Johns Hopkins researchers poke a hole in Apple’s encryption

The Washington Post ^ | March 21 at 12:01 AM | By Ellen Nakashima

[Swordmaker]

It boils down to it’s all software. Software sends the signals to wipe the system. Replace a few bytes in memory and that won’t happen anymore. It might write ‘Hello Bob’ on the screen instead.

That's not how it works, Okie. This all happens inside either the Secure Element or inside the Encryption Engine. If the passcode doesn't match for the tenth time, the one-way hash for comparison in side either one of those locations is simply erased. The system will never be able to pass the test to unlock the phone again. . . or build the 256 bit AES Key again. Without that key, it's a done deal. The only way to get at the data again is to brute force the data AES key. You are talking MORE than Cosmological time frames there.

[Swordmaker]

Somewhere on a memory chip a ‘key’ is stored to unlock the data. If that can be accessed outside the iPhone...........................

No, Red Badger, there isn't any key "stored to unlock the data". That is what Apple has accomplished here. The key is simply NOT stored on the iPhone. Apple stores a one-way HASH of the passcode that will unlock the data. To unlock the iPhone, the user must input the original passcode which the same hidden algorithm will re-calculate that one-way hash, compare it to the stored hash. If the two hashes match, then the iPhone will be unlocked. . . and the passcode is then used as one of FOUR parts of the 256 bit AES key used to decrypt the data. Without it and the other three parts, which are stored in an inaccessible location in the Encryption Engine, unreadable from RAM or by the A6's data processor, the key cannot be reconstructed.

[Swordmaker]

Just another nibble. I was shocked and overwhelmed by their new 4 inch phone. I’d never heard of a 4 inch phone until I looked into my pocket.

Apple's been selling a 4" iPhone since the iPhone 5 came out in 2012. Apple sold 30 million 4" iPhone 5S models last year alone. What do you think your snark is trying to say? Nice try, Okie. No Banana.

[Swordmaker]

No, it was their intent to resist assisting in cracking a terrorist's phone even if ordered by a court to do so. They act like they are above it all.

Their huge egos and self righteousness makes them look like they see themselves superior to the potential good of the rest of us.

Apple resisted an illegal court order that had no basis in law. A New York Magistrate Judge, in a case exactly similar to this one, although not so heinous, ruled that the All Writs Act can not be used the way the FBI and DOJ was trying to use it. He ruled it was UCONSTITUTIONALLY trying to usurp the legislative power to change an EXISTING LAW. . . 1994's Communications Assistance for Law Enforcement Act, which specifically states that Law Enforcement CANNOT require companies such as Apple to do what the FBI was trying to get Apple to do. It explicitly STATES THAT IN FEDERAL LAW.

The FBI cannot use a court to get an order to do something it is PROHIBITED by law from doing. Nor can a court use the All Writs Act to do something that Congress has addressed. It can only be used when Congress has NOT addressed something. It cannot be used if Congress addressed an issue and even declined to Act, because declining to do something is an ACT, and the Courts cannot substitute their decisions for the Legislative using the All Writs Act. In this case, not only did Congress address the issue, it acted! That prohibits the courts from using the All Writs Act from being used to re-write what Congress chose to do about encryption!

Apple is choosing to protect the privacy of the users of over one BILLION iOS devices, many of whom are relying on those devices to keep their safety and identities secure, as well as their finances and even state secrets secure. Included in the users of those devices are GOVERNMENTS, including ours, who pressured Apple into increasing the encryption on iOS devices so they could be securely used by OUR government agencies, OUR businesses who needed a mobile device that was secure enough to protect OUR ENTERPRISE secrets from prying eyes of foreign nationals seeking to steal intellectual properties and data. . . which is all too often happening. . . and you, ignoramus that you are, ignorantly claim it is ALL about terrorist stuff that may be on a stupid WORK phone that the FBI already knows AND ADMITS only has work calls, work messages, and work emails from the complete data they got from Verizon!

Sorry, you are just plain wrong.

[Red Badger]

Wow. It seems unbreakable, but not impossible.

... a purely random number that came from a purely entropic input from four sensors (camera, microphone, accelerometer, and one other Apple doesn't list)

I once read of a random number generator that relied upon a semiconductor noise generating diode that supplied the number as a random digit from the voltage measured across that diode. Say the third digit of 1.35681V one time then the 2nd digit of 1.46329 another, the 5th digit another time, etc.....................

[Red Badger]

Israeli firm helping FBI to open encrypted iPhone: report

http://www.reuters.com/article/us-apple-encryption-cellebrite-idUSKCN0WP17J

[Scutter]

Not surprising. All software has bugs, sometimes bugs lead to security holes. Glad these guys found it and notified Apple so it can be fixed.