Even the FBI can’t defeat good encryption – here’s why it works

encryption bill underway protects your most private data
Digital data is difficult to secure by nature. Once a person has access to a file, it’s trivial to move, copy or delete. A single breach can spread a file to literally millions of people across the globe, something that would never be possible with a document that only exists as a physical copy.

That will never change. The ease of accessing, moving, copying, altering, and deleting data is a key trait of all modern computers. Instead, digital data security focuses on creating barriers between the data and those seeking access, so a file never leaves its owner’s control.

Barriers like encryption. If you use the Internet, own a smartphone, or have a PC, then your data is at some point protected by encryption, though you may not know it. That’s why the FBI is having such a tough time getting into the phone of a mass shooter, and Apple is so reluctant to help. Defeating its own encryption for one iPhone could potentially defeat it for all iPhones, in the wrong hands.

It’s a complicated problem, but one that’s easier to understand if you know the basics of encryption. What is encryption, and how does it work? Hold on to your butts, because it’s time for some maths.

Child’s play

When I was a kid, I came up with a secret code that I thought was very clever. I’d write a message by substituting every letter with one six steps higher in the alphabet. So an A became G, and so on.

Silly as it may seem, this is a basic form of encryption. First, imagine each letter as a number. A corresponds to one, Z corresponds to 26, and so on. The cipher for my childhood code, mathematically speaking, became (x)+6, where (x) is the number corresponding to the letter I meant to communicate. Of course, the math loops above 26, since there’s only 26 letters in the alphabet. Thus, a Z became an F.

qwerty-card-password-protection-encryption

So, to reiterate, my cipher turned an A to a G because that was the result of one (the number corresponding to A) plus six.

This is a very basic form of encryption. A set of data, in this case the letters of the alphabet, has a mathematical algorithm applied to it. It’s terrible encryption, since it wouldn’t take much effort to identify patterns in my garbled words, and then work out the code. Still, the example covers the basics.

Diving into the deep end

The code I came up is a bit like a code used in the Roman Empire called Ceaser’s Cipher. Modern encryption is a lot more complex. A number of techniques have been invented to further garble the data. That includes the literal key to modern encryption techniques – the encryption key. I’ll explain, using the popular AES standard as a basis.

No modern computer can break 256-bit AES, even if it’d started working on the problem at the beginning of the universe.

Understanding the encryption key in detail requires mathematical knowledge that most people simply don’t have, so I’m not going to try and cover every step. To put it as simply as possible, the original data goes through an “exclusive or” function alongside the value of the key. The function registers false if the inputs are the same, and true if they are not. If you’re familiar with computers, you’ll immediately recognize this false/true function is binary, and so it generates a new set of binary data from the input of the original data and the key.

Then, to make it even harder to crack, AES uses a number of additional steps such as confusion, the technique I used to make my childhood cipher. After those several additional steps, the encryption is complete. Decryption reverses the steps to find the original message, but only if the key is known, since it was used to complete the encryption functions.

You’ve probably at some point heard that encryption keys come in different types, like 64-bit, 128-bit, and 256-bit. The more bits in the key, the harder it becomes to decrypt, because the original data is more thoroughly muddled through the “exclusive or” and successive steps.

And when I say difficult, I mean difficult. You’ve likely heard that the FBI wants Apple to help it bypass the security of an iPhone used by a suspect in the San Bernardino terrorist attack. That phone is protected by 256-bit AES encryption. No computer currently in existence can break 256-bit AES through brute-force even if it’d started working on the problem at the beginning of the universe. In fact, it would take hundreds of billions of years for a modern supercomputer to crack 256-bit AES just by guessing.

Getting around the impossible

While impossible is a strong word, it’s applicable to current technology, and current forms of encryption. A brute force attack against today’s best algorithms isn’t feasible.

Yet you’ve probably heard, time and time again, of attackers taking down encryption. How can that be? Sometimes this occurs because of the use of an old encryption method that’s been cracked. In other cases, it’s due not to a weakness of the algorithm used, but instead a problem with how it was implemented.

The iPhone that the FBI can’t crack is an example of well implemented encryption. A PIN is used to secure the phone, but it rejects unsuccessful attempts with a lockout time that becomes longer and longer after the fourth try. After ten unsuccessful attempts the phone wipes itself clean. It’s not possible to get around the PIN by loading new software, because firmware can only be loaded onto an iPhone if it’s signed with a specific code only Apple knows. And encryption is applied by a chip that’s between the phone’s flash storage and the main system memory, so it’s not possible to physically hijack the data.

apple-iphone-6s_7855-1500x1000-720x720

That’s a lot of security, and each barrier represents a potential hole. It’d be possible to simply re-try the PIN until the correct one was found if the iPhone did not reject successive attempts. The phone’s memory might be transplanted to a different device if it wasn’t encrypted by a chip within the phone. Firmware that’s not properly secured would let a hacker load their own custom firmware to disable the phone’s security features. And so on.

