Case Suggests How Government May Get Around Phone Encryption

Wall Street Journal ^ | November 25, 2014 | By Danny Yadron

[Swordmaker]

The Justice Department is turning to a 225-year-old law to tackle a very modern problem: password-protected cellphones.

Prosecutors last month persuaded a federal magistrate in Manhattan to order an unnamed phone maker to provide “reasonable technical assistance” to unlock a password-protected phone that could contain evidence in a credit-card-fraud case, according to court filings. The court had approved a search warrant for the phone three weeks earlier. The phone maker, its operating system and why the government has not been able to unlock it remain under seal.

The little-noticed case could offer hints for the government’s strategy to counter new encryption features from Apple Inc. and Google Inc., say privacy advocates and people familiar with such cases say.

[trebb]

...to unlock a password-protected phone that could contain evidence in a credit-card-fraud case...

How about getting permission to arbitrarily tase or club someone into submission because, even though they are behaving now, they "could act up later"?

[proxy_user]

These technologies hash every pass phrase to 256 bits. Even if you only have a single character, it is hashed to 256 bits.

That’s why the crackers lea uses are essentially pass phrase guessers. They try hashing likely pass phrases using the hashing algorithm, rather than trying every 256 bit combination.

[kevkrom]

Thanks for explaining that.I wrote what I did because the way I read the Article it sounded as if law enforcement would get a judge to force the company to provide the necessary assistance to break the encryption.

And they can. What makes it pointless is that there's two levels of encryption involved - Apple encrypts everything it sends to/from iCloud, but the content is (generally) encrypted a second time with your passcode. So, the feds can force Apple to turn over an unencrypted form of what they see, but that's still encrypted beyond their ability to decode.

[kevkrom]

Use a pass phrase, something not found in a dictionary. Something like: 27Katz8aVoLv0425¢

How did you know my passcode?

[Swordmaker]

How did you know my passcode?

I'm just sikick that way. I looked in my kristal ball. Oh, and I knew last week you were gonna ask me that today. Here's another prophesy that is true: " For centuries to come, years will pass."

[RememberRonnie]

Prosecutors last month persuaded a federal magistrate in Manhattan to order an unnamed phone maker to provide “reasonable technical assistance” to unlock a password-protected phone that could contain evidence in a credit-card-fraud case, according to court filings.

The whole point of the new encryption arrangement rolled out by Apple (and emulated by Google) is that the company can't unlock it even if they want to. It's the same principle as those safes that the employee can't unlock until a certain time and/or without a key held by somebody who doesn't hang around the store at night -- there's just no point robbing the place because the clerk can't give you anything beyond the few bucks currently in the change drawer.