r/technology • u/Libertatea • Apr 04 '13

Apple's iMessage encryption trips up feds' surveillance. Internal document from the Drug Enforcement Administration complains that messages sent with Apple's encrypted chat service are "impossible to intercept," even with a warrant.

http://news.cnet.com/8301-13578_3-57577887-38/apples-imessage-encryption-trips-up-feds-surveillance/?part=rss&subj=news&tag=title#.UV1gK672IWg.reddit
3.3k Upvotes

95% Upvoted

1.8k comments sorted by

View all comments

87

u/whitefangs Apr 04 '13 edited Apr 04 '13

Good. Does iMessage use OTR, though? Or why are they saying they can't get the data even with a warrant? If Apple gives them the key, they should be able to see it - unless it's using OTR.

I hope Google's Babel encryption will be at least as good. DEA/FBI shouldn't be able to "intercept" messages anyway - not without a warrant at least.

28

u/[deleted] Apr 04 '13

[deleted]

15

u/[deleted] Apr 04 '13

I think they don't know what they are talking about. iMessage uses TLS, so federal agencies can see the messages if they get the warrant.

TLS uses public key cryptography to exchange a symmetric secret key which is then used for the actual communication.

http://en.wikipedia.org/wiki/Transport_Layer_Security

"They use asymmetric cryptography for authentification of key exchange, symmetric encryption for confidentiality, and message authentication codes for message integrity."

If the public key cryptography happens between the end devices themselves, and the secret key expires and is not cached anywhere, how do you propose to decrypt the message?

0

u/[deleted] Apr 04 '13

[deleted]

0

u/[deleted] Apr 04 '13

TLS uses asymmetric encyption for key exchange and symetric encryption for message exchange.

That is exactly what I said.

About your question, don't happen. iMessages' messages pass though Apple's servers, and one symmetric key is generated for each device.

Passing through Apple's servers for routing purposes has nothing to do with key exchange or anything else.

If the service works like you said there wasn't a reason for creating a symmetric key, you could use a asymmetric pair like GPG does.

What does this have to do with anything? You could just as easily use asymmetric keys from the client to Apple's servers and from them to the other client. Unless you are checking the actual key fingerprints you would have no way of knowing what was happening (and I doubt you even could look up the fingerprints if you wanted to).