Data Encryption On iTunes Backups Uses AES-256.

By now you should have heard that it’s possible for Apple to track your location via the iPhone (or rather, via the backup files in iTunes), which garnered the company some government attention, domestic as well as foreign; a lawsuit; and untold amounts of bad publicity.


The furor caused Steve Jobs to comment on the issue, and Apple eventually released an update to iOS.  The update (iOS 4.3.3) resolves the issue by doing the following:




  • Reducing the cache size


  • Not backing up the cache to iTunes


  • Deleting the cache when Location Services is turned off

Even before the fix was released, though, it was pointed out that the above is only a problem if 1) someone gets a hold of both your computer and your phone or 2) if you didn’t click on “Encrypt iPhone backup” option (or, if you use an iPod Touch, “Encrypt iPod backup” option).


Now that the fix is out, you might consider everything to be a moot point.  Perhaps.


Still Need to Encrypt Backup



Seeing how the backup file in iTunes contains all of the data found on your phone/pod, including phone numbers, contact details, notes, photographs, etc., it is still worthwhile for you to select the use of encryption.


If you do so, please know that it will prompt you for a password to access the backup files.  This is not the same as your iTunes Store password or your phone’s password (although you could set it up to be the same as those two).  And, if you forget this password, you will never, ever be able to access your backup files again.


Why? Because the backup file uses AES-256 encryption, the same encryption used in AlertBoot endpoint security software designed for laptop encryption and desktop encryption.  According to Apple’s iPhone OS Enterprise Deployment Guide, Second Edition, v3.2 or later (Ch.4, p.62):


Device backups can be stored in encrypted format by selecting the Encrypt Backup option for the device in the summary pane of iTunes. Files are encrypted using AES256. The key is stored securely in the iPhone OS keychain.

How secure is this?  Very.  But, don’t take my word for it: just read all the people looking for help decrypting encrypted backups.  And notice how no one is able to say, “I can help.”


Where is iTunes Backup Encryption Setting?



So where is this iTunes setting to ensure your backups are encrypted?  First, you’ve got to plug in your iPod Touch or iPhone into your computer.  Otherwise, you won’t find it, since it’s part of the settings for the portable device itself.


Once you’ve plugged in the iPhone and opened up iTunes, find the device on the left-hand side menu and click on it (make sure you don’t click on the eject icon).  Under “Summary” there is a section called “Options.”  The last entry is “Encrypt iPhone (or iPod) backup.”  Click on the checkbox and supply a password.


That’s it.



Related Articles and Sites:
http://manuals.info.apple.com/en_US/Enterprise_Deployment_Guide.pdf



Comments (0)


Let us know what you think