Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

hackaday.com

Post reply on HN
Print view View original

11–20 of 38 posts

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#11

Post by ikawe »

DennisP wrote: post #9
ikawe wrote: post #8

Earlier quoted context omitted.

It does more than that. From the [ios security guide]: > The Secure Enclave provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised. e.g. you can encrypt and decrypt, referencing a key by id, but without having the private key ever leave the enclave, even if the app or iOS kernel gets compromised. [ios security gui…

Sounds like basically what a cryptocurrency hardware wallet does. Several months ago I saw a project making wallet software that used the enclave. I forget who they were but I think they'll have a hard sell; everyone just reflexively assumed it was insecure because it was on a phone.

And yet you’d be hard pressed to do worse than any mainstream desktop OS.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#12

Post by kbenson »

CapacitorSet wrote: post #5
rubyfan wrote: post #4

Earlier quoted context omitted.

> unless you don’t understand how Apple’s Secure Enclave Processor (SEP) works. So basically it’s only misleading to 99.9999% of people?

Not on HN, where I expect most readers to understand what is firmware and what happens when you have its binaries and/or source code.

I think the best you can hope for, even here, is that the majority says "from the headline I'm not sure what that means in practice, so I'll reserve judgment until I look into this."

And even that's a tall order.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#13

Post by iancarroll »

DennisP wrote: post #9
ikawe wrote: post #8

Earlier quoted context omitted.

It does more than that. From the [ios security guide]: > The Secure Enclave provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised. e.g. you can encrypt and decrypt, referencing a key by id, but without having the private key ever leave the enclave, even if the app or iOS kernel gets compromised. [ios security gui…

Sounds like basically what a cryptocurrency hardware wallet does. Several months ago I saw a project making wallet software that used the enclave. I forget who they were but I think they'll have a hard sell; everyone just reflexively assumed it was insecure because it was on a phone.

Indeed, cryptocurrency hardware wallets and the SEP are basically just HSMs (hardware security modules).

It's unfortunate people would draw negative connotations from it being on a mobile device. The security architecture of iOS and the SEP combined with the relatively wide deployment of iPhones makes for a great number of use cases.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#14

Post by yyzhero »

iancarroll wrote: post #13
DennisP wrote: post #9

Earlier quoted context omitted.

Sounds like basically what a cryptocurrency hardware wallet does. Several months ago I saw a project making wallet software that used the enclave. I forget who they were but I think they'll have a hard sell; everyone just reflexively assumed it was insecure because it was on a phone.

Indeed, cryptocurrency hardware wallets and the SEP are basically just HSMs (hardware security modules). It's unfortunate people would draw negative connotations from it being on a mobile device. The security architecture of iOS and the SEP combined with the relatively wide deployment of iPhones makes for a great number of use cases.

The secure enclave uses secp256r1 while blockchain typically use secp256k1. Since private keys can't be imported, blockchain devs still require software interface until one or the others adopts the scheme.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#15

Post by abalone »

> It’s a black box that we’re not supposed to know anything about

Nope. Apple published a whitepaper that details how the SEP works.[1] Decrypting the firmware does help researchers look for vulnerabilities in the implementation, but it's not like Apple is relying on it being a black box.

[1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#19

Post by Cyph0n »

abalone wrote: post #15

> It’s a black box that we’re not supposed to know anything about Nope. Apple published a whitepaper that details how the SEP works.[1] Decrypting the firmware does help researchers look for vulnerabilities in the implementation, but it's not like Apple is relying on it being a black box. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Can you point out the section in that whitepaper that describes SEP in detail? Because all I see is a high-level marketing document.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#20

Post by userbinator »

ikawe wrote: post #8
nateberkopec wrote: post #6

The link makes it sound like SEP only handles TouchID - is this true, or does the SEP also deal with passcodes?

It does more than that. From the [ios security guide]: > The Secure Enclave provides all cryptographic operations for Data Protection key management and maintains the integrity of Data Protection even if the kernel has been compromised. e.g. you can encrypt and decrypt, referencing a key by id, but without having the private key ever leave the enclave, even if the app or iOS kernel gets compromised. [ios security gui…

That sounds like what's essentially a TPM.
Post reply on HN