Encryption is effective, but sensitive. If the key used to execute it can be discovered, or the software and hardware used to conduct the encryption can be fooled, it’s easily defeated. Key-logging software is a good example. It can “defeat” even the toughest encryption by logging the user’s password. Once that’s compromised, an attacker doesn’t need the slightest technical skill to proceed.

Conclusion

The iPhone is also a great example of encryption because most people don’t realize it’s encrypted while using it. This is true of its implementation more often than not. HTTPS uses encryption to send data securely over the Web. All the major cloud storage providers use encryption to protect data. Even your cell phone’s data voice and data connections are encrypted.

Opaque operation is ideal. Encryption shouldn’t be obvious – at least not when applied to everyday consumer devices. If it were, it might become annoying, and users would seek ways to circumvent it. You’ll find it’s rare that you must do anything to enable encryption.

But it’s still important to know what it is, and how it works, so you can judge the devices you use and be careful about how you use them. User error causes encryption failure far more often than an actual breach of an algorithm. Knowledge can help you shore up the weak spot – you.

Product Review

'Hitman 2' goes in for the kill with more of everything you love

IO Interactive and Warner Bros introduce us to ‘Hitman 2’, a sequel that embraces what made the series so unique and exceeds at delivering a more polished and complex experience.
Home Theater

Looking for a podcast? Pandora’s Podcast Genome Project is just the ticket

Pandora has created a brand new service for podcast listeners. Powered by calls the Podcast Genome Project, the new podcast offering uses an advanced combination of algorithms and human curation to deliver the perfect podcasts for you.
Mobile

Google’s Gboard now uses A.I. to recommend GIFs based on your conversation

Google is bringing a new feature to Gboard that should make it better for those that regularly use GIFs and stickers. The feature essentially uses A.I. to recommend GIFs and stickers based on your conversation.
Gaming

This GameCube controller adapter gives you more options for ‘Smash Bros.’

8BitDo has announced the GBros. wireless adapter, a device that lets you use your old GameCube controllers on your Nintendo Switch via Bluetooth. The adapter will launch alongside Super Smash Bros. Ultimate.
Computing

Want to save a webpage as a PDF? Just follow these steps

Need to quickly save and share a webpage? The best way is to learn how to save a webpage as a PDF file, as they're fully featured and can handle images and text with ease. Here's how.
Computing

Installing fonts in Windows 10 is quick and easy -- just follow these steps

Want to know how to install fonts in Windows 10? Here's our guide on two easy ways to get the job done, no matter how many you want to add to your existing catalog, plus instructions for deleting fonts in the process.
Computing

After a month of bugs, the Windows 10 October 2018 Update is finally here

After more thoroughly investigating and resolving all bugs and related issues, Microsoft is announcing the Windows 10 October 2018 is again rolling out to consumers starting today, November 13. 
Computing

Changing file associations in Windows 10 is quick and easy with these steps

Learning how to change file associations can make editing certain file types much quicker than manually selecting your preferred application every time you open them. Just follow these short steps and you'll be on your way in no time.
Emerging Tech

New simulation shows how Elon Musk’s internet satellite network might work

Elon Musk has the dream of building a network for conveying internet traffic via thousands of satellites. A new simulation created by a computer scientist looks at how feasible the idea is.
Computing

A dead pixel doesn't mean a dead display. Here's how to repair it

Dead pixel got you down? We don't blame you. Check out our guide on how to fix a dead pixel and save yourself that costly screen replacement, or an unwanted trip to your local repair shop.
Computing

Great PC speakers don't need to break the bank. These are our favorites

Not sure which PC speakers work best with your computer? Here are the best computer speakers on the market, whether you're working with a tight budget or looking to rattle your workstation with top-of-the-line audio components.
Computing

Printing to PDF in Windows is easy, no matter which method you use

Microsoft's latest operating system makes it easier than ever to print to PDF in Windows, but there are alternative methods for doing so, even if you want to forgo Adobe Acrobat. Here's how.
Computing

These are the 5 best free antivirus apps to protect your MacBook

Malware protection is more important than ever, even if you eschew Windows in favor of Apple's desktop platform. Thankfully, protecting your machine is as easy as picking from the best free antivirus apps for Mac suites.
Computing

These laptop bags will keep your notebook secure wherever you go

Choosing the right laptop bag is no easy feat -- after all, no one likes to second-guess themselves. Here are some of the best laptop bags on the market, from backpacks to sleeves, so you can get it right the first time around.