Many iOS Encryption Measures 'Unused,' Say Cryptographers

iOS does not utilize built-in encryption measures as much as it could do, allowing for potentially unnecessary security vulnerabilities, according to cryptographers at Johns Hopkins University (via Wired).

iPhone 12 Security Feature

Using publicly available documentation from Apple and Google, law enforcement reports about bypassing mobile security features, and their own analysis, the cryptographers assessed the robustness of iOS and Android encryption. The research found that while encryption infrastructure on iOS "sounds really good," it is largely left unused:

"On iOS in particular, the infrastructure is in place for this hierarchical encryption that sounds really good," said Maximilian Zinkus, lead iOS researcher. "But I was definitely surprised to see then how much of it is unused."

When an iPhone boots up, all stored data is in a state of "Complete Protection," and the user must unlock the device before anything can be decrypted. While this is extremely secure, the researchers highlighted that once the device has been unlocked for the first time after a reboot, a large amount of data moves into a state Apple calls "Protected Until First User Authentication."

Since devices are rarely restarted, most data is in a state of "Protected Until First User Authentication" rather than "Complete Protection" most of the time. The advantage of this less secure state is that decryption keys are stored in quick access memory, where they can be swiftly accessed by applications.

In theory, an attacker could find and exploit certain types of security vulnerabilities in iOS to obtain encryption keys in the quick access memory, enabling them to decrypt large amounts of data from the device. It is believed that this is how many smartphone access tools work, such as those from the forensic access company Grayshift.

While it is true that attackers require a specific operating system vulnerability to access the keys, and both Apple and Google patch many of these flaws as they are noticed, it may be avoidable by hiding encryption keys more deeply.

"It just really shocked me, because I came into this project thinking that these phones are really protecting user data well," says Johns Hopkins cryptographer Matthew Green. "Now I've come out of the project thinking almost nothing is protected as much as it could be. So why do we need a backdoor for law enforcement when the protections that these phones actually offer are so bad?"

The researchers also shared their findings and a number of technical recommendations with Apple directly. A spokesperson for Apple offered a public statement in response:

"Apple devices are designed with multiple layers of security in order to protect against a wide range of potential threats, and we work constantly to add new protections for our users' data. As customers continue to increase the amount of sensitive information they store on their devices, we will continue to develop additional protections in both hardware and software to protect their data."

The spokesperson also told Wired that Apple's security work is primarily focused on protecting users from hackers, thieves, and criminals looking to steal personal information. They also noted that the types of attacks the researchers highlighted are very costly to develop, require physical access to the target device, and only work until Apple releases a patch. Apple also emphasized that its objective with iOS is to balance security and convenience.

Related Forum: iOS 14

Popular Stories

iPhone 17 Pro Blue Feature Tighter Crop

iPhone 17: What's New With the Cameras

Friday May 2, 2025 3:52 pm PDT by
We've still got months to go before the new iPhone 17 models come out, but a combination of dummy models and leaks have given us some insight into what we can expect in terms of camera changes. Apple is adding new camera features, and changing the design of the camera bump for some models. You might be skeptical of dummy models, but over the years, they've proven to be a highly accurate...
Beyond iPhone 13 Better Blue Face ID

20th-Anniversary iPhone Will Reportedly Feature an All-Screen Design

Saturday May 3, 2025 9:20 am PDT by
Apple's former design chief Jony Ive long dreamed of an iPhone with a truly all-screen design, and his wish might finally become reality in a few more years. The Information today cited multiple sources who said that at least one new iPhone model launching in 2027 will have a truly edge-to-edge display. The device's front camera and Face ID system would both be placed under the screen....
iPhone 17 Air Size Feature

iPhone 17 Air Expected to Have Battery Case Due to 'Worse' Battery Life

Saturday May 3, 2025 8:24 am PDT by
Apple's rumored iPhone 17 Air model will have "worse" battery life compared to previous iPhone models, according to a paywalled The Information report. In internal testing, Apple determined that the percentage of users who will be able to use the iPhone 17 Air for a full day without needing to recharge the device throughout the day will be between 60% and 70%, according to the report. For...
iOS 18

Apple Says iOS 18.5 Coming Soon, Here is What's New

Monday May 5, 2025 8:19 am PDT by
In its press release for the new Pride Band today, Apple said that iOS 18.5 is "upcoming," following more than a month of beta testing. We expect the iOS 18.5 Release Candidate to be released this week, and this should be the final beta version, barring any last-minute bugs or changes. The software update should then be released to the general public next week. iOS 18.5 is a relatively...
Foldable iPhone 2023 Feature Homescreen

