# Should Apple help the government hack into encrypted devices? **URL:** \ **Category:** Great Debates\ **Created:** [February 17, 2016, 1:20pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333 "2016-02-17T13:20:10Z")\ **Posts on this page:** 20\ **Page:** 21
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 21, 2016, 11:41pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/401 "2016-02-21T23:41:20Z")
> [@Scylla](#): > > let’s say we are encrypting the number “13.” > > Our encoding method will be to have a two number key using the numbers 1 - 100, the algorithm will be to multiply our input by the first number in the key and then add the second number. > > (I know, it’s a devastatingly complex and diabolical encryption method, but bear with me, this only a conceptual example) > > Now let’s say the output is “85.” > > Now even though we don’t know what the key is, we know certain things about the key. We know that the first number in the key can’t be greater than 6 since anything more than that would produce a Number higher than our output. > > Right off the bat we’ve eliminated 9400 of 10,000 possible combinations. > > We also know that the second number must be small enough to possibly give us our output, so if we are testing 6 as the first number of the key, the only possible combinations would be the numbers 1-7, we can exclude 8-100. We can do the same for the remaining possibilities for the first number of the key, and now we’ve reduced the possible keys from 10,000 to about 100 (I haven’t bothered to work it out exactly.). That’s about a 99% reduction in possible keys to test. > > The AES code is of course just slightly more complex than this, but knowing the formula used and knowing what unencrypted output looks like necessarily tells us something about what the keys must be. > > * * * > > So let’s say for the sake of argument that the above appears somewhat reasonable to you. You say “Very impressive Scylla! Congratulations, by applying your method you have now reduced the time needed to crack the code from 100 billion years, to only 1 billion years! We better get started on this right away.” > > That’s a good point except for the fact that the more complex the algorithm and keys used the greater the constraint upon the output, and the more unencrypted data you have to work with the more you able to eliminate keys. > > Going back to my example let’s say that the next piece of unencrypted data is “5.” And the output is “37.” We can now reduce the remaining keys again, and I believe that’s enough to solve it and guess the keys right there. > > Do you see the concept? Hashing. This is the concept you are missing. Hashing takes 13 and returns 3ACD78C55FAD063D01274563AE327. And it takes 14 and returns A430643CB66800186AC76984BDBF8. Your method does not work with modern cryptography. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 21, 2016, 11:43pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/402 "2016-02-21T23:43:15Z")
> [@Scylla](#): > > then we just send a text or an email or an update to the phone. No problemo. That data is encrypted with a completely different class of key from the keybag. Remember the keybag? Different keys encrypt different kinds of data. ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 11:52pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/403 "2016-02-21T23:52:12Z")
> [@Bricker](#): > > Hashing. > > This is the concept you are missing. > > Hashing takes 13 and returns 3ACD78C55FAD063D01274563AE327. > > And it takes 14 and returns A430643CB66800186AC76984BDBF8. > > Your method does not work with modern cryptography. How do you propose that matters? ---
**Author:** ![Jas09](https://avatars.discourse-cdn.com/v4/letter/j/d07c76/32.png) [@Jas09](https://boards.straightdope.com/u/Jas09)\ **Post date:** [February 21, 2016, 11:55pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/404 "2016-02-21T23:55:18Z")
> [@Scylla](#): > > How do you propose that matters? Are you proposing that AES is susceptible to a plaintext attack? Because that seems to be what you are proposing. With the very best minds in cryptanalysis all focused on doing that for the fame and fortune that would come with it, the very best techniques have reduced the time taken to extract the key from a known plaintext and the encrypted text by 2 bits. ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 21, 2016, 11:58pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/405 "2016-02-21T23:58:42Z")
> [@Bricker](#): > > That data is encrypted with a completely different class of key from the keybag. > > Remember the keybag? Different keys encrypt different kinds of data. Are you being deliberately obtuse? Do you really think we don’t know anything about the data we are trying to extract? ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 22, 2016, 12:00am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/406 "2016-02-22T00:00:34Z")
