Hacker News Reader

Comment by mirekrusin | Hacker News Reader

Not with the new iOS, right? There's no Apple's private key. There's only your own private key. If you loose it - you're loosing your data and nothing can help you. I think you have a choice of backing up your keychain in iCloud. If you haven't backed it up there's nothing that Apple can do to access data - except by changing security design. If you backed it up on iCloud then I don't know - maybe the whole keychain is just protected by password, in which case they could try to brute force it or something. Not feasible if your password is too long.

View on HN

Apple has a private key for signing software updates.

The FBI wants a modified iOS that will allow them to rapidly try all possible passcodes without getting locked out after N attempts.

The FBI wants legal precedent. If they truly wanted the data they could have handed the phone over to the NSA have have it hacked before the weekend.

I'm genuinely curious -- how would the NSA would crack it?

My understanding is that iOS's filesystem uses AES 256 encryption. Even if you physically removed the disk, brute force is not an option.

Essentially there are two keys used to encrypt data on an iphone - one linked to the hardware (hardcoded and unique to each iphone, cannot be erased) and one linked to the software that's stored in NAND. After N attempts the NAND is erased and the key is lost thus all the data on the device is gone (one could try to brute force using a rainbow table style attack but at this point it's a lost cause because the amount of time it would take to decrypt the device). The NSA uses the old technique of copying this NAND to a backup and restoring it every time the device gets erased. This would give them infinite attempts at cracking the passcode with as little device meddling as possible

edit Apologies forgot to mention the passcode/fingerprint is tied into the 2 key process.

Ok, right, that makes sense. That's probably doable - making iOS being able to run auto-update when locked. Once for example. Update still needs to be signed of course.

It would probably make all crooks use long passwords for keychain, but who knows, maybe it would help in some cases.

Reply on news.ycombinator.com