NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This seems to be the ideal method (FIPS140-2 Approved) for protecting user data on cell phones, as the encryption key is tied into the user password, thus decryption is only possible with user disclosing his/her password (nobody, including cell phone/cell phone OS manufacturer can decrypt user data if user does not disclose the password). Do you know of an cell phone OS (Android, iPhone OS, Symbian, other) that plans to implement this data protection mechanism?

It seems that current user data protection mechanisms implemented on iPhone iOS 4 are sub-par.


iOS 3 and 4 used PBKDF2 for internal encryption. iOS 5.0 and later provides the CommonCrypto/CommonKeyDerivation.h PBKDF2 library supporting key derivation through CCKeyDerivationPBKDF.

Android 3.0 and later uses PBKDF2 for filesystem encryption.

Windows Phone 7.1 and later provides the Data Protection API that contains PBKDF2 functionality.

Blackberry provides it also but had an issue in the past.

In September 2010, ElcomSoft announced a password cracking utility for Research In Motion BlackBerry device backups that takes advantage of what Vladimir Katalov, ElcomSoft's CEO, described as the "very strange way, to say the least" in which the BlackBerry uses PBKDF2. BlackBerries encrypts backup files with AES-256. In turn, the AES key is derived from the user's password using PBKDF2. However the BlackBerry software uses only one PBKDF2 iteration, thus not taking advantage of the key security features of PBKDF2.

  • SP800-132 suggests a minimum iteration count of 1,000, therefore if Blackberry is using anything less than the recommended value I would say that they are not in compliance with the standard.
    – Drew Lex
    Jan 9 '13 at 14:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.