> [@Jas09](#): > > Are you proposing that AES is susceptible to a plaintext attack? Because that seems to be what you are proposing. I was providing a conceptual example. ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 22, 2016, 1:14am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/407 "2016-02-22T01:14:37Z")
I don’t understand why anybody has any faith in this version of encryption on this version of the software on this version of the iPhone, when every other version on every other phone, has basically been hacked by some high school dropout eurotrash paparazzi. How many nude pictures of Jennifer Lawrence will it take to convince you I’m right? We have a whole department of government who’s job is to do nothing but try to intercept and decrypt the best efforts of other countries to shield their confidential data. Apparently they have had some success. Yet, you think they have been defeated by the iPhone? ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 22, 2016, 1:19am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/408 "2016-02-22T01:19:29Z")
> [@Scylla](#): > > Are you being deliberately obtuse? Do you really think we don’t know anything about the data we are trying to extract? We know a great deal about some of the plaintext data. But we don’t squat about others. And because the parts we know are encrypted with a different key than the ones we don’t know, knowing the plaintext data isn’t helpful. You seem to be picturing this as a Captain Crunch Decoder Ring. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 22, 2016, 1:20am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/409 "2016-02-22T01:20:34Z")
> [@Scylla](#): > > How do you propose that matters? It matters because it shreds your example. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 22, 2016, 1:27am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/410 "2016-02-22T01:27:40Z")
> [@Scylla](#): > > I don’t understand why anybody has any faith in this version of encryption on this version of the software on this version of the iPhone, when every other version on every other phone, has basically been hacked by some high school dropout eurotrash paparazzi. > > How many nude pictures of Jennifer Lawrence will it take to convince you I’m right? > > We have a whole department of government who’s job is to do nothing but try to intercept and decrypt the best efforts of other countries to shield their confidential data. Apparently they have had some success. Yet, you think they have been defeated by the iPhone? Yes. There are two arguments I have seen from you. One is, “The same techniques that have been successfully used in the past will work here!” And the second is, “We have loads of smart people who have worked on this. Surely they would have succeeded!” If there is some flaw in how Apple has executed the cryptography, and if these smart people have found it, then I agree with you. But the existence of that flaw is utterly speculative on your part. If there is no flaw, then – and here is where you struggle – the scheme is not vulnerable except to a truly prodigious breakthrough in computer architecture. ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 22, 2016, 2:02am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/411 "2016-02-22T02:02:17Z")
> [@Bricker](#): > > Yes. > > There are two arguments I have seen from you. One is, “The same techniques that have been successfully used in the past will work here!” And the second is, “We have loads of smart people who have worked on this. Surely they would have succeeded!” > > If there is some flaw in how Apple has executed the cryptography, and if these smart people have found it, then I agree with you. But the existence of that flaw is utterly speculative on your part. > > If there is no flaw, then – and here is where you struggle – the scheme is not vulnerable except to a truly prodigious breakthrough in computer architecture. You’ve called my viewpoint “speculative.” Consider though the # of iPhones we have had. Consider the # of operating systems we have had. Consider the number of updates we have had to each. Put together it likely numbers more than 100. Every single one of those previous versions had exploitable security holes. Every. single. one. You tell me that this one is different, and unlike every other iPhone that has ever existed this one is impervious. You, my friend are positing a unicorn, a Sasquatch, a mythical beast that has never been seen before. When I tell you in fact that it is probably not a unicorn, or a Sasquatch, or an Invisible Pink Unicorn, you claim I am being “speculative?” You are not arguing with a 13 year old child. You cannot simply spout Apple propaganda, wave a magic wand and say “hocus pocus, Aes 235 key bag hashing billion billion years, presto changeover uncrackable.” That this version of this phone is uncrackable… Or even particularly difficult to crack compared to previous versions is the speculative stance. That’s the extraordinary claim. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 22, 2016, 2:36am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/412 "2016-02-22T02:36:43Z")
