/article-new/2012/02/apple_security_icon-150x168.jpg?lossy){kind=icon}
Technology Review takes a look at the evolution of security on the iPhone, noting how Apple has been able to gain acceptance in government and enterprise by overcoming its initially lax stance on device security to roll out industry-leading encryption options that can defeat essentially all attempts at accessing properly protected devices.
At the heart of Apple's security architecture is the Advanced Encryption Standard algorithm (AES), a data-scrambling system published in 1998 and adopted as a U.S. government standard in 2001. After more than a decade of exhaustive analysis, AES is widely regarded as unbreakable. The algorithm is so strong that no computer imaginable for the foreseeable future—even a quantum computer—would be able to crack a truly random 256-bit AES key. The National Security Agency has approved AES-256 for storing top-secret data.
As Apple highlights in a recent white paper (PDF) on iOS security, this hardware security involves the incorporation of a unique AES-256 key fused into each iOS device and which can not be directly read.
Access to the device's software can be restricted with a PIN passcode, and while the default passcode option for iOS is a four-digit number, users can opt to use significantly longer and more complex passcodes. And with brute-force attacks required to break iOS passcodes needing to be run on the device itself at a speed of 80 milliseconds per attempt, a device with an eight-digit passcode could take up to 15 years to compromise.
"There are a lot of issues when it comes to extracting data from iOS devices," says Amber Schroader, CEO of Paraben, a supplier of forensic software, hardware, and services for cell phones. "We have had many civil cases we have not been able to process ... for discovery because of encryption blocking us."
Most of the information included in this report is not particularly new, and Apple's white paper goes into more detail on the company's efforts to address security on iOS devices, but the report offers an overview of the layers of security Apple has built into its products.
Top Rated Comments
(View all)So the best approach would be to hack the user instead of the device...
*Phone Rings*Hi this is Tom calling from Apple. We noticed some recent activity on your iTunes account potentially originating from your iPhone and we need your iPhone device passcode to verify whether or not these charges for $45,912 are fraudulent so we can refund your money.
...
Sure the passkey can be gotten from social engineering. However, this is not what this layer of security protects. This protects someone from accessing what is on the NAND memory if they have physical access to the device itself, but not the user (stolen/lost iPhone). This is a requirement for enterprises as they do not want their secrets to fall into the wrong hands.
As such, Blackberries were highly regarded.
Not to be picky.
"Not to be picky" is as certain the preceed pickiness as "with all due respect" is certain to forshadow an utter lack thereof.
Moreover:
(...) a device with an eight-digit passcode could take up to 15 years to compromise.
That's not true.Direct quote from Apple's white paper (http://images.apple.com/ipad/business/docs/iOS_Security_May12.pdf):
The iteration count is calibrated so that one attempt takes approximately 80 milliseconds. This means it would take more than 5½ years to try all combinations of a six-character alphanumeric passcode with lowercase letters and numbers, or 2½ years for a nine-digit passcode with numbers only.
An eight-digit passcode would "only" take 92 days to compromise. A four-digit passcode (from my experience the most popular one) would only take 13 minutes to compromise.