# Should Apple help the government hack into encrypted devices? **URL:** \ **Category:** Great Debates\ **Created:** [February 17, 2016, 1:20pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333 "2016-02-17T13:20:10Z")\ **Posts on this page:** 20\ **Page:** 20
**Author:** ![treis](https://avatars.discourse-cdn.com/v4/letter/t/bc79bd/32.png) [@treis](https://boards.straightdope.com/u/treis)\ **Post date:** [February 20, 2016, 7:45pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/381 "2016-02-20T19:45:35Z")
> [@Merneith](#): > > Plot Twist: > [Apple: We tried to help FBI terror probe, but someone changed iCloud password | Ars Technica](http://arstechnica.com/tech-policy/2016/02/apple-we-tried-to-help-fbi-terror-probe-but-someone-changed-icloud-password/) > > So it turns out that, at some point while the phone was in FBI posession, _someone_ who works for the FBI changed the password to its current supposedly unknown iteration. > > That means either > > 1. Some at the FBI changed it the password so that it would be safe from any of Sayed’s evildoer friends and _then forgot to write down the new one_ > > 2. Someone at the FBI changed the password in order to make a big production and force Apple to make them a backdoor > I would guess the odds are about 50-50. > Anyway, if it’s true that the FBI implemented the current password, does that change the case for forcing Apple’s assistance in fixing it? I don’t see having access to iCloud changes anything. There’s a lot of stuff not backed up to iCloud that the FBI wants. > [@Scylla](#): > > No. It’s not. Brute force is starting with a combination like “00000”. Than trying “0000001” etc. knowing the algorithm, the input values and the output values, one can graph a distribution of the results of key values run through the algorithm against the known data, and exclude whole groups of keys which could not possibly provide the output value. Next you run samples to create a distribution of the remaining values, and use that to try to exclude more groups, and then keep narrowing it down. AES is not vulnerable to this type of attack. If you have a method that eliminates any keys (as in even going from 2^128 to 2^127 possible keys) write it up in a paper. It would be the biggest paper of the decade in cryptography and the start of a extraordinarily lucrative career. ---
**Author:** ![UberArchetype](https://avatars.discourse-cdn.com/v4/letter/u/2bfe46/32.png) [@UberArchetype](https://boards.straightdope.com/u/UberArchetype)\ **Post date:** [February 20, 2016, 7:58pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/382 "2016-02-20T19:58:46Z")
Doesn’t anyone find it curious how one guy’s phone becomes the precursor to economic collapse, Internet-wide privacy forfeiture and the collapse of worldwide security? ---
**Author:** ![doubleminus](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@doubleminus](https://boards.straightdope.com/u/doubleminus)\ **Post date:** [February 20, 2016, 9:56pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/383 "2016-02-20T21:56:13Z")
> [@UberArchetype](#): > > Doesn’t anyone find it curious how one guy’s phone becomes the precursor to economic collapse, Internet-wide privacy forfeiture and the collapse of worldwide security? There are sometimes inflection points. Shooting Franz Ferdinand was one. Miss Roe getting pregnant was another. ---
**Author:** ![doubleminus](https://avatars.discourse-cdn.com/v4/letter/d/5daacb/32.png) [@doubleminus](https://boards.straightdope.com/u/doubleminus)\ **Post date:** [February 20, 2016, 10:20pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/384 "2016-02-20T22:20:27Z")
> [@Ravenman](#): > > Then I don’t know why you’re arguing with me about it. Because we both agree that Apple left a hole in their security for this device - I’m calling it a backdoor, I guess you’re calling it “a possibility for an exploit.” Tomato, tomato. It’s not a big disagreement, but one nevertheless. A backdoor implies intent. As an example: Apple would include _two_ public keys in the download code, each one permitting a correctly signed code to be loaded. One of the keys would be prepared by the FBI, and they would hold the corresponding private key. It is most probable that such an arrangement will be discovered by hackers (although it would not be exploitable) and Apple might need to explain that away. The other tomato is just a bug. Specifically, in this case it is a conceptual bug. I guess that Apple did not believe to be forced to sign a hack. By the way, a perfectly legal way FBI has, is to subpoena the private key Apple is using and the source code of the software. This is available on the shelf information, but even the FBI do not have the _cojones_ to ask for it. Regarding the cite you asked for: Please read [this NY Times article](http://www.nytimes.com/2016/02/19/technology/how-tim-cook-became-a-bulwark-for-digital-privacy.html). It contains a wealth of information: > [@](#): > > After December’s San Bernardino attack, Apple worked with the F.B.I. to gather data that had been backed up to the cloud from a work iPhone issued to one of the assailants, according to court filings. When investigators also wanted unspecified information on the phone that had not been backed up, the judge this week granted the order requiring Apple to create a special tool to help investigators more easily crack the phone’s passcode and get into the device. > > Apple had asked the F.B.I. to issue its application for the tool under seal. But the government made it public, prompting Mr. Cook to go into bunker mode to draft a response, according to people privy to the discussions, who spoke on condition of anonymity. The result was the letter that Mr. Cook signed on Tuesday, where he argued that it set a “dangerous precedent” for a company to be forced to build tools for the government that weaken security. ---
**Author:** ![Grumman](https://avatars.discourse-cdn.com/v4/letter/g/43a26b/32.png) [@Grumman](https://boards.straightdope.com/u/Grumman)\ **Post date:** [February 20, 2016, 11:20pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/385 "2016-02-20T23:20:06Z")
> [@UberArchetype](#): > > Doesn’t anyone find it curious how one guy’s phone becomes the precursor to economic collapse, Internet-wide privacy forfeiture and the collapse of worldwide security? If these morons didn’t use one guy’s phone as an excuse for _every_ corrupt government everywhere to have the tools to sabotage _every_ phone, we wouldn’t be talking about this. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [February 20, 2016, 11:50pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/386 "2016-02-20T23:50:29Z")
Let’s get real. You think corrupt governments are just waiting for the FBI to do something first so they can get away with the same thing? Get real. The Chinese government sends people to work camps for criminal without a trial. I laugh if you’re going to posit that they wouldn’t dare conduct searches that are a million kinds of illegal here. **doubleminus** , thanks for the cite. I’ll read that tonight. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 21, 2016, 1:42am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/387 "2016-02-21T01:42:09Z")
> [@Crazyhorse](#): > > The order says Apple must disable the auto-erase feature “whether or not it is enabled” when it could just as easily say “if it is enabled”. Obviously Apple could determine if it is enabled, and if not they might be perfectly willing to tell the government that it isn’t, and they can feel free to brute force crack it. How, specifically? ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 1:56am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/388 "2016-02-21T01:56:05Z")
> [@treis](#): > > AES is not vulnerable to this type of attack. If you have a method that eliminates any keys (as in even going from 2^128 to 2^127 possible keys) write it up in a paper. It would be the biggest paper of the decade in cryptography and the start of a extraordinarily lucrative career. The power of deduction tells me you didn’t click my link. ---
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [February 21, 2016, 2:28am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/389 "2016-02-21T02:28:50Z")
> [@Bricker](#): > > How, specifically? The order is to create a new OS for the iPhone that bypasses these security measures. There is no question that they could do so. In the same vein they could also create software that tells them if the currently installed OS has the auto-erase feature enabled. I’m not a software engineer so I can’t really say how specifically, but it is 100% guaranteed that they can do this. You’re not a software engineer either but I would be curious why you think that they couldn’t. This order comes on the heels of many other attempts to force Apple to create a backdoor to the iPhone. Apple is a business, not a privacy activist. If it was in their best interest as a business they would comply. Clearly it isn’t, and they won’t. It will be interesting to see how this all unfolds, but as written the order is obviously an attempt to open the door to create a backdoor to the iOS. The precendent set if they did would open the door to countless other investigations that demand the same action. ---
**Author:** ![CurtC](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@CurtC](https://boards.straightdope.com/u/CurtC)\ **Post date:** [February 21, 2016, 5:19am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/390 "2016-02-21T05:19:09Z")
> [@Scylla](#): > > No. It’s not. Brute force is starting with a combination like “00000”. Than trying “0000001” etc. knowing the algorithm, the input values and the output values, one can graph a distribution of the results of key values run through the algorithm against the known data, and exclude whole groups of keys which could not possibly provide the output value. Next you run samples to create a distribution of the remaining values, and use that to try to exclude more groups, and then keep narrowing it down. Scylla, you’re just flat wrong here. If you do a distribution of input values and output values like you’re suggesting, _that takes billions and billions of years!_ There are two to the 256 power different keys to try out! How do you think they could do a distribution of the outputs of each of these keys, when there are almost as many keys as there are subatomic particles in the universe? > [@Scylla](#): > > Here’s a brief explanation of the technique I described. > > [https://www.quora.com/Was-AES-256-cracked-or-not](https://www.quora.com/Was-AES-256-cracked-or-not) That says nothing like what you’ve described. I think at this point you just need to admit that you know nothing about cryptography and stick to your conspiracy theory ideas about how we know they’ve cracked it is that they say they haven’t. ---
**Author:** ![The\_Niply\_Elder](https://avatars.discourse-cdn.com/v4/letter/t/8e8cbc/32.png) [@The\_Niply\_Elder](https://boards.straightdope.com/u/The_Niply_Elder)\ **Post date:** [February 21, 2016, 10:45am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/391 "2016-02-21T10:45:17Z")
> [@Crazyhorse](#): > > The order is to create a new OS for the iPhone that bypasses these security measures. There is no question that they could do so. In the same vein they could also create software that tells them if the currently installed OS has the auto-erase feature enabled. I’m not a software engineer so I can’t really say how specifically, but it is 100% guaranteed that they can do this. You’re not a software engineer either but I would be curious why you think that they couldn’t. I’m not a software engineer either, but I think the answer is they can’t since the phone is encrypted and by definition there is no plain data like that to be extracted. ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 1:12pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/392 "2016-02-21T13:12:04Z")
> [@CurtC](#): > > Scylla, you’re just flat wrong here. If you do a distribution of input values and output values like you’re suggesting, _that takes billions and billions of years!_ There are two to the 256 power different keys to try out! How do you think they could do a distribution of the outputs of each of these keys, when there are almost as many keys as there are subatomic particles in the universe? “A distribution of key values” which is what I said does not equal “a distribution of all key values” > [@](#): > > That says nothing like what you’ve described. Or you’re not getting it. > [@](#): > > I think at this point you just need to admit that you know nothing about cryptography and stick to your conspiracy theory ideas about how we know they’ve cracked it is that they say they haven’t. Your not providing any information or arguments. “No it’s not.” Is not valid debate. ---
**Author:** ![UberArchetype](https://avatars.discourse-cdn.com/v4/letter/u/2bfe46/32.png) [@UberArchetype](https://boards.straightdope.com/u/UberArchetype)\ **Post date:** [February 21, 2016, 3:54pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/393 "2016-02-21T15:54:48Z")
Nothing like free publicity. But it’s risky. Next thing you know every dead terrorist will turn up with an iPhone in their pocket. ---
**Author:** ![CurtC](https://avatars.discourse-cdn.com/v4/letter/c/ce73a5/32.png) [@CurtC](https://boards.straightdope.com/u/CurtC)\ **Post date:** [February 21, 2016, 8:37pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/394 "2016-02-21T20:37:10Z")
> [@](#): > > Your not providing any information or arguments. “No it’s not.” Is not valid debate. Fair enough… > [@Scylla](#): > > “A distribution of key values” which is what I said does not equal “a distribution of all key values” But which ones do you do? There are 10^77 possibilities, and it does you no good to look at just a trillion of them. If one of those trillion isn’t it, then you’re no closer to figuring out which one IS it. ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 9:48pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/395 "2016-02-21T21:48:15Z")
