No likey no unlocky

[BrilloPad]

DaveB answered my question - just ignore me.

[SimonMac]

They are saying they wont do what the FBI have asked them to do. Imaging the disk wont work in any case as it required the OS on the imaged disk to have access to the encryption key in combination with the PIN number being entered. The OS has to be "live" for it to work and if it's live it will erase the data after 10 failed attempts.

Other disk encryption solutions *may* be hackable through attacking the image but the way Apple has implemented it mean it's not possible.

Can't they put the imaged disk into another phone and use that to enter a PIN?

Rinse and repeat until the 10,000th guess works

(although I assume they can't else they would have tried it)

[NotAllThere]

So why can't someone take a copy of that data by copying to another drive? Then try the passcode on that.

Apologies if that is a stupid question.....

I asked the same. Then I read the links.

AIUI The pin is processed by a cpu that has a random UID hard wired into it. If the pin is correct, the cpu releases a AES key (comprising a hash of the pin and the UID) that can be used to decrypt the data. The cpu must be running for any of this to work. Hence offline attacks are out. The cpu microcode will forget the pin (or rather the hash) after ten attempts. The AES key is too strong for a brute force attack on the data to work within a reasonable time.

[DimPrawn]

So what I have learned, is, if I see someone wearing the usual Muslim attire, carrying a large bag that might contain guns or a bomb, who is holding an iPhone, it's probably best to be some place else.

[NickFitz]

So what I have learned, is, if I see someone wearing the usual Muslim attire, carrying a large bag that might contain guns or a bomb, who is holding an iPhone, it's probably best to be some place else.

The 9-11 hijackers didn't wear whatever you might think of as Muslim attire, didn't carry large bags, and didn't have iPhones. Other than that…

[NibblyPig]

As explained in the articles I linked to above, the device's data is encrypted with an AES key that is not accessible other than via the passcode, or Touch ID on hardware capable of that.

I imagine if they manage to clone the drive (or a portion of the drive) they can brute force the key because they won't need to worry about it deleting the data.

Oh wait nope, I was wrong, brute forcing would take until the heat death of the universe.

However, if they can clone the drive, they can just try every combination and reclone it back if it wipes itself (to the same device). Unless the key is stored on some internal flash memory that you can't get to, I suppose.

[DaveB]

I imagine if they manage to clone the drive (or a portion of the drive) they can brute force the key because they won't need to worry about it deleting the data.

Oh wait nope, I was wrong, brute forcing would take until the heat death of the universe.

However, if they can clone the drive, they can just try every combination and reclone it back if it wipes itself (to the same device). Unless the key is stored on some internal flash memory that you can't get to, I suppose.

Not flash memory, in a dedicated encryption CPU, with it's own hardwired access paths.

[DimPrawn]

The 9-11 hijackers didn't wear whatever you might think of as Muslim attire, didn't carry large bags, and didn't have iPhones. Other than that…

I don't think they were worried about someone hacking their phone when they "landed"

[DaveB]

I don't think they were worried about someone hacking their phone when they "landed"

So despite the fact that nothing you originally posted held true, you are still trying to stick to your grubby little racist stereotyping?

[NickFitz]

Ah, it seems this is quite an old phone (5C), so doesn't have much of the latest encryption hardware: Errata Security: Some notes on Apple decryption San Bernadino phone

So it may, just possibly, be feasible for Apple to get it to unlock with a special software update. Which explains why they're challenging the court order (which, BTW, the order itself explicitly says they can do) but haven't said it's impossible for them to comply, which would probably be the case with a more recent phone.