Apple T2 Security Chip: Security Overview [pdf]
1–10 of 99 posts
Re: Apple T2 Security Chip: Security Overview [pdf]
#2Is there anything different in the T2 chip introduced today in MacBook Air and the one in the MacBook Pro released earlier this year?
Re: Apple T2 Security Chip: Security Overview [pdf]
#3"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed."
It's interesting, I don't know if other brands do that?
Re: Apple T2 Security Chip: Security Overview [pdf]
#4Is there anything different in the T2 chip introduced today in MacBook Air and the one in the MacBook Pro released earlier this year?
Doesn't appear to be. Apple lists the MBP and iMac chips as one and the same - assume that the MBA would be added to this list. https://support.apple.com/en-us/HT208862
Re: Apple T2 Security Chip: Security Overview [pdf]
#5upvoting because I want people who know more than me about security to see and comment. :)
Re: Apple T2 Security Chip: Security Overview [pdf]
#6> line-speed encrypted storage
What does this mean?
> The Mac unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the Secure Enclave during manufacturing. No software or firmware can read the keys directly
Does anyone know the details underlying this?
Re: Apple T2 Security Chip: Security Overview [pdf]
#7> line-speed encrypted storage What does this mean? > The Mac unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the Secure Enclave during manufacturing. No software or firmware can read the keys directly Does anyone know the details underlying this?
It means that it can encrypt and decrypt data at the same speed as the interface/underlying storage. Encrypted storage doesn't slow down storage versus unencrypted usage.
Re: Apple T2 Security Chip: Security Overview [pdf]
#8One interesting point in the discussion of UEFI secure boot: it appears there is no way to boot OSes other than Mac OS and Windows without disabling secure boot entirely.
> By default, Mac computers supporting secure boot only trust content signed by Apple. However, in order to improve the security of Boot Camp installations, support for secure booting Windows is also provided. The UEFI firmware includes a copy of the Microsoft Windows Production CA 2011 certificate used to authenticate Microsoft bootloaders.
> NOTE: There is currently no trust provided for the the Microsoft Corporation UEFI CA 2011, which would allow verification of code signed by Microsoft partners. This UEFI CA is commonly used to verify the authenticity of bootloaders for other operating systems such as Linux variants.
It isn't clear whether new root CAs can be added or if there is a customer-accessible setup mode for secure boot at all.
Another part of the discussion is about the various levels of secure boot enforcement. In the default "Full Security" mode, the Mac OS setup (or Boot Camp assistant for Windows boot) requests that Apple sign the OS boot loader with a signature derived from the T2 chip's unique ID, and then the boot firmware on the T2 checks for this machine-specific signature on boot. As I understand it, Apple claims that by simply changing its online service to deny signing certain boot loaders, it can prevent many OS downgrades to versions with known vulnerabilities.
Re: Apple T2 Security Chip: Security Overview [pdf]
#9> line-speed encrypted storage What does this mean? > The Mac unique ID (UID) and a device group ID (GID) are AES 256-bit keys fused (UID) or compiled (GID) into the Secure Enclave during manufacturing. No software or firmware can read the keys directly Does anyone know the details underlying this?
I don't have any insight into the details, but I'd guess that under the hood (and not-so-under the hood) it looks and behaves a lot like a TPM
Re: Apple T2 Security Chip: Security Overview [pdf]
#10"All Mac portables with the Apple T2 Security Chip feature a hardware disconnect that ensures that the microphone is disabled whenever the lid is closed." It's interesting, I don't know if other brands do that?
Very interesting indeed.