Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

hackaday.com

Post reply on HN
Print view View original

21–30 of 38 posts

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#21

Post by geofft »

CapacitorSet wrote: post #5
rubyfan wrote: post #4

Earlier quoted context omitted.

> unless you don’t understand how Apple’s Secure Enclave Processor (SEP) works. So basically it’s only misleading to 99.9999% of people?

Not on HN, where I expect most readers to understand what is firmware and what happens when you have its binaries and/or source code.

Even if you understand firmware (which I wouldn't expect of most readers, just some; the reason we develop abstractions is so our fellow hackers can hack on new things instead of studying the same things we already studied and hacked), it's extremely common for companies that keep security software secret to rely on that secrecy for security. You need to understand the Secure Enclave in particular and believe that the Apple folks are both talented and honest enough to implement what they say they're implementing to know that, in this case, that's not what's happening.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#22

Post by slim »

LeoPanthera wrote: post #2

August 18, 2017 Also, don't be mislead by the headline. To quote a comment on the article: "Imagine the Secure Enclave as a vault. Apple hung a big, dark curtain over it to prevent anyone from even seeing the vault. Now, that curtain has been opened and people can see the vault. The vault, however, is still locked as securely as ever."

Actually the sentence you've chosen is misleading. This is the essential step towards breaking the iPhone open. The next steps will be less news worthy, til we get a jail break

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#23

Post by c22 »

LeoPanthera wrote: post #2

August 18, 2017 Also, don't be mislead by the headline. To quote a comment on the article: "Imagine the Secure Enclave as a vault. Apple hung a big, dark curtain over it to prevent anyone from even seeing the vault. Now, that curtain has been opened and people can see the vault. The vault, however, is still locked as securely as ever."

Isn't it more like getting the plans to the vault?

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#24

Post by abalone »

Cyph0n wrote: post #19
abalone wrote: post #15

> It’s a black box that we’re not supposed to know anything about Nope. Apple published a whitepaper that details how the SEP works.[1] Decrypting the firmware does help researchers look for vulnerabilities in the implementation, but it's not like Apple is relying on it being a black box. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Can you point out the section in that whitepaper that describes SEP in detail? Because all I see is a high-level marketing document.

Says the PhD candidate in hardware security. You may want more low-level details but it's inaccurate characterize it as "marketing". That's just snark. It presents numerous details on the implementation of the SEP throughout the document.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#26

Post by runeks »

c22 wrote: post #23
LeoPanthera wrote: post #2

August 18, 2017 Also, don't be mislead by the headline. To quote a comment on the article: "Imagine the Secure Enclave as a vault. Apple hung a big, dark curtain over it to prevent anyone from even seeing the vault. Now, that curtain has been opened and people can see the vault. The vault, however, is still locked as securely as ever."

Isn't it more like getting the plans to the vault?

It’s more like acquiring knowledge of the mechanics of a safe dial lock: if the mechanism exposes a safe interface, it doesn’t matter. Only if there’s a flaw in the inner workings of the lock, that an attacker can exploit from the outside, does it pose a problem.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#27

Post by bluesign »

yyzhero wrote: post #14
iancarroll wrote: post #13

Earlier quoted context omitted.

Indeed, cryptocurrency hardware wallets and the SEP are basically just HSMs (hardware security modules). It's unfortunate people would draw negative connotations from it being on a mobile device. The security architecture of iOS and the SEP combined with the relatively wide deployment of iPhones makes for a great number of use cases.

The secure enclave uses secp256r1 while blockchain typically use secp256k1. Since private keys can't be imported, blockchain devs still require software interface until one or the others adopts the scheme.

I think use case for blockchain will be private key derived from a key stored in secured enclave. Which is not the ideal case of course.

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#29

Post by johneth »

Cyph0n wrote: post #19
abalone wrote: post #15

> It’s a black box that we’re not supposed to know anything about Nope. Apple published a whitepaper that details how the SEP works.[1] Decrypting the firmware does help researchers look for vulnerabilities in the implementation, but it's not like Apple is relying on it being a black box. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf

Can you point out the section in that whitepaper that describes SEP in detail? Because all I see is a high-level marketing document.

There's a video of a presentation by Ivan Krstic (head of security engineering, Apple) at Black Hat from 2016 about iOS security: https://www.youtube.com/watch?v=BLGFriOKz6U

Re: Apple’s Secure Enclave Processor (SEP) Firmware Decrypted

#30

Post by DennisP »

yyzhero wrote: post #14
iancarroll wrote: post #13

Earlier quoted context omitted.

Indeed, cryptocurrency hardware wallets and the SEP are basically just HSMs (hardware security modules). It's unfortunate people would draw negative connotations from it being on a mobile device. The security architecture of iOS and the SEP combined with the relatively wide deployment of iPhones makes for a great number of use cases.

The secure enclave uses secp256r1 while blockchain typically use secp256k1. Since private keys can't be imported, blockchain devs still require software interface until one or the others adopts the scheme.

Ah, too bad. Ethereum is supposed to be adding signature abstraction, so you can use whatever signature scheme you want; maybe using secp256r1 with phones would be a good application of that.
Post reply on HN