Technology Review takes a look at the evolution of security on the iPhone, noting how Apple has been able to gain acceptance in government and enterprise by overcoming its initially lax stance on device security to roll out industry-leading encryption options that can defeat essentially all attempts at accessing properly protected devices.
At the heart of Apple's security architecture is the Advanced Encryption Standard algorithm (AES), a data-scrambling system published in 1998 and adopted as a U.S. government standard in 2001. After more than a decade of exhaustive analysis, AES is widely regarded as unbreakable. The algorithm is so strong that no computer imaginable for the foreseeable future—even a quantum computer—would be able to crack a truly random 256-bit AES key. The National Security Agency has approved AES-256 for storing top-secret data.
As Apple highlights in a recent white paper (PDF) on iOS security, this hardware security involves the incorporation of a unique AES-256 key fused into each iOS device and which can not be directly read.
Access to the device's software can be restricted with a PIN passcode, and while the default passcode option for iOS is a four-digit number, users can opt to use significantly longer and more complex passcodes. And with brute-force attacks required to break iOS passcodes needing to be run on the device itself at a speed of 80 milliseconds per attempt, a device with an eight-digit passcode could take up to 15 years to compromise.
"There are a lot of issues when it comes to extracting data from iOS devices," says Amber Schroader, CEO of Paraben, a supplier of forensic software, hardware, and services for cell phones. "We have had many civil cases we have not been able to process ... for discovery because of encryption blocking us."
Most of the information included in this report is not particularly new, and Apple's white paper goes into more detail on the company's efforts to address security on iOS devices, but the report offers an overview of the layers of security Apple has built into its products.
