3

I know that apple provides per-file key encryption .i.e. a separate encryption key for each file exists on the apple device. The Hardware Key and the Passcode are required to generate these random keys.

But once the device is unlocked then all the files can be accessed irrespective of the file protection class which signifies that if I want to read the files from a locked device then I should be breaking the passcode rather than finding the individual keys for all files.

I want to understand what is the actual reason for creating separate encryption key for each file? As there are 4 file protection classes available in ios, is it not feasible to use a single key for all the files belonging to same protection level? With this methodology only 4 encryption keys are required.

Improve this question

2 Answers 2

Reset to default
4

File level encryption keys allow each file to be securely deleted instantly, regardless of the file’s size, simply by deleting its key.

Improve this answer
3
  • I believe that the first sentence makes sense but I have some doubt on the second part. Let's consider a situation where a two-factor-authentication is enabled by a user for his/ her apple account and the iCloud backup is turned on. In this case the backup includes the protection key of the files. And whenever a new device is setup, we only have to provide "passcode" of the current device to access the files. Therefore, I think knowing the passcode, Apple can read all the files. Kindly correct me if I am missing any crucial point.
    – Ishmeet Kaur
    Commented Jun 29, 2020 at 20:01
  • 1
    I was doing more research on the topic and have read the iOS_Security_Guide provided by apple. Following is a statement from that guide: "For all Data Protection classes except No Protection, the encrypted data is read from the device and sent to iCloud. The corresponding class keys are protected by iCloud keys."
    – Ishmeet Kaur
    Commented Jun 30, 2020 at 7:52
  • @IshmeetKaur , thanks, I have removed the incorrect information from the answer.
    – John Deters
    Commented Jun 30, 2020 at 10:35
0

There are two ways to crack encryption on iOS: By cracking the passcode, and by cracking the final 256 bit encryption - make a bit by bit copy of the drive and let the latest and greatest supercomputer crack it.

Per file encryption means that after cracking one file, your supercomputer must do the same work again for the next file. It might be that some files are crackable due to their contents; in that case this would give you extra security.

Now I don’t think cracking the 256 bit keys is feasible at all, but (1) I might be wrong, (2) it is cheap to do, and (3) it looks good in a white paper.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .