the problem is that the iphone is a general-purpose computer, and the only tool strong enough to control what software can run on a general-purpose computer is encryption. fortunately, apple can cryptographically sign all the code they want and check it as many times as they like -- it's still a "trusted client" problem, and that's always a losing proposition.
Not always. But I wouldn't bet money on Apple winning either.
See it's always going to be possible to execute untrusted code -- to win, all Apple has to do is make the cost of jailbreaking more expensive than it's worth for most people.
There's one really easy way to do this: custom CPUs.
Consider the following chain of trust:
1) CPU has access to secret key (S) stored in on-die ROM.
2) A first stage bootloader (1BL) is stored in the same location as S, and used as the starting point of execution.
3) 1BL performs CPU initialization. 1BL checksums a second-stage bootloader (2BL), stored elsewhere (anywhere it will fit -- probably wherever is cheapest.) If the checksum passes, execution is passed to 2BL.
4) 2BL uses S to decrypt the next link in the chain of trust (the kernel) as well as check its signature against Apple's public key. If the signature is valid, execution is passed to the kernel and the OS begins to boot. If the signature is invalid, the CPU halts.
5) At this stage the kernel is known to be trusted, and from now on, binary signatures can be enforced.
There are a couple drawbacks though:
First, there's the issue of cost. Yeah, we won't need that much space for the secret key and 1BL (which can be fairly small, as we only need to hash 2BL, not check a signature) -- but using any custom CPU is going to boost the cost of the device by quite a bit.
Second, there's the issue of writing bug free code: it's harder than it seems. The bootloaders would have to be written in assembly (ROM is expensive, remember), and thus verifying that they're free of bugs is a non-trivial challenge. Definitely doable, but still not easy.
The advantage, however, is that you've basically ensured that nobody's going to jailbreak. In order to JB, you'd have to replace the CPU, and that would be both expensive and difficult (for starters, if it's a custom chip you might not be able to get a hold of one...) Without replacing the CPU, you can't modify 1BL, and without modifying 1BL, you can't bypass the kernel verification.
The really geeky folks reading this post might realize that this is basically what MS did with the Xbox (except they didn't use a custom CPU.) As Michael Steil pointed out, had Microsoft put the secret key on a custom CPU, cost would have indeed prevented the recovery of the secret key (as well as recovery of 1BL.) Of course he was also right in pointing out that cost would be an issue for both sides.
So yeah, as long as Apple's going to use commodity CPUs, I can't really see a way to avoid people modifying the iPhone. They might eventually make it difficult to do without physical modification (which would definitely dissuade most users), but I can't see them every making it too difficult for determined hobbyists.
