[Cryptography] Hope Apple Fights This!

[Thierry Moreau]

On 17/02/16 04:58 AM, Harlan Lieberman-Berg wrote:
> Aram Perez <aramperez at mac.com> writes:
>> [The court orders Apple to] disable the feature that wipes the data on
>> the phone after 10 incorrect tries at entering a password."
>
> The response, of course, is to make sure you design your systems such
> that you can't be put in this situation in the first place.  The newer
> versions of Apple's phones, in fact, use a secure co-processor with
> secure flash for this exact purpose.
>

Reading the Court order (posted on another thread) paragraph 2, the 
software functions (erase of user data upon password entry failures, 
time throttling of password entry attempts) that need to be customized 
for the forensic facilities are typically *not* implemented in a secure 
co-processor (or at least not implemented in a secure co-processor 
devoid of a flash re-programming capability).

Not that such an architecture is impossible: it is simply too 
antagonistic to product development culture to come up with a product 
where encrypted user data is irrevocably lost when an encryption key is 
zeroized.

- Thierry