Is it possible for Apple or any other company to create fully encrypted smartphone?

Question

From the latest Apple vs FBI story it's known that Apple is technically capable of changing the boot-loader of the iPhone to provide interface for brute-force finding of 4-digit password.

I'm wondering, is it theoretically possible for Apple or any other software any hardware company to create a fully-encrypted smartphone. By fully-encrypted smartphone I mean that it would have the next properties:

• The device is encrypted via some key (possible implementations, but a requirement: 4-digit, x-length alphanumerical, TouchID, retinal scan, etc.
• Neither manufacturer nor FBI can decrypt data is a timely manner (100+ years with currently available hardware).
• It's not possible to change a part of it's software or hardware without data being lost.
• The chances to recover data after data wipe are negligible.

Please think of physical access to the RAM and Flash memory. No one should be able to "connect" to RAM memory while device is working and read unencrypted user data.

Also, the smartphone itself should behave just like any other modern smartphone - it should have apps downloadable from the store, software updates, etc.

Update: Let's ignore software or hardware exploits, worms, vulnerability, etc.

Answer 1

It'd be a piece of cake. All you need to do is manage the safety of the secret (i.e. the handling of the PIN) in firmware, and make it so you can't update the firmware anymore. The ability to prevent a device from accepting additional firmware uploads has been around for decades, usually under a name like a "fuse bit."

Of course, the consequences of this is that Apple becomes incapable of updating the firmware if anything goes wrong. Naturally this is unpopular, so companies elect to not do it.

There's also the exotic solution of a Key Ceremony. It's a fascinating topic to read about, but the long story short is that it ends up splitting the root key into several dozen pieces, giving each person a different piece. If each piece of software had to be signed by such a key, it would be virtually impossible to get all the keys together for a second signing.

Answer 2

In the case of apple, they can remote update software. It's like pushing an update that adds or removes any other feature. The idea would be that the phone removes the piece of code that puts a limit on the number of attempts.

If the phone is not setup for remote updates and requires some type of user interaction to install or permit updates, then the changes would no be made that way. It still may technically be possible to do something directly with hardware and memory to make changes, but that would be much more difficult and time consuming. You may not be able to decrypt, but if you can copy it you may be able to go back to that point in memory or replicate or virtualize it. There are hardware measures that can make such attacks more difficult, but theoretically, there is some physical state which could be observed and therefore copied.

If you have control over your encryption and your OS, it would be hard to make unauthorized changes without finding some other vulnerability to exploit.

Apple is not breaking encryption in this case, they would be introducing a patch to stop brute forcing.

---

Edit: Yes, it could be possible to make a phone such that when you tried to physically tamper with it, a chemical reaction could be triggered to destroy the components or that taking it apart would somehow result in a high likelihood of it being broken.

If you disable the ability to remotely change the phone, then you generally already have the requirements you are asking for in your question above. As for not changing the software, then you can't install apps or updates apps, because those are software. Remember, in most cases you don't "break encryption" you find other weaknesses or vulnerabilities.

Answer 3

Yes, it's possible, however, we should consider what is being asked of Apple and what your solution is.

Apple is being asked to alter the operating system to allow for the bruteforcing of the encryption key. In the case at hand, the key is derived from a 4 digit code. So, right now, anyone who can bruteforce this 4 digit code should (legitimately) have access to the decrypted phone.

Now, to design a phone with your properties, you suggest an encryption key giving a 4 digit code as the example. So what's to stop someone from bruteforcing this 4 digit code? You want 100+ years to decrypt/bruteforce? That would mean 10,000 attempts would have to take 200+ years (50% chance of getting it in 5,000 attempts at 100+ years). So each attempt would take 7.3 days to try to satisfy your requirements.

So, the solution is to enforce a key that cannot be bruteforced in a reasonable amount of time. Right now, you have the option of selecting an alpha-numeric passphrase for your iPhone. Just use that and neither the FBI nor Apple would be able to increase the cracking speed in a manner that would reasonably bruteforce a 10 char complex password.