With the Apple-San Bernardino case in the news, I thought I would try to provide some background.
During World War II, German ships and U-boats left their ports with an Enigma machine so that they could communicate with each other using coded messages. The Enigma machine had been commercially available to anyone wishing to purchase it, so they knew the Allies had them. They also sent out with their ships a code book that had a new cipher key each day. The code books were printed in water-soluble ink so that the books could be destroyed easily in the case of capture. Getting your hands on one of these books would make decoding the messages child’s play. It was only the laziness of German cipher operators in reusing codes and repeating words that provided clues that helped break the code.
The Americans after going through a number of different encryption methods that ultimately were cracked settled upon using native Indian soldiers to communicate in their mother tongues. In particular, Navajo was a language that few non-native speakers knew and bore grammar and other characteristics that no other language had.
Secure communication over the internet has a big disadvantage relative to using secret code books as the Germans did and using an obscure language as the Americans did. On the internet, everyone has to be able to communicate securely with everyone else, so we have to use the same language. At the same time, in theory your bank could have you pick up a code book at a branch, but that would be impractical.
The solution to secure communication on the internet is something referred to as public key-private key encryption. Think of a public key like a box with an open padlock on it. If you have one of these boxes, you can put something in it and then lock the padlock. At this point, the only person who can unlock the box is the person who has the combination (i.e. the private key). Not even the person who put the item in the box can take it out once it’s been put in.
Every website with a secure connection has a public key that is given out freely and a private key that is protected at all costs. If someone obtained Amazon.com’s private key, they would potentially be able to decrypt all of the credit card numbers that were sent to Amazon.
How does this relate to Apple and the San Bernardino terrorists phone? You may read in the news that Apple at one point could decrypt iMessages but now can’t. What happened? It used to be that your iPhone used Apple’s public key to encrypt messages which were sent to Apple’s servers which then decrypted them and sent them onto the recipient. Now, your phone has its very own set of public and private keys. Now when you send a message, the iPhone uses the recipient’s public key to encrypt the message. The only device that can decrypt your message is the one with the corresponding private key.
Apple was able to turnover backups of the phone to the FBI. The backups were encrypted by an Apple key instead of one belonging to someone’s specific device. Why is that? Because you need your backups when you’ve lost your phone and thus no longer have access to your private key.
The FBI is now asking Apple to turn over the source code and what is known as their “digital certificate”. What is a digital certificate? It’s the same idea. Your phone wants to authenticate and ensure that any software update is actually an update from Apple and not someone attempting to install something malicious onto your phone.