The US government is unable to hack iPhones that use an encryption standard they helped
create.
Oh the irony.
Hi haxors, Julian here for DNews.
Way way back in 2001, the National Institute of Standards and Technology announced their
new standard for....encryption technology.
The Advanced Encryption Standard, or AES, was the product of years of testing competing
designs with open public scrutiny and feedback.
The winner was made by belgian cryptographers Vincent Rijmen and Joan Daemen, who called
it the Rijndael (rain-dahl) Cipher.
And it is a doozy.
The goal of cryptography is to make a message so scrambled the original message can’t
be divined.
Rijndael does this by taking the data and breaking it into 128 bit chunks, a bit being
the smallest unit of data in a computer, either a 1 or a 0.
It then substitutes these bits with other bits.
It’s not as simple as a zero goes in and a 1 comes out: changing any one of the input
bits should cause an avalanche effect, changing about half the output bits.
Once the bits are swapped, they’re moved around in a process called permutation.
The substitutions and permutations are repeated, up to fourteen times at the highest AES level,
which makes analyzing the jumbled data for statistical fingerprints almost impossible.
But you may be seeing a problem here: the AES was developed in plain view of everyone,
so if you know the math behind the steps, you could just reverse any jumbling, right?
Well that’s where the key comes in.
In between each round of swapping and swirling, a key is added to the data to confound the
information further.
If you have that key and run the steps in reverse, you can decrypt the data almost instantly.
The key itself is a set of bits - and they can up to 256 bits long!
If you don’t have the key, that’s 256 ones and zeros that you’d have to guess
correctly to brute force your way in....and that would take over 1077 tries (2256 = 1.157
x 1077).
That’s 1 with 77 zeroes after it.
Security architect Mohit Arora estimates that would take 3 x 1056 years with a supercomputer.
For our purposes, let’s call that “forever.”
The AES is so successful, the government has been using it to encrypt top secret documents
since 2003.
The knowledge that JFK was actually assassinated by the roswell alien is probably guarded by
this cipher.
So it’s not a big surprise that some companies, like Apple, use the AES too.
Apple has implemented it on iphones to encrypt your photos, texts, emails, and health info.
But obviously you can’t remember a 256 bit password, so that is actually burned into
the hardware.
It’s a Unique ID for each phone, and Apple claims they don’t keep a record of the keys
and no software can read it.
When you set a passcode on your phone, it combines that with the key and your data is
protected.
So obviously guessing the 4 digit PIN is much easier than the whole key because there are
only 10,000 (104) possibilities.
Apple counters that with a 80 millisecond hardware delay, and, crucially, a software
delay too.
If you put in the wrong PIN too many times, your phone will make you wait longer and longer
before you can try again.
Get it wrong ten times, and the phone will wipe its knowledge of the key and the data
is lost forever, if that setting is turned on.
But here’s the catch: if Apple were to create and sign an “update” that disabled those
delays and automatic wipe, AND let you enter PIN attempts quickly through a computer, breaking
into a device a doddle.
And that’s exactly what the FBI is asking Apple to do.
Right now the FBI is attempting to unlock an iPhone 5C that belonged to a suspect in
the San Bernardino terrorist attack.
The FBI asked Apple to write an update that could only be applied to this particular device,
but Apple CEO Tim Cook is worried that won’t be the case.
What if the firmware update leaks?
It’s digital, so even though the FBI wants it to only be usable for this particular phone,
it’s possible it could be changed and used for more.
Newer iPhones have a piece of hardware called the Secure Enclave that would need a separate
firmware update, but anything older than a 5s would be vulnerable to this skeleton key.
If the FBI does end up getting their way, you can still protect yourself.
Longer alphanumeric passcodes will take exponentially longer to crack because of the hardware delay.
A 6 character passcode of letters and numbers could take over 5 and a half years!
Apple lets you use those instead of a 4 digit PINs… for now.
Sponsorship?
CTA video So just how powerful does producing a leading
smartphone with tough security make Apple?
Check out our sister show Test Tube here for the answer.
Tim Cook’s open letter talked about a need for discussion.
Well, you know how the encryption works, you know what’s at stake.
Go on, discuss!
There’s the comments section down there or our facebook or twitter @DNews.
Subscribe for more and I’ll see you next time, on DNews.