> [@Scylla](#): > > You’ve called my viewpoint “speculative.” Consider though the # of iPhones we have had. Consider the # of operating systems we have had. Consider the number of updates we have had to each. Put together it likely numbers more than 100. > > Every single one of those previous versions had exploitable security holes. Every. single. one. Not true. Most are bug fixes. Some are security holes that don’t relate to encryption. > [@](#): > > You tell me that this one is different, and unlike every other iPhone that has ever existed this one is impervious. > > You, my friend are positing a unicorn, a Sasquatch, a mythical beast that has never been seen before. > > When I tell you in fact that it is probably not a unicorn, or a Sasquatch, or an Invisible Pink Unicorn, you claim I am being “speculative?” > > You are not arguing with a 13 year old child. You cannot simply spout Apple propaganda, wave a magic wand and say “hocus pocus, Aes 235 key bag hashing billion billion years, presto changeover uncrackable.” > > That this version of this phone is uncrackable… Or even particularly difficult to crack compared to previous versions is the speculative stance. That’s the extraordinary claim. Except that no one is stepping forward to actually demonstrate the crack. Why is that? ---
**Author:** ![Scylla](https://avatars.discourse-cdn.com/v4/letter/s/a5b964/32.png) [@Scylla](https://boards.straightdope.com/u/Scylla)\ **Post date:** [February 22, 2016, 2:47am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/413 "2016-02-22T02:47:45Z")
> [@Bricker](#): > > Not true. > > Most are bug fixes. Some are security holes that don’t relate to encryption Fair enough, but you see my point. > [@](#): > > Except that no one is stepping forward to actually demonstrate the crack. Why is that? In the case of the government, I believe I’ve already made my case in great detail as to why they might wish this terrorist’s compatriots to believe their data is secure. There are two rules to code breaking: 1. Break the code 2. Convince everybody that you didn’t break the code. Not all hackers wear white hats. Are you seriously asking me to argue why it might be advantageous to have access to a security hole that is generally unknown? ---
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [February 22, 2016, 2:50am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/414 "2016-02-22T02:50:43Z")
> [@Bricker](#): > > Because the settings themselves are encrypted. > > As I explained earlier when I discussed the keybag. > > They could determine the setting only by disabling it in their new OS, loading the new OS, brute-forcing the passcode, using the passcode, and then checking the setting. I disagree. The phone has to be able to determine if someone enters the wrong password 10 times and obviously it has to be able to do this before it has received the correct password and opened up access to the file system. So somewhere in there it is working with the unencrypted equivalent of “nope, try again. 9 attempts remaining…” Like I said I’m not an Apple engineer and only one of those could really answer this question with certainty, but I find it extremely likely that Apple would know how to find that. They aren’t limited to doing what the FBI suggests. They might be able sniff data going between the CPU and the keypad UI and know that some bit is changing each time they try an incorrect PW, where no bit should change if the correct PW was entered, even if they can’t directly see what the bit is set to. Or any number of other possibilities. But even if you’re right it doesn’t take anything away from the larger point that I was only reinforcing with this theory about the wording of the order to disable the auto-erase feature: this is not intended by the government to just be done for one phone and only one phone. It is just the most recent move in a long battle they’re fighting to make Apple backdoor the phone. Apple made it no secret that with the changes in IOS 8 they would no longer be able to honor orders from the government to crack into people’s phones and they were quite happy about that. The government isn’t happy about it. They are trying to set a precedent with this order and Apple is trying to set a precedent by refusing to comply with it. They are both thinking ahead to millions of other phones that are going to be affected by the outcome of this one way or the other. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 22, 2016, 3:44am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/415 "2016-02-22T03:44:30Z")
