Backup Keybag
Definition
A data structure in iOS encrypted backups that holds the per-class encryption keys used to protect individual files. The keybag itself is wrapped by a key derived from the backup password using PBKDF2. Without the correct password, the keybag cannot be unwrapped and file content remains encrypted.
- Platform
- iOS encrypted device backups
- Contains
- Per-class file encryption keys
- Wrapping method
- PBKDF2-derived key from backup password
Common questions
Why can't an examiner simply read backup files without the password?+
Individual files in an encrypted iOS backup are protected by per-class keys stored inside the keybag, and the keybag itself is wrapped by a key derived from the backup password, so without the correct password the wrapping cannot be reversed and the per-class keys, and therefore the file contents, remain inaccessible.
Does the backup keybag differ from the keybag used on the device itself?+
Yes, the on-device keybag is tied to hardware-bound keys in the Secure Enclave and unlocked by the device passcode, while the backup keybag is a separate structure created for that backup and protected by the backup password the user set in iTunes or Finder, which is why device passcode and backup password recovery are handled as distinct problems.
Why does PBKDF2 make brute-forcing the backup password slow?+
PBKDF2 deliberately applies a large number of iterations of a hash function to the password before it can unwrap the keybag, which multiplies the computational cost of testing each password guess and is why weak backup passwords are still crackable but strong ones can take an impractical amount of time to exhaust.
Related terms
- ADB Backup
- An Android Debug Bridge backup produced by the adb backup command. The output is a TAR archive prefixed by a small plaintext...
- allowBackup Flag
- An Android manifest attribute (android:allowBackup) that controls whether an app's data is included in ADB backups. When set to false the app's...
- CLOUD Act
- The Clarifying Lawful Overseas Use of Data Act (US, 2018). Clarifies that US service providers must comply with valid US legal process...
- Domain (iOS Backup)
- A prefix in the iOS backup manifest that identifies the origin of each backed-up file. Common domains include HomeDomain (the device home...
- Manifest.db
- The SQLite database at the root of every iTunes local backup. It maps each backed-up file to its SHA-1 hash filename, recording...