Apple’s data protection and iOS-integrated encryption provide a powerful information security system, provided that these technologies are properly implemented.
If collaborators do not enable data protection on their devices, or if they use applications that do not use it, all that’s left is basic iOS encryption to protect sensitive data. It is then easier to erase the contents of these devices. To take advantage of the powerful encryption features provided by the Apple system, you must ensure that users have enabled data protection and associated settings.
At the launch of iOS 4, Apple added a new important feature: data protection; an improved architecture that enhances iOS encryption on devices.
It combines with encryption mechanisms built into device hardware and firmware to better protect data.
Apple has improved data protection over the evolution of iOS in the direction of greater flexibility of access to files, even on a locked device, without putting these data in danger.
Integrated iOS encryption
Since the release of the iPhone 3GS, Apple has integrated encryption hardware and firmware of its iPad and iPhone. Thus, any iOS device has since had a 256-bit AES (Advanced Encryption Standard) cryptographic engine interposed between the Flash memory and the main system memory. Combined with the SHA-1 cryptographic hash function (also implemented on hardware), this engine reduces the overhead associated with encryption operations.
The device hardware also includes a built-in unique identifier (UDID), a 256-bit AES key embedded in the application processor. The UDID is device-specific and is not registered anywhere else. No software or firmware can read it directly. Only the results of the encryption and decryption operations are visible. Moreover, since the key is etched in silicon, it can not be falsified or bypassed. Only the cryptographic engine has access to it. Result: The data is cryptographically related to a specific device and can not be associated with any other device or device.
Integrating encryption with the architecture makes it easy to encrypt all data stored on an iOS device. In fact, Apple enables this level of encryption by default and does not allow it to be disabled. However, in terms of real protection, this iOS encryption provides little, except that it allows a fast and safe erasure of the system. This is an important function, especially in case of loss or theft of a device and provided that the remote erase has been configured beforehand. In such circumstances, it is theoretically possible to erase data from a device before someone can hack or unblock it. But if the device is not cleaned up fast enough, an attacker can “crack” security and
Enable iOS data protection
That’s where iOS data protection comes in. This feature is implemented at the software level and combines with hardware and firmware encryption to provide a higher degree of security.
When data protection is enabled, each data file is associated with a particular class that supports a different level of accessibility and protects the data according to how they are accessed. The encryption and decryption operations associated with each class depend on a complex key hierarchy that uses the device’s UDID and secret code, plus a class key, a file system key, and a key per file . The key per file is used to encrypt the contents of the file. The class key wraps the key by file. It is stored in the metadata of the file. The file system key is used to encrypt the metadata. The UDID and the secret code protect the class key.
Fortunately, this operation is transparent to the user. The latter accesses its applications normally. The detailed operation of encryption mechanisms is not the most important to remember (except for developers). Remember that for a device to use data protection, a secret code must be entered when accessing this device. The code is not only used to unlock the device; it also becomes inseparable from the UDID to create iOS encryption keys that are more resistant to hacking and force attacks. In fact, users must enable PINs on their devices to enable data protection.
Protect data in iOS
If you allow iOS devices in your business, your policies should encourage users to use PINs that help protect sensitive data. But do not forget that all secret codes are not equal. On an iOS device, there are two types: the simple four-digit numeric code and the complex alphanumeric code, which in principle is much longer. Of course, the more complex the alphanumeric code, the more efficient it is.
For example, according to Apple’s documentation, a force attack directed at a device that uses a nine-digit alphanumeric secret code will require two and a half years of effort to try every possible combination, in part because iOS applies increasing deadlines. to discourage this kind of attack. On the other hand, a six-character secret code combining digits and lowercase letters will withstand five and a half years. And, as you can imagine, a four-digit numeric code would be cracked in no time. Of course, if users set their devices so that their content is automatically erased after 10 failed attempts, the number of attempts is not a problem (unless the secret code can be guessed in less than 10 tries).
However, secret codes are not the only factor to take into account to get the most out of iOS data protection. An application must be designed to use the Data Protection Application Programming Interfaces (APIs) to ensure this protection when the application accesses the data. It must also ensure that you do not transfer data to applications that do not use data protection. In other words, no unsecured application should be able to access the data of a secure application. Remember, even if an application is designed to protect all its data, it may have limitations that it does not control. Thus, data protection does not
Since iOS 6, users can better control applications that can access secure data in other applications. Although the encryption mechanisms themselves have not changed in iOS 6, the operating system has since required a user’s permission for a new application to access personal data, such as calendars, reminders and contacts. Similarly, users can now change data access for certain applications in the device settings (under Privacy – Privacy).
But that’s not all. In the wake of iOS 8, Apple has released a new version of its white paper describing security provisions embedded by its mobile operating system. And we learn that “some system applications such as Messages, Mail, Calendars, Contacts, and Photos use Data Protection by default” when third-party applications can optionally take advantage of it. This data protection device aims at 256-bit AES encryption of data files stored on the internal flash memory. It is activated automatically as soon as the user sets a password to lock his terminal. With an A7 processor – iPhone 5S in particular – all tasks related to encryption keys are provided by Secure Enclave, a coprocessor dedicated to cryptography and which is used to check the signature of applications. According to Apple, Secure Enclave “maintains the integrity of Data Protection even when the kernel has been compromised. This coprocessor uses an encrypted memory space.
To get the most out of iOS encryption, it’s not just about enforcing secret code rules, but also maintaining full control over the applications running on iOS devices, or at least those using strategic data of the company. Without these methods, no salvation, because the degree of protection would then be practically nil.