I was reading Apple's public letter here regarding the "backdoor" that they have been asked to create. I'm very unclear exactly what the issue is. There was no backdoor in the encryption algorithm that was actually used on the phone and it's doesn't seem as if they are being asked to create one (and sneak it onto phones) for the future. Instead it seems like they are being asked to remove a feature of their phones which deletes data if too many wrong attempts are made. A couple of questions:

  1. This seems like it has nothing to do with cryptography or with a government inserting backdoors into encryption algorithms. Therefore the consequences aren't nearly as universal as they make it sound (in their example of a "universal key"). Is this correct or incorrect?

  2. If the data is encrypted and they just want to be able to brute force the data , why do they need apple to create this piece of software? Given the resources of the FBI why can't they get the data off the phone and brute force it offline, or why can't they have their own software engineers (along with some reverse engineers) design whatever it is that apple is supposed to do?

  • $\begingroup$ Have you read this article? $\endgroup$ – mikeazo Feb 17 '16 at 19:42
  • 4
    $\begingroup$ In short, the judge told apple to make it easier to brute force the PIN. This would be done by disabling (non-cryptographic) security features and adding some additional capability (the ability to use hardware to type the PIN as opposed to a finger). So no backdoors in encryption algorithms. But, security of encryption is only as secure as security of the key. So by making the key easy to get, you are giving, in some sense, a "universal key". $\endgroup$ – mikeazo Feb 17 '16 at 19:46
  • $\begingroup$ This is more of a question for Information Security, however it can no longer be migrated and was apparently accepted here back in early 2016. I have thus locked it for historical significance. $\endgroup$ – SEJPM Nov 10 at 10:51

Apple are being asked to put a backdoor, not in the encryption algorithms (which are mathematical constructs that you can't add a backdoor to after you've designed it, and tend to be designed to be free of backdoors), but in their encryption system.

Cryptography isn't just about the basic algorithms but also how you use them. Other big topics in cryptography include protocol design (how basic algorithms are combined to design secure storage and communication systems) and key management (how you generate, distribute, store and revoke keys). The particular aspect that is at stake here is rate limitation, and it is related to key management.

Consider a 4-digit PIN. Suppose that legitimate unlocking of the phone given a PIN must take no longer than 1 second. If you try all PINs (brute force attack), that'll only take a little over 3 hours at most. To make this secure, two things are needed.

  1. The encryption key must be derived not only from the PIN, but also from some other secret component which varies from device to device. Otherwise a resourceful adversary could go through all possible 10000 PINs by trying them on multiple devices.
  2. That secret component must be physically hard to access. You can't just store it in a flash memory. It can't be encrypted. (bootstrapping problem: with what key would you encrypt it?) Recent iPhones and iPads (since the Apple A7 processor) have what Apple calls a “secure enclave” which includes a physically protected processor with some memory for that key. There aren't much details around about the secure enclave; Apple's security guide says what they're willing to say about it.
  3. The secret component must be programmed not to allow an outside entity to try all possible PINs to give out the data encryption key. It's programmed to impose a delay between attempts and lock itself out after too many failed attempts. The same technique is used on other types of devices that must resist physical attacks, such as smartcards (e.g. credit cards with a chip, as is the norm in Europe among other places).

Apple claims, and this is likely, that they cannot give FBI access to a locked phone. This implies that:

  • Their security architecture follows the idea that I described above, with a secret component in a physically protected memory (that the FBI isn't able to dump). It may not be exactly this, but something with similar properties.
  • They have not kept a copy of the secret component that's in each phone. (It's probably randomly generated when the device is first booted, and probably regenerated when the device is reset to factory settings.)
  • They have not programmed the secure enclave with a backdoor, e.g. a secret password that would make it give out either the encryption key or the secret component (from which the encryption key could be calculated for each PIN value).

Apple surely could update their software (the iOS operating system, or more precisely, in fact, I think, the software that runs in the secure enclave) to include a backdoor, e.g. a secret password that would cause the enclave to release the secrets that it stores. Their letter doesn't say so explicitly, but it implies that they could and choose not to. Of course, if such a password existed, there would be no way to limit its use to “legitimate” cases: it would be bound to leak sooner or later, and a secure enclave doesn't know whether it's getting a password from the FBI in a terrorist case, from the FBI in an unauthorized surveillance, or from the FSB, the Ministry of State Security or the Mafia.

The fact that Apple could do it in the future doesn't help for existing devices. If the device can't be started for lack of a PIN, it won't apply the firmware updates.

Note that what I described doesn't rule out the possibility of other attacks. For example, it may be possible to take out the flash memory, put in another flash memory with a different firmware image that contains an update for the secure enclave firmware, and use that to get the secure enclave to relinquish its secret component.

In summary, the answers to your questions are:

  1. What the FBI is asking for would be a backdoor in the encryption system of iDevices. It would be a universal key for iDevices.
  2. Unsoldering a flash chip is well within the FBI's resources. But there are techniques, such as the ones used in smartcards, that allow storing a small amount of data (typically hundreds of kB, I think) and make it much more difficult to extract that data even with relatively fancy equipment.
  • $\begingroup$ Note that the phone in question here is an iPhone 5C, which does not have a secure enclave. (I don't think it's true that a software update could convince the enclave to give up its secrets.) Apple is being asked to create a variant iOS that does not limit the number of faulty PIN attempts. This is technically feasible because on the 5C, the PIN policy is enforced by the iOS software/firmware, not by a hardware enclave. $\endgroup$ – Chris Peikert Feb 18 '16 at 13:23
  • $\begingroup$ @ChrisPeikert Oh, I wasn't familiar with the details of that case, thank you. In this case I wonder why FBI doesn't do offline enumeration. FBI might have trouble with a secure enclave (they could probably break it but it might cost a lot), but with ordinary flash memory, they can just make copies or use independent software. $\endgroup$ – Gilles 'SO- stop being evil' Feb 18 '16 at 14:54
  • $\begingroup$ The data encryption key is a combination of the user passcode and a key stored securely in hardware (not the secure enclave in this case, but something else). So copying the encrypted data and brute-forcing the PIN alone will not work. $\endgroup$ – Chris Peikert Feb 18 '16 at 17:07

Iphones have a chip in them that will fry the phones memory once 10 incorrect attempts are made.

This means that an attacker can only try to guess the correct password 10 times. This way even if the password used is relatively trivial there is a low probability to guess it in the first 10 tries.

What the fbi asked apple (as far as i can tell) is to disable this feature. They asked apple to remotely install a different version of the operating system on a phone they would like to attack.

This way they can try to brute force the password without worrying that the data will be lost.

As to why fbi didnt try to bypass this hardware feature themselves it is not clear. It may well be in their capabilities to perform such an action but it also may be the case that it is too expensive a process and the data are not worth it.

Also fbi probably cant remotely install software on iphones since iphone is very likely to only accept code that is signed by apple

A very interesting point to note here is that apple CAN install software on iphones without the owners consent. So they didnt refuse to install a backdoor. They just refused to let fbi use it. The backdoor is there.


Not the answer you're looking for? Browse other questions tagged or ask your own question.