> [@CurtC](#): > > But which ones do you do? There are 10^77 possibilities, and it does you no good to look at just a trillion of them. If one of those trillion isn’t it, then you’re no closer to figuring out which one IS it. let’s say we are encrypting the number “13.” Our encoding method will be to have a two number key using the numbers 1 - 100, the algorithm will be to multiply our input by the first number in the key and then add the second number. (I know, it’s a devastatingly complex and diabolical encryption method, but bear with me, this only a conceptual example) Now let’s say the output is “85.” Now even though we don’t know what the key is, we know certain things about the key. We know that the first number in the key can’t be greater than 6 since anything more than that would produce a Number higher than our output. Right off the bat we’ve eliminated 9400 of 10,000 possible combinations. We also know that the second number must be small enough to possibly give us our output, so if we are testing 6 as the first number of the key, the only possible combinations would be the numbers 1-7, we can exclude 8-100. We can do the same for the remaining possibilities for the first number of the key, and now we’ve reduced the possible keys from 10,000 to about 100 (I haven’t bothered to work it out exactly.). That’s about a 99% reduction in possible keys to test. The AES code is of course just slightly more complex than this, but knowing the formula used and knowing what unencrypted output looks like necessarily tells us something about what the keys must be. * * * So let’s say for the sake of argument that the above appears somewhat reasonable to you. You say “Very impressive Scylla! Congratulations, by applying your method you have now reduced the time needed to crack the code from 100 billion years, to only 1 billion years! We better get started on this right away.” That’s a good point except for the fact that the more complex the algorithm and keys used the greater the constraint upon the output, and the more unencrypted data you have to work with the more you able to eliminate keys. Going back to my example let’s say that the next piece of unencrypted data is “5.” And the output is “37.” We can now reduce the remaining keys again, and I believe that’s enough to solve it and guess the keys right there. Do you see the concept? ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 10:00pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/396 "2016-02-21T22:00:16Z")
\*\*\*\*actually that wasn’t enough to to solve it, there’s still a few possible combinations. ---
**Author:** ![eschereal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/eschereal/32/18939_2.png) [@eschereal](https://boards.straightdope.com/u/eschereal)\ **Post date:** [February 21, 2016, 10:03pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/397 "2016-02-21T22:03:28Z")
Again, the problem is that we do not know what the “13” is, much less what the key is. You assume that the iPhone encrypts every byte on its SSD; I believe that is an unfounded assumption. Show me where it says that literally all of the phone’s content is encrypted, because it would make a lot more sense from a security perspective to _not_ encrypt the standard data and object code (which is nicely segregated form user data). ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 10:33pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/398 "2016-02-21T22:33:28Z")
> [@eschereal](#): > > Again, the problem is that we do not know what the “13” is, much less what the key is. You assume that the iPhone encrypts every byte on its SSD; I believe that is an unfounded assumption. Show me where it says that literally all of the phone’s content is encrypted, because it would make a lot more sense from a security perspective to _not_ encrypt the standard data and object code (which is nicely segregated form user data). then we just send a text or an email or an update to the phone. No problemo. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 21, 2016, 11:34pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/399 "2016-02-21T23:34:41Z")
> [@Crazyhorse](#): > > The order is to create a new OS for the iPhone that bypasses these security measures. There is no question that they could do so. In the same vein they could also create software that tells them if the currently installed OS has the auto-erase feature enabled. I’m not a software engineer so I can’t really say how specifically, but it is 100% guaranteed that they can do this. You’re not a software engineer either but I would be curious why you think that they couldn’t. Because the settings themselves are encrypted. As I explained earlier when I discussed the keybag. They could determine the setting only by disabling it in their new OS, loading the new OS, brute-forcing the passcode, using the passcode, and then checking the setting. ---
**Author:** ![Jas09](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@Jas09](https://boards.straightdope.com/u/Jas09)\ **Post date:** [February 21, 2016, 11:38pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/400 "2016-02-21T23:38:44Z")
Scylla, if you really believe that a plaintext attack on AES-256 is plausible, you need to go apply to the NSA and explain your technique. You will also likely get a Fields medal. There are few techniques that have shown enough effectiveness to reduce the key-length by two bits. Anything beyond that is fantasy at this point (or at least a very well kept secret). [Previous page](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333.md?page=19) [Next page](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333.md?page=21)