Re:FBI Breaks into iPhone. We Have Some Questions
by makomk on Wednesday March 30, 2016 @12:33PM
(#11390518)
That unique device-specific key provides no protection against replay attacks. So in practice, the newer Apple devices don't appear to provide any more protection against an attacker with physical access than the one that the FBI just cracked - they should be able to get everything they were demanding in their warrant without Apple's help on any iPhone.
[ Parent
| on HN ]
Re:FBI Breaks into iPhone. We Have Some Questions
by abalone on Wednesday March 30, 2016 @07:03PM
(#11393702)
Maybe I don't understand what you mean by "replay attack" in this context, but the secure enclave does in fact provide protection against brute forcing passcodes. It is detailed in Apple's security whitepaper (see p12). Basically, you have to give the passcode to the secure enclave to get the data decryption key which is derived from the device-specific key contained therein. And the enclave enforces time delays between wrong guesses.
If you can envision a procedure for hacking around this I would love to hear it.