> [@Scylla](#): > > Fair enough, but you see my point. > > In the case of the government, I believe I’ve already made my case in great detail as to why they might wish this terrorist’s compatriots to believe their data is secure. There are two rules to code breaking: > > 1. Break the code > 2. Convince everybody that you didn’t break the code. > > Not all hackers wear white hats. Are you seriously asking me to argue why it might be advantageous to have access to a security hole that is generally unknown? No, I get that motive. I just don’t agree that this shows the code is broken. ---
**Author:** ![Bricker](https://avatars.discourse-cdn.com/v4/letter/b/977dab/32.png) [@Bricker](https://boards.straightdope.com/u/Bricker)\ **Post date:** [February 22, 2016, 3:47am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/416 "2016-02-22T03:47:20Z")
> [@Crazyhorse](#): > > I disagree. The phone has to be able to determine if someone enters the wrong password 10 times and obviously it has to be able to do this before it has received the correct password and opened up access to the file system. So somewhere in there it is working with the unencrypted equivalent of “nope, try again. 9 attempts remaining…” > > Like I said I’m not an Apple engineer and only one of those could really answer this question with certainty, but I find it extremely likely that Apple would know how to find that. They aren’t limited to doing what the FBI suggests. They might be able sniff data going between the CPU and the keypad UI and know that some bit is changing each time they try an incorrect PW, where no bit should change if the correct PW was entered, even if they can’t directly see what the bit is set to. Or any number of other possibilities. That count is happening regardless. The phone increases time between tries after several failed attempts even when the auto-erase is not enabled. > [@](#): > > The government isn’t happy about it. They are trying to set a precedent with this order and Apple is trying to set a precedent by refusing to comply with it. They are both thinking ahead to millions of other phones that are going to be affected by the outcome of this one way or the other. I take no position on this claim. ---
**Author:** ![Wolf333](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/wolf333/32/3460_2.png) [@Wolf333](https://boards.straightdope.com/u/Wolf333)\ **Post date:** [February 22, 2016, 7:33am UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/417 "2016-02-22T07:33:41Z")
> [@Scylla](#): > > I don’t understand why anybody has any faith in this version of encryption on this version of the software on this version of the iPhone, when every other version on every other phone, has basically been hacked by some high school dropout eurotrash paparazzi. > > How many nude pictures of Jennifer Lawrence will it take to convince you I’m right? > > We have a whole department of government who’s job is to do nothing but try to intercept and decrypt the best efforts of other countries to shield their confidential data. Apparently they have had some success. Yet, you think they have been defeated by the iPhone? The iCloud was done via social engineering, not breaking encryption. ---
**Author:** ![Ravenman](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ravenman/32/2929_2.png) [@Ravenman](https://boards.straightdope.com/u/Ravenman)\ **Post date:** [February 22, 2016, 2:29pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/418 "2016-02-22T14:29:28Z")
**Scylla** , what you’re proposing just plain doesn’t make sense. Even if we knew that Moby Dick was on this murderer’s phone, doesn’t mean we can encrypt Moby Dick on our own and somehow crack his passcode. Different keys yield totally different results, and even an imperceptible difference in the text (let’s say one of the thousands of commas in the book was mistakenly misprinted as a period) would also result in totally different results even if you were using the same key. I think everyone in this thread acknowledges that there are ways to break into this particular iPhone, and other iPhones in the past, by using some pretty clever techniques that do not involve banging one’s head against a very, very strong encryption system that the government uses to protect Top Secret data. If comparing different encrypted versions of identical versions Moby Dick yielded clues to breaking AES wide open, then you can absolutely bet that neither NIST, which validates the security of AES, or the NSA, which is responsible for the US military’s cryptography, would use this system. It would be dumped faster than old fish sitting in your wastebasket. ---
**Author:** ![Snowboarder\_Bo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/snowboarder_bo/32/229_2.png) [@Snowboarder\_Bo](https://boards.straightdope.com/u/Snowboarder_Bo)\ **Post date:** [February 22, 2016, 3:11pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/419 "2016-02-22T15:11:11Z")
[In the news today](http://hosted.ap.org/dynamic/stories/U/US_APPLE_ENCRYPTION?