Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Could Apple build a backdoor into it's FileVault encryption technology? Is that a risk you take of using a closed-source encryption product in general? Would using something like TrueCrypt be more reliable?

share|improve this question
    
I would encourage the down-voter to express their thoughts on why the displeasure with my question. –  kenny Jul 29 '12 at 18:41
add comment

4 Answers

up vote 4 down vote accepted

I would be less worried about a backdoor than sheer weakness as an encryption scheme. This article appeared in February this year and was the first thing that came up when I typed "decrypt filevault" in google: http://reviews.cnet.com/8301-13727_7-57369983-263/filevault-2-easily-decrypted-warns-passware/

You should check out TrueCrypt, as they are evidently purely devoted to mac disk encryption. Probably any non-costly or self-made system will be reversible in the right hands, partly due to the fact that the decrpyter would be smart to assume one of those methods (free or supplied with the operating system) were used, which is essentially removing one variable in the search for the decryption key.

share|improve this answer
1  
What?! I didn't knew those algorithms were so bad it was possible to break a macbook in less than an hour. @rofls indeed. –  Camilo Martin Jul 27 '12 at 12:30
    
thanks @Camilo Martin, i like apple (not as much as ubuntu or even windows 7, sorry) but in tech especially there can be huge impacts from the division of labor. Edit: tagged Camilo Martin –  rofls Jul 28 '12 at 5:20
    
Linux is excellent for servers, Windows is excellent for gaming, Mac OS is excellent for ads. Also, you mention a self-made system is not very good, but see it from the point of view that any self-made system will not have a commercial GUI application made just to crack that (and unless you're very high-profile no one will hire a top hacker to crack your laptop's encryption scheme). –  Camilo Martin Jul 28 '12 at 10:29
2  
Looking at the linked article they retrieved the key from memory using the firewire port (this has been a known issue with Macs for while), they didn't actually crack the Crypto on file vault. It's worth pointing out that if someone has access to the memory on your machine and you have a loaded encryption key it's possible they'll be able to retrieve it. –  Rоry McCune Jul 29 '12 at 14:33
    
In that article it looks like the machine would have to be powered on. At that point in time the entire disk would be decrypted. There would be no real need to extract the password, unless you want to power down the machine, when you could just copy the drive. If someone gets a machine that has entire disk encryption and it is powered on nothing is encrypted. On the other hand if the computer is off RAM will be empty or contains meaningless information. For Filevault to work you have to have the computer off. –  Chris.Stover Jan 15 at 19:37
show 1 more comment

The simple answer is yes - any provider of software could build a backdoor into it.

But would they? @Terry gives a good point about motivation, so my confidence would be high that they wouldn't want to add a backdoor, however you also need to be aware that governments and other pressures may force a company to add a backdoor.

So if you have sensitive data, think about additional encryption...

share|improve this answer
add comment

To answer the question, yes - it is possible that Apple could build a backdoor into its encryption system.

However, and I cannot stress this enough - there is no reason why Apple will do this. The fallout if it ever gets discovered would be enormous, probably enough to completely destroy the reputation and goodwill Apple has built up over the years.

I would not be worried about a backdoor - just the strength of the encryption. I would suggest TrueCrypt, it is simple to use and reliable.

share|improve this answer
add comment

Apple applies for 3 patents which are designed to retrieve private keys using a built-in backdoor in 2010.

Abstarct of one of patents:

The invention is a cryptographic system using chaotic dynamics. A chaotic system is used to generate a public key and an adjustable back door from a private key. The public key is distributed and can be used in a public key encryption system. The invention can also be used for authentication purposes. The adjustable back door of the invention can be used in conjunction with the public key to derive the private key. The degree of difficulty involved in deriving the private key is dependent on the adjustable back door. That is the value of the back door can be adjusted to vary the difficulty involved in deriving the private key.

More specific, this patent amongst other, claims (#5):

receiving a public key and a back door, the back door including interim conditions in an N-body chaotic system which has initial conditions, the public key being generated from the N-body chaotic system based on the initial conditions and the interim conditions; performing backward iterations on the public key, the backward iteration including applying one or more equations in a motion model to bodies in the N-body chaotic system; and generating a private key based on the public key and the backward iterations.

They have reversable cryptosystem. There is also a non-zero possibility that they use this cryptosystem in their closed-source products like FileVault, but it is hard to tell if they do really use it.

share|improve this answer
1  
Please consider quoting parts of the article to improve your answer as links tend to become outdated. –  Simon Oct 2 '13 at 1:39
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  TildalWave Oct 2 '13 at 3:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.