password?

The iCloud issue is really only there if you actually are foolish enough to trust that your data is secure with cloud computing. I don't use iCloud myself so I could not see how they could reset/restore everything like that reporter had happen. If I actually stored anything of importance on my phone I'd backup to my home computer in an encrypted directory.
 
gregwyattjr

gregwyattjr

macrumors regular
Oct 17, 2008
198
1
Its nice to see Apple taking security a little more seriously. I hope their doing these sorts of things for OS X as well.
 
notabadname

notabadname

macrumors 68000
Jan 4, 2010
1,568
736
Detroit Suburbs
GQB said:
Not to be picky, but "a device with an eight-digit passcode could take up to 15 years to compromise" does not equal 'unbreakable'.
And the security/complexity of the lock-screen password is inversely proportional to the likelyhood that one will actually be used.
Still, good that they're using strong AES.
But passwords aren't the solution.
Click to expand...

To be picky, the article didn't state that the 8 digit pin was "unbreakable", only the AES-256 encryption. But even with just 8 numbers and letters, not case sensitive, you break into trillions of permutations.
 
D

dethmaShine

macrumors 68000
Apr 13, 2010
1,697
0
Into the lungs of Hell
GQB said:
Not to be picky, but "a device with an eight-digit passcode could take up to 15 years to compromise" does not equal 'unbreakable'.
And the security/complexity of the lock-screen password is inversely proportional to the likelyhood that one will actually be used.
Still, good that they're using strong AES.
But passwords aren't the solution.
Click to expand...

Eight binary digits or Eight decimal digits?

Eight decimal digits ~ 34 binary digits. => 2^34 probably keys.

So according to the rootN formula, on an average it would take approximately 2^17 trials to find the random key. This is such a small number that I maybe able to crack in a matter of days and not 15 years.

Moreover, if the encryption was so hard that a brute force attack took 15 years, I would call it 'unbreakable' as there is no perceivable way to break the encryption for a forceable future.

EDIT: I've made a stupid maths mistake, given I was posting this casually. I divided 100,000,000 by 64 recursively and was left with ~ 6 as the quotient at the very end. It was divided by 64 - 4 times. Given this was really late last night, I made the mistake of treating 64 as 2^8 whereas it was 2^6. 2^[(8*4)+2]
(+2 for 6/(2*2*) is how I got my answer. Nonetheless, it should 2^(6*4+2) = 2^26. Or simply use log_2{100000000}.

More on the rootN explanation in a future post.
 
Last edited:
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom