Apple signs your device's certificate used for secure iMessage communications. Apple can always generate a new certificate for you and provide access to its root keys to impersonate you and read subsequent messages.
While it has forward secrecy, iMessage, and indeed no PKI encryption system, is secure from a rogue root authority.
> There are certain categories of information which we do not provide to law enforcement or any other group because we choose not to retain it
Now it is up to you whether or not you take this statement at face value. But it's consistent with the other things I know about iMessage, as a person who has studied it in far more detail than your average HN reader, and so I believe it to be true.
If it is true, then Apple would be limited by technology to only provide iMessage dumps that started the date of the tap. If they did at all.
And I would be very surprised if they do at all. You obviously have to comply with a warrant to provide data if you have that data, but it becomes much more difficult, legally speaking, to compel somebody to collect information that they do not have to begin with. The CALEA was conceived to "correct" this "problem" but it only applies to "telecommunications infrastructure" organizations like ISPs, and courts have been reluctant to expand its application to actual internet services. It's something of an open secret that it was easier to simply acquire Skype for $8.5 bn and modify their technology than it was to obtain the necessary ruling under the CALEA that would compel them to modify it themselves.
Now if you are plotting revolutions, by all means, don't use iMessage. But my assessment is that the NSA threat level is lower than any other type of communication an ordinary person would be able to use, such as phone, e-mail, or even SSL.
Just as a point of comparison, DJB et al recently (2013) published a repeated plaintext attack on SSL/TLS that is viable at 2^24 TLS sessions. That sounds high enough to be safe, but if you consider the server case or the cron job case of rapidly opening SSL sessions, not so much. And attacks only get better. History suggests that the NSA is often a good ten or fifteen years ahead of the independent cryptographers, and meanwhile we are at plausible SSL attacks today.
(a) to prove identity -- a digital signature (b) to provide confidentiality -- encryption
If the secret part of an asymmetric key is generated on a device and it lives and dies on that device, Apple doesn't have it -- the device does. Messages encrypted using the public part of that key can only be decrypted with a device that has the key.
Your augment regarding PKI encryption systems is flawed. You don't need or care about a "root authority" to provide confidentiality. If your assertion is/was true, how can or does PGP work? (Hint: signing only affects identification and authenticity of a message)
But he wasn't describing a technique for decoding messages that have already been sent. He's only claiming an attack on future messages.
With control of the CA, the attacker can just advertise a bogus public key for the victim in the key server, giving him access to future messages. He can now intercept and relay.
If the protocol announces when a new key is added to the "encryption set" how can you get away with that?
(when you add a new device to iMessage all the other devices "see" the new device being added and tell you about it).
It would be great to see a comparison between OTR and iMessage.
And who writes the software on those devices that tells you about the new key again?
Based on what I'm reading, absent physical access to one of the devices authorized for using iMessage at the time, past iMessages should be safe. But, given the apparent ease of adding new authorized devices, tapping future iMessages sounds like it wouldn't be hard.