Could Apple build a backdoor into it's FileVault encryption technology? Is that a risk you take of using a closed-source encryption product in general? Would using something like TrueCrypt be more reliable?
I would encourage the down-voter to express their thoughts on why the displeasure with my question.– kennyJul 29, 2012 at 18:41
I would be less worried about a backdoor than sheer weakness as an encryption scheme. This article appeared in February this year and was the first thing that came up when I typed "decrypt filevault" in google: http://reviews.cnet.com/8301-13727_7-57369983-263/filevault-2-easily-decrypted-warns-passware/
You should check out TrueCrypt, as they are evidently purely devoted to mac disk encryption. Probably any non-costly or self-made system will be reversible in the right hands, partly due to the fact that the decrpyter would be smart to assume one of those methods (free or supplied with the operating system) were used, which is essentially removing one variable in the search for the decryption key.
1What?! I didn't knew those algorithms were so bad it was possible to break a macbook in less than an hour. @rofls indeed. Jul 27, 2012 at 12:30
1Linux is excellent for servers, Windows is excellent for gaming, Mac OS is excellent for ads. Also, you mention a self-made system is not very good, but see it from the point of view that any self-made system will not have a commercial GUI application made just to crack that (and unless you're very high-profile no one will hire a top hacker to crack your laptop's encryption scheme). Jul 28, 2012 at 10:29
7Looking at the linked article they retrieved the key from memory using the firewire port (this has been a known issue with Macs for while), they didn't actually crack the Crypto on file vault. It's worth pointing out that if someone has access to the memory on your machine and you have a loaded encryption key it's possible they'll be able to retrieve it. Jul 29, 2012 at 14:33
In that article it looks like the machine would have to be powered on. At that point in time the entire disk would be decrypted. There would be no real need to extract the password, unless you want to power down the machine, when you could just copy the drive. If someone gets a machine that has entire disk encryption and it is powered on nothing is encrypted. On the other hand if the computer is off RAM will be empty or contains meaningless information. For Filevault to work you have to have the computer off. Jan 15, 2014 at 19:37
1Apple's changed how things work in OS X with the fix of CVE-2011-3215, and now the only way the Firewire attack would work is if the computer is on, logged in, and the session unlocked. Flat out removing the system's RAM while the machine is running could still be used, but such an attack would also work against TrueCrypt (and others).– KitsuneJan 15, 2014 at 21:02
The simple answer is yes - any provider of software could build a backdoor into it.
But would they? @Terry gives a good point about motivation, so my confidence would be high that they wouldn't want to add a backdoor, however you also need to be aware that governments and other pressures may force a company to add a backdoor.
So if you have sensitive data, think about additional encryption...
To answer the question, yes - it is possible that Apple could build a backdoor into its encryption system.
However, and I cannot stress this enough - there is no reason why Apple will do this. The fallout if it ever gets discovered would be enormous, probably enough to completely destroy the reputation and goodwill Apple has built up over the years.
I would not be worried about a backdoor - just the strength of the encryption. I would suggest TrueCrypt, it is simple to use and reliable.
Apple applies for 3 patents which are designed to retrieve private keys using a built-in backdoor in 2010.
Abstarct of one of patents:
The invention is a cryptographic system using chaotic dynamics. A chaotic system is used to generate a public key and an adjustable back door from a private key. The public key is distributed and can be used in a public key encryption system. The invention can also be used for authentication purposes. The adjustable back door of the invention can be used in conjunction with the public key to derive the private key. The degree of difficulty involved in deriving the private key is dependent on the adjustable back door. That is the value of the back door can be adjusted to vary the difficulty involved in deriving the private key.
More specific, this patent amongst other, claims (#5):
receiving a public key and a back door, the back door including interim conditions in an N-body chaotic system which has initial conditions, the public key being generated from the N-body chaotic system based on the initial conditions and the interim conditions; performing backward iterations on the public key, the backward iteration including applying one or more equations in a motion model to bodies in the N-body chaotic system; and generating a private key based on the public key and the backward iterations.
They have reversable cryptosystem. There is also a non-zero possibility that they use this cryptosystem in their closed-source products like FileVault, but it is hard to tell if they do really use it.