When reading the iOS security doc, on page 6, it discusses the OTA update process.
The OTA process, includes sending information of current version and device ID to Apple. Inside the OTA response, Apples signs the version information and device ID. A nonce is also sent by device to tackle replay attacks.
Apple also states:
The boot-time chain-of-trust evaluation verifies that the signature comes from Apple and that the measurement of the item loaded from disk, combined with the device’s ECID, matches what was covered by the signature. These steps ensure that the authorization is for a specific device and that an old iOS version from one device can’t be copied to another. The nonce prevents an attacker from saving the server’s response and using it to tamper with a device or otherwise alter the system software.
My questions are:
1) Why is the signed device ID required to be part of OTA update ? If device contacts Apple, only Apple can sign a OTA response. Given a nonce is involved, the device could tell its for the request just sent. Then why is the signed device ID needed for personalizing the OTA update ?
2) They mention copying old iOS to different phone - do they imply via some USB interface or other ? How can this be accomplished ?