6
$\begingroup$

My understanding is, ignoring implementation details, iOS disk encryption works like this: On boot (and/or every time you unlock your phone) an ephemeral session key is created that can decrypt encrypted files.

My question is, how is it possible to create ephemeral keys, without re-encrypting the files on disk?

The only solution that comes to my mind is use the ephemeral key to decrypt the "real" key that then is used to decrypt the files. And when your session expires and you need to invalidate the ephemeral key basically you delete the encrypted copy of the real key that was encrypted by the ephemeral session key.

Are there any other solutions to this? basically to create ephemeral keys without re-encrypting the data?

Improve this question
$\endgroup$

1 Answer 1

Reset to default
5
$\begingroup$

The answer is in what Apple means by "ephemeral session key". See the BlackHat session starting around 12:00 in.

The raw file encryption keys are wrapped with a ephemeral key when outside the SEP (Secure Enclave Processor), the actual key is never exposed to the normal application processor. The ephemeral keys are bound to the boot session of the phone.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.