[nickysielicki]

Are you sure it's unreadable? I'd be so surprised if they couldn't sniff that out.

If it is, how do they do that? I can't imagine it's somehow embedded in circuitry (too complicated to mass produce) so it must be on some kind of storage medium, right? What makes that unreadable?

[jonknee]

https://www.apple.com/business/docs/iOS_Security_Guide.pdf

> Every iOS device has a dedicated AES 256 crypto engine built into the DMA path between the flash storage and main system memory, making file encryption highly efficient.

> The device’s unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the application processor and Secure Enclave during manufacturing. No software or firmware can read them directly; they can see only the results of encryption or decryption operations performed by dedicated AES engines implemented in silicon using the UID or GID as a key.

> Additionally, the Secure Enclave’s UID and GID can only be used by the AES engine dedicated to the Secure Enclave. The UIDs are unique to each device and are not recorded by Apple or any of its suppliers.

[cschmidt]

I'm fairly sure that only applies to the iPhone 5, and the FBI is interested in an iPhone 4, which doesn't have the Secure Enclave.

[jonknee]

No, as Apple states, every iOS device has a hardware key.

> Every iOS device has a dedicated AES 256 crypto engine built into the DMA path between the flash storage and main system memory, making file encryption highly efficient.

In newer phones it is in the Secure Enclave instead of the CPU (the SE handles all encryption/decryption for the CPU).

[geographomics]

There's no known API to read the UID out (there is one to use it, or the GID, or any other AES key: http://iphonedevwiki.net/index.php/IOCryptoAcceleratorFamily...), no published side-channel attacks, and the destructive/invasive techniques that would involve decapping the chip and using an electron microscope are not solid enough to use for this, such that there would a huge risk of destroying evidence.

[caf]

Embedding it in the circuitry isn't that complicated - remember, it's only 256 bits you have to embed, which for example could be stored in 256 fusible links.

[andromeduck]

If it's in fusible links, which IMO is very likely, wouldn't that mean you could read it back the same way you wrote it?

Maybe another HW key is required to do so.

[belovedeagle]

> wouldn't that mean you could read it back the same way you wrote it

Not if there's a write-permit fuse as well =)

[andromeduck]

Good point but isn't blowing a fuse detectable with x-rays?

[maaku]

It's in the chip.