Is Apple’s Cloud Key Vault a Crypto Backdoor? (2017)

> This is probably the biggest weakness of the system, and the part that’s driving the “backdoor’ concerns above. You see, the HSMs Apple uses are programmable. This means that — as long as Apple still has the code signing keys — the company can potentially update the custom code it includes onto the HSM to do all sort sorts of things.

> To remove these keys as a concern, once Apple is done programming the HSM, they run these cards through a process that they call a “physical one-way hash function”

> To make sure all admin cards are destroyed, the company has developed a complex ceremony for controlling the cards prior to their destruction.

> This mostly involves people making assertions that they haven’t made copies of the code signing key — which isn’t quite foolproof. But overall it’s pretty impressive.

The problem is that with this kind of implementation governments can forbidden key destruction.

Now, I don't know how to protect users with encryption without users owning master/private key. But that's not my point.

My point is that saying that there is no backdoor is misleading because although there is no backdoor today it's not immune to backdoors

Edit: typing