News for hackers. Stuff that matters.
Re:FBI May Demand iOS Source Code, Signing Key by bogomipz on Friday March 11, 2016 @06:03PM (#11270183)
Can someone explain how the encryption works on the iPhone? I was under the impression that the 4 digit code is just a screen lock and had nothing to do with the encryption.

Also is there a reason they can't just use this piece of hardware to brute force the phone?

https://www.intego.com/mac-security-blog/iphone-pin-pass-cod...

Re:FBI May Demand iOS Source Code, Signing Key by mikeash on Saturday March 12, 2016 @05:35PM (#11274999)
Lots of info here:

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

The short version is that your passcode (whether four digits, six digits, or a full password) is combined with an encryption key embedded in the device in a way that's supposed to be impossible to extract, and used to derive the encryption key used to protect your data.

The device you linked to relies on a vulnerability in the US, where it would report that a passcode entry failed before recording that failure to nonvolatile storage. Normally, the device starts adding more and more delays to passcode entry after a few failures. By cutting power to the device immediately after it reported failure, it bypasses those escalating delays. As your link mentions, Apple fixed this vulnerability in a subsequent OS update, so that hardware only works on older OSes. This phone's OS is too new.

Re:FBI May Demand iOS Source Code, Signing Key by bogomipz on Saturday March 12, 2016 @09:27PM (#11275845)
Thanks for the clarification. Does anyone know how Android's crypto at rest compares to iOS?