Octagon opens: bottles, iCDP records, and the trusted-device PIN
By early October the MMCS / Ford spine could rebuild an iTunes-shaped backup tree. For many ADP accounts that was still not enough: zone masters and Manatee-class material sit behind Octagon—Apple’s trust circle—not behind another MMCS range. On 5 October 2026 that layer stopped being a black box: the recoverable objects were the bottles already bound to devices that had joined the circle.
Escrowproxy get_records lists Secure Backup rows. The ones that matter for
Octagon are the iCDP labels (com.apple.icdp.record.*): each is a
bottle tied to a previously trusted device (serial, build, remaining HSM attempts). Listing
is non-destructive. Recovering is not—each wrong PIN burns one of roughly ten HSM tries
on that record.
The unlock path is device-passcode SRP, not the older PCS “dsid:dsid” secret:
SRP_INIT / RECOVER with Basic email+PET, then unwrap the
EscrowBottle plist (PBKDF2 + AES) into BottledPeerEntropy (~72 bytes). That
entropy is the hinge: with it, Cuttlefish fetchViableBottles returns OTBottle
Contents that AES-GCM-open into the peer signing/encryption keys. From there the circle can
yield the KeySet / vault material the backup decrypt path needs—recovery
through a PIN you already know for a trusted device, without inventing a new peer out of thin air.
Two caution lights stayed on after that day. First: iCDP recover is irreversible at the HSM; tooling must refuse without an explicit confirm. Second: this is the bottle path for devices already in the circle. When no bottle PIN is available, the later Recovery Key / TLKShare road (24 October) becomes the other door into the same Octagon vault.
← All notes