Cryptography Experts Recommend Apple Replace its iMessage Encryption

IMessage_IconApple has implemented a series of short- and long-term defenses to its iMessage protocol after several issues were discovered by a team of researchers at Johns Hopkins University, according to a report published today (via PatentlyApple).

This attack is different to the one Johns Hopkins researchers discovered in March, which allowed an attacker to decrypt photos and videos sent over iMessage.

The technical paper details how another method known as a "ciphertext attack" allowed them to retrospectively decrypt certain types of payloads and attachments when either the sender or receiver is still online.

The scenario requires that the attacker intercepts messages using stolen TLS certificates or by gaining access to Apple's servers. While the attack takes a high level of technical expertise to be successful, the researchers note that it would be well within the means of state-sponsored actors.

Overall, our determination is that while iMessage’s end-to-end encryption protocol is an improvement over systems that use encryption on network traffic only (e.g., Google Hangouts), messages sent through iMessage may not be secure against sophisticated adversaries.

The team also discovered that Apple doesn't rotate encryption keys at regular intervals, in the way that modern encryption protocols such as OTR and Signal do. This means that the same attack can be used on iMessage historical data, which is often backed up inside iCloud. In theory, law enforcement could issue a court order forcing Apple to provide access to their servers and then use the attack to decrypt the data.

The researchers believe the attack could also be used on other protocols that use the same encryption format, such as Apple's Handoff feature, which transfers data between devices via Bluetooth. OpenPGP encryption (as implemented by GnuPGP) may be vulnerable to similar attacks when used in instant messaging applications, the paper noted.

Apple was notified of the issue as early as November 2015 and patched the iMessage protocol in iOS 9.3 and OS X 10.11.4 as a result. Since that time, the company has been pushing out further mitigations recommended by the researchers through monthly updates to several of its products.

However, the team's long-term recommendation is that Apple should replace the iMessage encryption mechanism with one that eliminates weaknesses in the protocol's core distribution mechanism.

The paper detailing the security issue is called Dancing on the Lip of the Volcano: Chosen Ciphertext Attacks on Apple iMessage, and was published as part of the USENIX Security Symposium, which took place in Austin, Texas. You can read the full paper here.

Top Rated Comments

(View all)
Avatar
54 months ago

John Hopkins is a renowned medical school in Baltimore. What makes them the experts on cryptography?

It's more than just a medical school.

Jesus ****ing christ on a stick we're less than three comments in and 2/3 of them are dismissing this out of hand because it's not a 100% positive Apple story but a constructive criticism of how they can improve weaknesses in their cryptography.
Score: 40 Votes (Like | Disagree)
Avatar
54 months ago

John Hopkins is a renowned medical school in Baltimore. What makes them the experts on cryptography?

They have an Information Security Institute. Professor Matthew Green was part of the research team.

Green is part of the group which developed Zerocoin ('https://en.wikipedia.org/wiki/Zerocoin'), an anonymous cryptocurrency ('https://en.wikipedia.org/wiki/Cryptocurrency'). His research team has exposed flaws in more than one third of SSL/TLS ('https://en.wikipedia.org/wiki/Transport_Layer_Security') encrypted web sites as well as vulnerabilities in encryption technologies, including RSA BSAFE ('https://en.wikipedia.org/wiki/RSA_BSAFE'), Exxon/Mobil Speedpass ('https://en.wikipedia.org/wiki/Speedpass'), E-ZPass ('https://en.wikipedia.org/wiki/E-ZPass'), and automotive security systems. In 2015, Green was a member of the research team that identified the Logjam ('https://en.wikipedia.org/wiki/Logjam_(computer_security)') vulnerability in the TLS protocol.

Green is a member of the technical advisory board for the Linux Foundation Core Infrastructure Initiative, formed to address critical Internet security concerns in the wake of the Heartbleed ('https://en.wikipedia.org/wiki/Heartbleed') security bug disclosed in April 2014 in the OpenSSL ('https://en.wikipedia.org/wiki/OpenSSL') cryptography library.

He sits on the technical advisory boards for CipherCloud ('https://en.wikipedia.org/wiki/CipherCloud'), Overnest and Mozilla Cybersecurity Delphi. Green co-founded and serves on the Board for Directors of the Open Crypto Audit Project (OCAP), which undertook a security audit ('https://en.wikipedia.org/wiki/Security_audit') of the TrueCrypt ('https://en.wikipedia.org/wiki/TrueCrypt') software.

https://en.wikipedia.org/wiki/Matthew_D._Green
Score: 35 Votes (Like | Disagree)
Avatar
54 months ago

John Hopkins is a renowned medical school in Baltimore. What makes them the experts on cryptography?

Comments like these annoy me quite a bit (unless I'm missing some type of sarcasm). As an Apple user and someone with a background in cryptography who has actually read the entire paper, you don't need to have a MIT or Stanford paper to make a cryptanalysis. In cryptography papers are heavily peer reviewed and skepticism is part of the process the whole time. At the end of the day it boils down to mathematics and computer science and these are provable things, so it's not hypothesis. The paper includes examples of how the attacks can be carried out and under specific conditions. It explains the protocols and the exact mechanisms used to extract the payloads in their settings. All the caveats are stated. Also, it does state that Apple implemented a lot of their recommendations in later versions of iOS and OS X/macOS (their paper references iOS 9.3 and OS X 10.11.4 or later)
Score: 31 Votes (Like | Disagree)
Avatar
54 months ago

I think I read this on news.google.com.au.... sounds like a beat up to me. Next....

