Questions about iCloud Drive security and encryption

Hello,


I'd like to store my PDF document library in iCloud Drive so that I can access all of my bank statements, receipts, etc. on all of my devices. The thought of putting things like bank statements and tax returns on a cloud drive is a little troubling, however. I'm hoping someone can answer a few questions about security.


Can anyone at Apple ever gain access to my iCloud Drive documents? I read the security overview, but iCloud Drive is not listed under the "End to End Encrypted Data" section. One of the reasons I don't want to use Dropbox is that some of their employees (under special/extreme circumstances) can access user data. That worries me. If it's possible for certain employees to see what's in my Dropbox, it's possible for a hacker to do the same. So what about iCloud Drive? Is it a true zero knowledge system where no one at Apple can ever see what's in my iCloud Drive? Or?


I've also read that iCloud uses a "minimum of 128-bit AES encryption". Obviously 256 is much better. That's what Dropbox uses. So what about Apple? Are my iCloud Drive documents protected by 128- or 256- bit encryption?


Thanks!

Posted on Aug 6, 2018 12:13 AM

Reply
11 replies

Aug 6, 2018 11:35 AM in response to Rob X

Not really significantly. In fact the NSA has classified all AES strengths as sufficiently secure to protect government data classified as Secret. While Top Secret requires 192 or 256.


Until May 2009, the only successful published attacks against the full AES were side-channel attacks on some specific implementations. The National Security Agency (NSA) reviewed all the AES finalists, including Rijndael, and stated that all of them were secure enough for U.S. Government non-classified data. In June 2003, the U.S. Government announced that AES could be used to protect classified information:

The design and strength of all key lengths of the AES algorithm (i.e., 128, 192 and 256) are sufficient to protect classified information up to the SECRET level. TOP SECRET information will require use of either the 192 or 256 key lengths. The implementation of AES in products intended to protect national security systems and/or information must be reviewed and certified by NSA prior to their acquisition and use.[12]

https://en.wikipedia.org/wiki/Advanced_Encryption_Standard


Unless you think your bank statement data falls in the category of Top Secret...


Beyond that, Apple does not directly participate here. Outside of the mods / hosts which just enforce the rules, and the Specialists which generally only answer posts that have gone unanswered for more than a couple of days, there is no direct involvement by Apple here.


Whether an Apple employee is able to access your data in icloud, is unknown. Apple does not disclose this. information. What we do know, is that given the hacks and breakings to several companies servers, such as Target, Equifax, Yahoo, etc... Apple has remained unbreached as far as anyone knows. Which should at the very least provide a better sense of security than storing things in other locations.


Also, do you think your banks statements cannot be seen by your bank's employees? What happens if they are unscrupulous themselves? What happens if your bank is compromised? How much safer do you think your Bank is, than Apple, if at all?

Aug 6, 2018 10:55 AM in response to Rob X

Its explained in the support document you came from. iCloud Drive is encrypted in transit and on server with at least 128 bit AES encryption.


The table in that support document specifically addresses that:


DataEncryptionNotes
In transitOn server
BackupYesYesA minimum of 128-bit AES encryption
BookmarksYesYes
CalendarsYesYes
ContactsYesYes
Find My FriendsYesYes
Find My iPhoneYesYes
HealthYesYes
iCloud DriveYesYes
NotesYesYes
PhotosYesYes
RemindersYesYes
iCloud.comYesN/AAll sessions at iCloud.com are encrypted with TLS 1.2. Any data accessed via iCloud.com is encrypted on server as indicated in this table.
Back to My MacYesN/ABack to My Mac does not store data on iCloud. Data retrieved from other computers is encrypted with TLS 1.2 while in transit.
MailYesNo

All traffic between your devices and iCloud Mail is encrypted with TLS 1.2. Consistent with standard industry practice, iCloud does not encrypt data stored on IMAP mail servers. All Apple email clients support optional S/MIME encryption.



There's not much more that can be said besides that.

Aug 6, 2018 1:57 PM in response to Rob X

I'm not arguing about you wanting to store your document securely. I'm just pointing out just how securely do you really need them to be?


I can understand wanting them to be secure within certain parameters, but it comes down to whether you trust a service or not, and the encryption they use within the information they provide.


If you cannot trust Apple, then you should not store your document on their service. Simple as that.


There's no real way for anyone to provide complete and utter security anywhere. And probably no way for you get a satisfactory answer about how Apple operates its iCloud service as that would in fact compromise it. Best way to have secure operation, is to not disclose the details of its functionality to anyone.


You can contact Apple Support directly, but its unlikely they even know or can tell you if they do know exactly how iCloud Drive is operated and what kind of access employees have to it as I'm sure iron clad NDAs are involved for those who know exactly what kind of access exists if any.


We've provided the information that is available to users. All you can do is make a decision based on that information.

Aug 6, 2018 9:39 AM in response to tygb

Thanks, but that wasn’t my question. I want to know about Apple’s security policies at their server farms, not on my desktop. What encryption do they use for iCloud Drive documents? And can any of their employees access my files the way certain Dropbox employees can access Dropbox user data? This has nothing to do with security on the desktop.

Aug 6, 2018 11:11 AM in response to Eric Root

I get that. Thought someone from Apple might choose to respond and clarify, or perhaps a user who had already done this research. I’m going to call Apple but I don’t have high hopes that I’ll get a solid answer from tech support. They’ll likely point me to the support document someone else already posted (and I made clear that I’d already read), which doesn’t answer my questions.

Aug 6, 2018 11:15 AM in response to Phil0124

That support document doesn’t really answer my questions though.


Dropbox also uses encryption in transit and at rest. Yet it is not a zero knowledge platform. Certain Dropbox employees can access your data despite the encryption. So what about Apple? Just because they use encryption in transit and at rest, which I would expect of any cloud platform, that doesn’t mean that employees can’t access your iCloud Drive. I want to know if this is possible.


I’d also like clarification on the level of encryption used. 128 is significantly weaker than 256.

Aug 6, 2018 12:42 PM in response to Phil0124

I’m not here to argue about security, nor about the relative appeal (or lack thereof) of my bank statements to hackers. Besides, why do you care what I’m storing on iCloud drive and whether it’s worthy or not of higher security? And why should I care whether you think my files are worthy or not? It’s not your place to put down my desire to store my documents securely.

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Questions about iCloud Drive security and encryption

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.