6
$\begingroup$

In terms of cryptography, how secure is Apple Secure Notes? Can one store sensitive information there? The relevant section of the Apple white paper is quoted below:

The Notes app includes a Secure Notes feature that allows users to protect the contents of specific notes. Secure notes are encrypted using a user-provided passphrase that is required to view the notes on iOS, macOS, and the iCloud website.

When a user secures a note, a 16-byte key is derived from the user’s passphrase using PBKDF2 and SHA256. The note’s contents are encrypted using AES-GCM. New records are created in Core Data and CloudKit to store the encrypted note, tag, and initialization vector, and the original note records are deleted; the encrypted data isn’t written in place. Attachments are also encrypted in the same way.

When a user successfully enters the passphrase, whether to view or create a secure note, Notes opens a secure session. While open, the user isn’t required to enter the passphrase, or use Touch ID, to view or secure other notes. However, if some notes have a different passphrase, the secure session applies only to notes protected with the current passphrase. The secure session is closed when the user taps the Lock Now button in Notes, when Notes is switched to the background for more than 3 minutes, or when the device locks.

|improve this question
$\endgroup$
  • $\begingroup$ What exactly do you mean when asking How secure? – As security can be interpreted in different ways (choice of well-vetted algos, correct implementation, securing against specific adversaries, etc.), what kind of scenario are you thinking about? Or do you simply want to know if the key derivation and AES-GCM encryption they use can be regarded as “cryptographically secure at the time of writing this”? $\endgroup$ – e-sushi Oct 17 '17 at 9:17
5
$\begingroup$

From a cryptographic standpoint (ignoring implementation issues and password sniffing), the security depends primarily on the entropy $s$ in the password, and the number $n$ of iterations in PBKDF2. Work to break is about $n\,2^{s-1}$ SHA-256 (for large $n$).

Per the obligatory XKCD, a good password has like 44 bits of entropy; a bad password (among the 1000 most common) like 10 bits.

According to that source, $n$ was $10^4$ in iOS 4.x; I'll use $n=2^{16}$ (6.5 times more).

Thus the effort to break the system is like $2^{25}$ to $2^{60}$ SHA-256.

$2^{25}$ SHA-256 is very easy. $2^{60}$ is considerable, but feasible for an entity like the NSA if it decides to invest in the necessary hardware (ASICs specialized in cracking PBKDF2). As a comparison, according to this source, bitcoin miners currently hash at a rate of $10^{19}$ SHA-256d per second, where one SHA-256d is two SHA-256; that is over $2^{70}$ SHA-256 per minute.

Nowadays, if something is protected only by a password, and can be accessed on a mobile device, and the key stretching step uses PBKDF2 without the hash in hardware, and the password is of average quality, likely it could be broken. For something safer, we want scrypt or Argon2, that leverage RAM to make the investment in a password cracker much higher; or an exceptionally good password.

|improve this answer
$\endgroup$
  • $\begingroup$ Are there comparable hash rates available for scrypt and/or Argon2? $\endgroup$ – zaph Oct 17 '17 at 14:20
  • $\begingroup$ @zaph: what matters is not the hash rate, but the ratio of hash rate on the attacker's platform compared to hash rate on the legitimate user platform, for a given attacker's investment. PBKDF2 on ASICs makes that ratio much higher than possible with scrypt or Argon2. The scrypt paper has numbers. $\endgroup$ – fgrieu Oct 17 '17 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.