Foldable iPhone Said to Have Two Key Advantages

Monday May 5, 2025 6:41 am PDT by
Apple plans to release its first foldable iPhone next year, according to several reporters and analysts who cover the company. In his Power On newsletter today, Bloomberg's Mark Gurman said the foldable iPhone will offer two key advantages over other foldable smartphones. First, he said the foldable iPhone will have a "nearly invisible" crease when unfolded. This means the device's...
iPhone Top Left Hole Punch Face ID Feature 2

iPhone 18 Pro Models Rumored to Feature Under-Screen Face ID With Top-Left Camera Hole

Saturday May 3, 2025 9:19 am PDT by
Apple's two-generations-away iPhone 18 Pro models will likely feature under-screen Face ID, according to The Information. The paywalled report today cited a source who said the iPhone 18 Pro and iPhone 18 Pro Max will have only a small hole in top-left corner of the screen, to accommodate the front-facing camera, with all Face ID hardware moved under the screen. With under-screen Face ID, ...
AirPods Pro 3 Mock Feature

AirPods Pro 3 Just Months Away – Here's What We Know

Tuesday April 29, 2025 1:30 am PDT by
Despite being more than two years old, Apple's AirPods Pro 2 still dominate the premium wireless‑earbud space, thanks to a potent mix of top‑tier audio, class‑leading noise cancellation, and Apple's habit of delivering major new features through software updates. With AirPods Pro 3 widely expected to arrive in 2025, prospective buyers now face a familiar dilemma: snap up the proven...
Foldable iPhone 2023 Feature Iridescent Search

Apple Plans Split iPhone Launch Strategy: Pro and Foldable in Fall 2026, Standard in Spring 2027

Saturday May 3, 2025 8:32 am PDT by
Starting in 2026, Apple plans to change the release cycle for its flagship iPhone lineup, according to The Information. Apple will release the more expensive iPhone 18 Pro models in the fall, delaying the release of the standard iPhone 18 until the spring. The shift may be because Apple plans to debut a foldable iPhone in 2026, which will join the existing iPhone lineup. The fall release...

Top Rated Comments

Joseph C Avatar
56 months ago
The biggest problem for me is that Apple planned to make iCloud backups end to end encrypted but this was thwarted.

Thus really even on Apple devices we have little privacy if we use iCloud.
Score: 28 Votes (Like | Disagree)
aid Avatar
56 months ago

I wouldn't mind sacrificing some speed when logging in/opening applications to have my phone in a state of "complete protection" when ever I lock it. I do however have no idea what impact this will have for calls, text and other notifications. But we are at a place where the iPhone is fast enough that added security shouldn't be noticed to much on new models
The problem is that enforcing the "complete protection" at all times would result in you having to enter your password every time you use your phone. Nor would the phone be able to perform background operations whilst it was locked - such as check email, accept incoming notifications etc. The impact is not about a couple millisecond delay as users start using the phone - but real changes to the user experience.

All of security it a balance between privacy and convenience; I think Apple's balance in iOS is pretty good - and appropriate for something like 99.5% of the users out there.
Score: 17 Votes (Like | Disagree)
velocityg4 Avatar
56 months ago
It would be nice if they had a USB off option. I know there is USB Restricted Mode. But that still gives an hour where the USB port may be attacked (plus loopholes to reset the timer). When we should have the option to disable all data connections to the USB port entirely. Whether or not the phone is unlocked. Only allowing charging. Heck with wireless charging now. Users should have the option to totally disable the port.


So, TL;DR, it seems that I should restart my phone every day.
Doesn't really help. As soon as you use it the vulnerability returns. You'd have to turn it off whenever you aren't using it.
Score: 12 Votes (Like | Disagree)
AngerDanger Avatar
56 months ago

Then what was the slogan all about “what’s on iPhone stays on iPhone” ? Or something like that lol
My guess is that the original was more accurate but less eloquent.



Attachment Image
Score: 11 Votes (Like | Disagree)
dvanwinkle Avatar
56 months ago

So, TL;DR, it seems that I should restart my phone every day.
You don't have to restart your phone. Hitting the power button 5 times in a row forces the phone into the Complete Protection mode as well.
Score: 7 Votes (Like | Disagree)
lkrupp Avatar
56 months ago
The last paragraph is the most important.

The spokesperson also told Wired that Apple's security work is primarily focused on protecting users from hackers, thieves, and criminals looking to steal personal information. T[I]hey also noted that the types of attacks the researchers highlighted are very costly to develop, require physical access to the target device, and only work until Apple releases a patch. [/I]Apple also emphasized that its objective with iOS is to balance security and convenience.

So all you worrywarts out there thinking Apple security is crap need to take chill pill and relax. If you had 100% security you wouldn’t be able to use your device.
Score: 7 Votes (Like | Disagree)