7

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second. But for an iphone (let's say iOS9 if it matters), it is said that it would take years to do so. Of course there is the time-lock that restricts password attempts after a few failures. But I think there should be a way, by using an external device, to copy the encrypted iphone's data(the combination of 0s and 1s in the entire hardware) to bypass such 'software' restrictons. Would it still be tough to crack the data? If so why is it so much harder than cracking a 6-digit numeric passworded zip-file?

5
  • 14
    Why do you think there is a way to copy the encrypted iphone's data? This doesn't match your question headline at all.
    – Rory Alsop
    Jan 19, 2016 at 16:58
  • 5
    The answer to your question is here blog.cryptographyengineering.com/2014/10/… Jan 19, 2016 at 17:00
  • Assuming it takes half a second for an iPhone to unlock the device, and assuming a desktop CPU is 5 times as powerful as an iPhone CPU, and assuming you could copy the data off the device, you should be able to brute-force it in less than 28 hours with one CPU (or half an hour with 56 CPUs). Whoever said it would take a year was probably relying on the time lock - it'll take a year if each attempt takes you 30 seconds.
    – user253751
    Jan 20, 2016 at 9:20
  • (The above does not hold if there's a device-specific key you can't access, since that key is part of the data you need to copy off the device)
    – user253751
    Jan 20, 2016 at 9:27
  • ZIP file (along with unzip utility) is a purely software solution, so it cannot hide anything from you or prevent you from doing something computationally feasible. Hardware can do both. Jan 20, 2016 at 10:32

3 Answers 3

21

Having only 1,000,000 possible combinations, an encrypted zip-file with a 6-digit numeric password, could be brute force cracked within a second.

This depends on the hashing or encryption algorithm, and the hardware as well.

But for an iphone (let's say iOS9 if it matters), it is said that it would take years to do so.

Again, this depends on the hardware and algorithms used, and whether it's a hash, or if it's encryption.

Of course there is the time-lock that restricts password attempts after a few failures.

You are trying to compare breaking the password on an offline zip file, whose brute force protections (if they even exist) can be circumvented by simply writing your own unzip utility, to the breaking of a password on an iPhone's lock screen which stops you after 10 incorrect attempts. The two are entirely different concepts and problems, but they do seem somewhat similar, I'll give you that.

But I think there should be a way, by using an external device, to copy the encrypted iphone's data(the combination of 0s and 1s in the entire hardware) to bypass such 'software' restrictons.

Regarding the last part, please read Rory McCune's link.

Is there any hope to crack "impossible" encryption?

While some news articles are reporting that it's impossible to break the encryption of the iPhone, and "even the NSA can't do it," I'd take it with a grain of salt as this is a red herring.

Who cares about your Dr. Dalek AESontaren 256 billion bit Racnoss Encryption if you can exploit a vulnerability in the iPhone itself? Let's say in the example of a malicious application.

Instead of unlocking the heavily-fortified front door that's capable of withstanding tremendous punishment, what if you could just break the window and climb in? A vulnerability that allows you to run malicious code, which in turn allows you to view the actions of a user in real-time, and access the contents of their device, is the new frontier. If you can compromise any device, either Point A, or Point B, then encryption becomes a moot point.

13
  • 1
    Can you rephrase that, please? I am unclear on what you mean. Jan 19, 2016 at 18:17
  • 24
    I am a firefighter turned programmer and we used to call this the $10,000 padlock on a $10 chain principle. There is no need to waste the time trying to break a "perfect" pad lock if some other part of the security is easily breakable. Jan 19, 2016 at 19:19
  • 3
    @Allen - if you were to do a completely naive attack on the memory, presumably after it is taken off the phone, then the answer is yes. To do that you'd need to try every possible 6-digit numeric password with every possible device ID. That is, of course, ludicrous and not worth attempting. Jan 20, 2016 at 3:45
  • 3
    Obligatory xkcd reference: xkcd.com/538
    – justhalf
    Jan 20, 2016 at 10:10
  • 1
    @Insane No, the concept is somewhat similar. He wants to crack a password in each case... it's just that it requires different approaches. You could technically take almost the same approach if the iPhone didn't have the protections it did. Unintentional funny? :P Jan 20, 2016 at 11:21
7

Hardware

In a classic approach, you can have the data encrypted by a long and secure random key that is not vulnerable to any brute force attacks, and have that long key stored within a secure chip that will disclose (or apply) that key only when presented with a PIN code under certain conditions that include a rate-limiting of how frequently PINs can be attempted and destroy the key upon a certain number of attempts.

If properly implemented, such chips are secure from any non-destructive attacks; often the data might be read by disassembling/destroying the chip and analysing its contents with an electron microscope but that is a rather tricky, costly, slow and non-scalable manual process that's also not guaranteed to succeed.

1
  • +1 this is the answer. "...But I think there should be a way, by using an external device, to copy the encrypted iphone's data..." is where the real trick lies. Apple has made it very difficult to copy said encrypted data. Certainly not physically impossible, but the industry has a lot of practice making it hard to get access to sensitive keys on chips (I don't know what the iPhone does, but it's common for smart cards to have a layer of aluminum just over the chip, so that any attempt to mill down to the chip to look at its surface could set fire to the aluminum, damaging the chip)
    – Cort Ammon
    Jan 19, 2016 at 23:39
5

There are various "tricks" to make decryption of an iPhone harder.

One is that part of the decryption key is stored in the CPU of the iPhone, different for every iPhone, and not accessible by anyone, including Apple. That means if you remove the flash drive from the phone and connect it to the worlds fastest supercomputer, that supercomputer has to crack 256 bit encryption, because guessing the passcode doesn't work anymore. And cracking 256 bit encryption is just not possible.

The other is that Apple deliberately makes the act of checking a password slow. Your passcode will be re-hashed repeatedly. And by repeatedly, I mean millions of times. The actual number depends on the phone; it is calibrated so that checking a passcode will always take about 1/10th of a second. That's fast enough not to affect the user, but checking a million passcodes will take 100,000 seconds or a bit over a day.

That's assuming that you can actually run code on the iPhone that checks a million passcodes, which you can't, because only code signed by Apple gets access to the hardware that is needed for checking a passcode. Basically, only the software that runs when you tap in your passcode.

1
  • Could you access the phone via bruteforce if you jailbroke the phone or if it was already jailbroken? Apr 8, 2017 at 18:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .