FBI didn't demand help with that layer, it demanded a way to bypass auto erase. They intended to perform the brute force of the 4 digit PIN themselves. Sure, they wanted to be able to enter PINs electronically, but they could just as easily have an intern sit there and enumerate the 1000 combinations once auto erase was disabled.
That was a timing weakness in an older version of iOS that was patched in software. Previously you could just cut power at a precise monent and get unlimited attempts. It's no longer exploitable.
Yes you can, if you sync the commit to NVRAM before giving any external indication of success/failure, and don't leak through any side-channels. The CVE before demo'd by the famous youtube video was that you had a split second after failure was indicated where you could cut the power and keep the failure from being stored.
Many of the reports in the press were saying it was a 4-digit pin. But it's feasible even to brute force a six-digit PIN in the way I described, it would just take several weeks.
I use a larger than 8 digit pass code on my iphone. It looks different.
Using a default 4 digit code, you end up with a numeric pad and four boxes. If you use a longer than 4 digit code but stick with numbers, it gives a single box to enter the pass code in but presents a numeric pad. If you use letters at all, it switches to a qwerty-ish keyboard and a single box to enter the pass code.