You have to read more than just the title before you can make an informed comment.
Score: 19 Votes (Like | Disagree)
Avatar
54 months ago

I think I read this on news.google.com.au.... sounds like a beat up to me. Next....

Doesn't sound like a beat up to me. Sounds like good advice and it seems Apple has been favorable at receiving advice in the past. Hopefully, they address the concerns for all our sakes.
Score: 13 Votes (Like | Disagree)
Avatar
54 months ago

John Hopkins is a renowned medical school in Baltimore. What makes them the experts on cryptography?

A school cannot be great at more than one field?
Score: 11 Votes (Like | Disagree)

Top Stories

Here's How You Can Download iOS 14 and iPadOS 14 Around the World [It's Out]

Wednesday September 16, 2020 2:36 am PDT by
Apple's official public release of iOS 14 and iPadOS 14 dropped on Wednesday, September 16, just a day after the company released the Golden Master to third-party developers. Also set to be made available to the general public for the first time are watchOS 7 and tvOS 14. Getting Started With iOS 14 Video Click image to watch iOS 14 Getting Started While that's left a lot of developers...

When Will the iPhone 12 Launch? Here's What We Know

Wednesday September 16, 2020 6:12 am PDT by
Yesterday's "Time Flies" Apple event saw the release of the Apple Watch Series 6, Apple Watch SE, iPad 8, and iPad Air 4, but no new iPhone models. Rumors before the event strongly alleged that it would not see the unveiling of new iPhones, with many reports pointing to an October launch. The lack of new iPhone models yesterday seems to confirm that the iPhone 12 lineup will not appear...

Apple Releases iOS 14 and iPadOS 14 With Home Screen Redesign, App Library, Compact UI, Translate App, Scribble Support, App Clips, and More

Wednesday September 16, 2020 12:48 pm PDT by
Apple has released iOS 14 and iPadOS 14, the newest operating system updates designed for the iPhone and iPad. As with all of Apple's software updates, iOS 14 and iPadOS 14 can be downloaded for free. iOS 14 is available on the iPhone 6s and later, while iPadOS 14 is available on the iPad Air 2 and later. The updates are available on all eligible devices over-the-air in the Settings app. To ...

Apple Updates AirPods 2 and AirPods Pro Firmware to Version 3A283

Monday September 14, 2020 11:24 am PDT by
Apple today released new 3A283 firmware updates for the second-generation AirPods and the AirPods Pro. The second-generation AirPods are being updated from the 2D15 firmware they were previously running, while the AirPods Pros are being updated from the 2D27 firmware they had installed previously. Apple does not provide details on what's included in refreshed firmware so we don't know what's ...

Spotify Says Apple One Bundle Will Cause 'Irreparable Harm to Developer Community'

Tuesday September 15, 2020 12:26 pm PDT by
Apple today announced Apple One, a series of new subscription bundles that provide access to various Apple services at a combined monthly price. In response, Spotify sent out statements (via Peter Kafka) to the press decrying Apple's anti-competitive behavior and calling on "competition authorities" to stop Apple before it is able to cause "irreparable harm" to developers.Once again, Apple...

iOS 14, iPadOS 14, watchOS 7, and tvOS 14 Will Be Released September 16

Tuesday September 15, 2020 11:06 am PDT by
Apple today announced that iOS 14, iPadOS 14, watchOS 7, and tvOS 14 will be officially released on Wednesday, September 16. Apple has seeded the final Golden Master beta versions of each update to developers in advance. ‌iOS 14‌ and iPadOS 14 introduce dozens of new features, including a redesigned Home Screen that supports widgets on the iPhone and iPad for the first time. For more...

New AirPods Pro Firmware Introduces Spatial Audio Support and Automatic Switching

Monday September 14, 2020 12:22 pm PDT by
The new 3A283 firmware that Apple released for the AirPods Pro today appears to introduce support for Spatial Audio, a new feature coming to the higher-end AirPods with iOS 14. Multiple reports on Twitter and the MacRumors forums indicate that the firmware update adds a "Spatial Audio" option to the Control Center, which can be activated to enable the feature. Note that using Spatial Audio...

Apple Releases Safari 14 for Mac Ahead of macOS Big Sur Launch

Wednesday September 16, 2020 1:40 pm PDT by
macOS Big Sur didn't launch alongside iOS 14, iPadOS 14, tvOS 14, and watchOS 7 today, with the update coming later this fall, but Apple did release the Safari 14 update for macOS Catalina and macOS Mojave users. Safari 14 brings improved performance, customizable start pages, a Privacy Report to see which cross-site trackers are being blocked, and a new tab bar design that provides tab...

Full Transcript of Apple's 'Time Flies' Event With Apple Watch and iPad Updates

Tuesday September 15, 2020 8:46 am PDT by
Apple's virtual "Time Flies" event kicks off today at 10:00 a.m. Pacific Time, with Apple expected to debut new Apple Watch and iPad models, but it appears we may not see the iPhone 12 until next month. While we're not expecting to see new iPhones today, Apple's software updates for its various platforms are likely nearly ready for launch, so we may be hearing more about them today. Check...

Everything Apple Announced at Today's iPad and Apple Watch Event in Just Seven Minutes

Tuesday September 15, 2020 2:19 pm PDT by
Apple today held its annual September event, but this year was a bit different because no new iPhones were announced. The "Time Flies" event focused on the Apple Watch Series 6 and the iPad Air, and saw the debut of a new Apple One services bundle. Subscribe to the MacRumors YouTube channel for more videos. It took Apple an hour to introduce the new devices, but we've recapped the event in...