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2016-02-22-09-11-10): [Tim Cook sent an email to Apple’s employees today about why the company is taking a stance against fulfilling the judge’s order](http://techcrunch.com/2016/02/22/in-employee-email-apple-ceo-tim-cook-calls-for-commission-on-interaction-of-technology-and-intelligence-gathering/). [The full text of the email is reprinted here:](http://www.theverge.com/2016/2/22/11092028/apple-tim-cook-fbi-encryption-internal-memo) > [@Apple CEO Tim Cook](#): > > Subject: Thank you for your support > > Team, > > Last week we asked our customers and people across the United States to join a public dialogue about important issues facing our country. In the week since that letter, I’ve been grateful for the thought and discussion we’ve heard and read, as well as the outpouring of support we’ve received from across America. > > As individuals and as a company, we have no tolerance or sympathy for terrorists. When they commit unspeakable acts like the tragic attacks in San Bernardino, we work to help the authorities pursue justice for the victims. And that’s exactly what we did. > > This case is about much more than a single phone or a single investigation, so when we received the government’s order we knew we had to speak out. At stake is the data security of hundreds of millions of law-abiding people, and setting a dangerous precedent that threatens everyone’s civil liberties. > > As you know, we use encryption to protect our customers — whose data is under siege. We work hard to improve security with every software release because the threats are becoming more frequent and more sophisticated all the time. > > Some advocates of the government’s order want us to roll back data protections to iOS 7, which we released in September 2013. Starting with iOS 8, we began encrypting data in a way that not even the iPhone itself can read without the user’s passcode, so if it is lost or stolen, our personal data, conversations, financial and health information are far more secure. We all know that turning back the clock on that progress would be a terrible idea. > > Our fellow citizens know it, too. Over the past week I’ve received messages from thousands of people in all 50 states, and the overwhelming majority are writing to voice their strong support. One email was from a 13-year-old app developer who thanked us for standing up for “all future generations.” And a 30-year Army veteran told me, “Like my freedom, I will always consider my privacy as a treasure.” > > I’ve also heard from many of you and I am especially grateful for your support. > > Many people still have questions about the case and we want to make sure they understand the facts. So today we are posting answers on [Customer Letter - FAQ - Apple](http://apple.com/customer-letter/answers/) to provide more information on this issue. I encourage you to read them. > > Apple is a uniquely American company. It does not feel right to be on the opposite side of the government in a case centering on the freedoms and liberties that government is meant to protect. > > Our country has always been strongest when we come together. We feel the best way forward would be for the government to withdraw its demands under the All Writs Act and, as some in Congress have proposed, form a commission or other panel of experts on intelligence, technology and civil liberties to discuss the implications for law enforcement, national security, privacy and personal freedoms. Apple would gladly participate in such an effort. > > People trust Apple to keep their data safe, and that data is an increasingly important part of everyone’s lives. You do an incredible job protecting them with the features we design into our products. Thank you. > > Tim ---
**Author:** ![Crotalus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crotalus/32/41_2.png) [@Crotalus](https://boards.straightdope.com/u/Crotalus)\ **Post date:** [February 22, 2016, 3:40pm UTC](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333/420 "2016-02-22T15:40:14Z")
I strongly suggest that everyone engaging in this discussion read the [Answers to your questions about Apple and security](http://www.apple.com/customer-letter/answers/) linked to in Bo’s post above. You may think it is full of lies (I don’t), but I think we should all be clear about what Apple is claiming publicly. One thing that I found instructive is that Apple considers the OS requirement that all passcode entry be done via fingers is integral to their security scheme, so they strongly object to the part of the FBI request that would allow passcode entry via a port or Bluetooth. [Previous page](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333.md?page=20) [Next page](https://boards.straightdope.com/t/should-apple-help-the-government-hack-into-encrypted-devices/746333.md?page=22)