Decrypting keychain (iOS 11)

[kristian]

Just decrypted an (encrypted) iOS11 backup using backup_tool without a problem. Unfortunately decrypting the keychain afterwards using keychain_tool failed. The following error is shown on console:

Cannot decrypt backup keybag. Wrong password ?

I checked the Manifest.plist file and the "password" denoted in the file, matches my backup password. Any idea why this happens? I don't own the key835 for my device and so far I havn't gotten any idea how I should get it. Would the key835 be required to decrypt an encrypted keychain from a backup file?

Thanks & regards, Kristian

[AppleTechy]

Have you use this utility before? I essentially did the samething as you and ran into the same problem. I was decrypting an (encrypted) ios 10 backup. I used the command, python keychain_tool.py -d "/Users/dev/Desktop/extracted/KeychainDomain/keychain-backup.plist" "/Users/dev/Desktop/extracted/Manifest.plist" However the response to that command is, If you have key835 for device _______ enter it (in hex). My understanding was that the key835 wasn't required for decrypted (encrypted) backups, did I misunderstand something?

[pedropapa]

I'm having the same issue, already tried to hex my iTunes password with no luck.

[kennym]

Same issue here.

[AppleTechy]

Anyone found a work around yet? Would be much appreciated!

_{Sent with GitHawk}

[guikeese]

Same here.. trying to find some but nothing yet.. =/

[mohrt]

It looks like you'd have to jailbreak your iPhone and get the 0x835 key for YOUR device. http://www.securitylearn.net/2012/04/22/extracting-aes-keys-from-iphone/

[Commodore1024]

Key835 is required to unwrap the following security keys:
kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
kSecAttrAccessibleAlwaysThisDeviceOnly
kSecAttrAccessibleWhenUnlockedThisDeviceOnly

So any material in the keychain that is encrypted using those keys will not be decrypted.

[AdolfoPD]

Help,

I have a backup that was partially corrupted, I have the password, however the Meanifest.DB file is not cryptographed.

How to extract the data, which are cryptographed.

[lgrimani]

Wondering if the resident experts know how iOS12 changes things.

Does the ManifestKey/BackupKeybag change completely with each incremental differential backup? I tested this a few times and sometimes it doesn't change at all and sometimes some of the contents of the Keybag change but its not clear to me how and when.

Once Manifest.DB is decrypted, does each encrypted file have its own unique key that needs to be generated from Manifest.DB's Files table?

Finally, when entries are removed from the Files table, are they removed completely from the SQLite database or is it just hidden by a delete flag?

I am trying to decrypt encrypted files from one backup ago where a newer Manifest.DB/.plist has overwritten the old ones.

Thanks