0

Suppose that a third-party app is encrypted (say, with AES 128), and that this app stores data in iCloud through iCloud Drive. In general, can Apple decrypt this data as it would with data stored in native iOS apps?

2
  • Do you mean “can they if iCloud, macOS and other Apple products work the way Apple says that they do” or “can they if Apple is lying about how its products work”? – Mike Scott Oct 5 '20 at 17:07
  • I initially intended the former, i.e. assuming that their products and services work as they claim, but on second thought, I'd also be curious of the situation in which they're lying. – Dion Oct 5 '20 at 17:14
2

If Apple is telling the truth, then they can’t access your data, assuming the third-party app developer doesn’t store your AES key in iCloud. Apple has no way to get at a key stored locally on your device (according to Apple) and no way to decrypt the data without the key (according to everything we know about cryptography).

If Apple is lying, then of course all encryption keys created or used by third-party apps could be secretly transmitted to Apple’s servers so that they can be used to decrypt your data, even if the app thinks it’s only storing them locally.

2
  • faq.whatsapp.com/iphone/chats/how-to-back-up-to-icloud/?lang=en This says that whatsapp messages stored in iCloud are not protected by end-to-end encryption. But might they still be encrypted by Whatsapp in such a way that "honest" Apple cannot read the messages? – Dion Oct 5 '20 at 18:55
  • @Dion They might be, but since WhatsApp doesn’t say that they are, it’s safest to assume that they aren’t. It would, for example, stop you from restoring the backup to a different device if it was encrypted with a locally stored key. – Mike Scott Oct 5 '20 at 19:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .