How resistant is the iPhone encryption against brute-force attacks?

Question

I just read the following paragraph in an article from the New York Times about Apple encrypting iPhones by default):

Breaking the code, according to an Apple technical guide, could take “more than 5 1/2 years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers.” (Computer security experts question that figure, because Apple does not fully realize how quickly the N.S.A. supercomputers can crack codes.)

From all the advice about encryption I've hear, how important pass phrases are, six digit passwords seem far too insecure to me in this scenario. From what I understand, an attacker that has posession of the phone could try out different passwords very quickly and in parallel.

Is there any reliable estimate on how much it would take (in time and hardware) for a brute-force attack against an iPhone with the given parameters for possible passwords?

Answer 1

Apple has quite a comprehensive whitepaper on iOS security.

According to the whitepaper:

Every time a file on the data partition is created, Data Protection creates a new 256-bit key (the “per-file” key) and gives it to the hardware AES engine

Assuming an attacker had a file and nothing else then this would be quite secure.

According to wikipedia:

50 supercomputers that could check a billion billion (1018) AES keys per second (if such a device could ever be made) would, in theory, require about 3×1051 years to exhaust the 256-bit key space.

However:

The per-file key is wrapped with one of several class keys [...] The class key is protected with the hardware UID and, for some classes, the user’s passcode.

And

To obtain the actual key, an attacker would have to mount a highly sophisticated and expensive physical attack against the processor’s silicon.

So if you could extract the hardware UID you may be able to then brute force it on the passcode alone. I suspect this would be a significant challenge even for the NSA though and they're probably resort to a wrench instead.

An attacker would also have to be careful if trying any form of online (as in entering the password while the device is powered on) attack because it's possible to set a policy whereby the phone is erased after 10 failed attempts.

The "Erase all content and settings" option in Settings obliterates all the keys in Effaceable Storage, rendering all user data on the device cryptographically inaccessible.

Basically it erases the encryption key for all the files, so then you'd be back to trying to brute force a 256 bit AES key.

Overall I'd say the iPhone is pretty secure considering how difficult it is to secure a device when an attacker can physically access it. Having said that, an iPhone is basically a black box so caveat emptor. There's still the possibility for bugs and vulnerabilities (such as say a weak RNG) or back doors.

When your adversary is someone such as the NSA you also can't discount the possibility of them compelling Apple to sign compromised firmware then physically intercepting the device before it's delivered.