Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

All iOS devices from the iPhone 3GS have a hardware encryption chip, right?

When you erase an iOS device with the "Erase All Content and Settings" menu item or via Remote Wipe the encryption keys are deleted. However, the data is still present on the device in an encrypted state.

Does this mean that forensic experts or perhaps anyone with the right tools can retrieve the data and decrypt it by other means?

Has Apple left a backdoor of some kind for law enforcement and security professionals?

As an aside there is an app called iShredder that claims to use various military grade wipe algorithms that can wipe your iOS device, but I don't see how this is possible as all iOS apps are sandboxed.

UPDATE: I know understand what iShredder does after Jonathan Garber's and Lucas Kauffman's comments.

share|improve this question
4  
"Military Grade Wiping Algorithms" is a load of bull imo. There are a few shredding algorithms out there but nulling the address space where the file recided once, should be adequate. –  Lucas Kauffman Mar 30 '13 at 16:28
    
@LucasKauffman but how can iShredder supposedly do any wiping outside of its sandbox? Has Apple given the developer special permissions or is the whole app a marketing ploy. –  joshu Mar 30 '13 at 17:11
    
It has no special permissions. The site says that files to be shredded must be deleted before running the app. Essentially all it does is generate random data to overwrite free space on the device. That's not particularly special. –  Jonathan Garber Mar 30 '13 at 17:23
    
@JonathanGarber so in other words it generates data within its own sandbox which uses whatever algorithm to make that data random and then once it has filled up the "empty space" it marks that data as deleted. –  joshu Mar 30 '13 at 17:29
2  
related: security.stackexchange.com/questions/29521/… –  Rook Mar 31 '13 at 4:39
show 3 more comments

1 Answer 1

When you do a remote whipe on your iphone, the encryption keys are deleted making the data unreadable. However, if you later find your iphone you can restore your data using mobileme to re-download the encryption keys. So the encryption keys are still stored on Apple servers.

Hence, it would make sense that law enforcement can certainly ask Apple for the encryption keys stored on their servers. Also, I am not sure what sort of encryption algorithm the iphone uses, it might not be so hard to intelligently brute force the encryption keys.

EDIT: by doing some googling, I cam across this: http://www.iosresearch.org/ and https://viaforensics.com/resources/white-papers/iphone-forensics/. However, it looks like Zdziarski method requires the hardware encryption keys to be present on the device.

share|improve this answer
1  
While it might be possible to brute-force a password on an encryption key, brute forcing a modern encryption key itself is impossible short of implementation failures or major scientific breakthroughs. –  mgjk Apr 5 '13 at 14:19
    
Are you sure that the encryption keys are stored on Apple's servers? –  joshu Apr 10 '13 at 21:11
    
Yes, because if you wipe your iPhone, and later find it, you can restore data from the mobileme website, and all that does is re-download the encryption key. –  marcwho Apr 11 '13 at 13:27
add comment

protected by Community Jan 24 at 9:20

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.