6 ms·

Assuming you are referring to the San Bernardino case, that is an iPhone 5c which features an A6 series CPU. The Secure Enclave feature was introduced with the

Assuming you are referring to the San Bernardino case, that is an iPhone 5c which features an A6 series CPU. The Secure Enclave feature was introduced with the A7 [1]. [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf (page 5)

tlrobinson 11y ago
The point is, it was speculated that if the phone had a Secure Enclave it would be impossible for Apple to meet the FBI's request, but it appears that even Secure Enclave phones are vulnerable.
- threeseed 11y ago
  > but it appears that even Secure Enclave phones are vulnerable What proof is there of this ? Even reports I've heard from people at the White House believe the newer phones are simply not possible for Apple to compromise.
  - metric10 11y ago
    This appears to be true. If you look at Page 5 of [1], there's a side note about DFU mode. There's no indication that updating the firmware wipes the secure contents of the device, which it would need to in order to be secure: """ Entering Device Firmware Upgrade (DFU) mode Restoring a device after it enters DFU mode returns it to known good state with the certainty that only unmodified Apple-signed code is present. DFU mode can be entered manually: First connect the device to a computer using a USB cable, then hold down both the Home and Sleep/Wake buttons. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button. Note: Nothing will be displayed on the screen when the device is in DFU mode. If the Apple logo appears, the Sleep/Wake button was held down too long. """ [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
    - acdha 11y ago
      That doesn't say whether the Secure Enclave code can be updated, only the main phone OS.
      - metric10 11y ago
        But we agree that the Secure Enclave code CAN be updated, correct? I know that it can, because I remember an iOS update that fixed a problem with Touch ID on my iPhone 5s. If the DFU mode can't do it, then you just need to load an OS that will do it. The only question is, does the existing firmware blank the store keys before flashing the new update. I didn't see any indication that it does.
        acdha 11y ago
        It seems like it can be updated but it's not clear whether there are any restrictions on that process. It might accept any signed update but that wouldn't be enough if it required Touch ID or the phone to be unlocked to avoid clearing the HSM.
  - tlrobinson 11y ago
    Not definitive proof, but a former Apple security engineer suggests it is: https://twitter.com/JohnHedge/status/699882614212075520 https://twitter.com/JohnHedge/status/699882614212075520 A possible mitigation against the "FBI attack" (which I don't know if Apple has implemented), while still allowing SEP firmware updates, would be to have a simple routine in ROM that the SEP always runs upon boot (before running the SEP firmware blob) to verify that as hash of the firmware blob matches the one previously recorded by the SEP. If it doesn't, it could either wipe and update the hash, or refuse to boot until the previous blob is restored. When updating the firmware normally, the SEP would simply verify the user enters their pin before updating the hash. Or simply require pin entry (or wipe) for all DFU firmware updates, which seems like a much safer option.
    - HappyTypist 11y ago
      Yeah, this changes everything. It's concerning, but I feel Apple will most likely implement given recent events.
ajross 11y ago
Yes, but there was a long subthread yesterday dealing with the theoretical aspects of the case: whether it was possible for Apple to ship a phone where compliance with the kind of court order would be impossible. Lots of people felt (IMHO with poor understandings of the situation) that it was, and that a modern iPhone would never be "hackable" by the government in this way. That turns out not to be the case, for the obvious reason that Apple needs to be able to ship modified firmware for the enclave, and that modified firmware can always contain modifications to emit the encryption keys in a way that the original security metaphor wouldn't have permitted.
- sjwright 11y ago
  It would be entirely possible for the secure enclave to refuse a firmware update while the device is locked. Or as an alternative to refusing, it could ensure the NVRAM is reset in the process, rendering the encryption keys permanently lost.
  - ajross 11y ago
    Arrgh, no What you suggest is not possible if the firmware for the enclave is stored off-chip in mutable storage. Or rather, you could do it, but you'd have to hash the firmware and simply refuse to run any new firmware without a data wipe. Things like eMMC's RPMB partitions are designed to work around this (by having the transactions encrypted by a secret key stored on the SoC, generally in wrote-once fuses), but then you have the problem that you'd have to wipe all data on any firmware update, which relevant to this thread we now know is not the case. Basically: people are hanging their determination that "the iPhone is secure from government snooping by technological measures" on a completely unattested fantasy design. The real device almost certainly doesn't work like that, and even Apple hasn't claimed that it does.
    - sjwright 11y ago
      So what you're saying is it's possible, but your speculation is different to my speculation? I'm not sure it's useful to have a battle of hypotheses and assumptions couched in the language of confidence and certainty.

tlrobinson 11y ago

The point is, it was speculated that if the phone had a Secure Enclave it would be impossible for Apple to meet the FBI's request, but it appears that even Secure Enclave phones are vulnerable.

threeseed 11y ago
> but it appears that even Secure Enclave phones are vulnerable What proof is there of this ? Even reports I've heard from people at the White House believe the newer phones are simply not possible for Apple to compromise.
- metric10 11y ago
  This appears to be true. If you look at Page 5 of [1], there's a side note about DFU mode. There's no indication that updating the firmware wipes the secure contents of the device, which it would need to in order to be secure: """ Entering Device Firmware Upgrade (DFU) mode Restoring a device after it enters DFU mode returns it to known good state with the certainty that only unmodified Apple-signed code is present. DFU mode can be entered manually: First connect the device to a computer using a USB cable, then hold down both the Home and Sleep/Wake buttons. After 8 seconds, release the Sleep/Wake button while continuing to hold down the Home button. Note: Nothing will be displayed on the screen when the device is in DFU mode. If the Apple logo appears, the Sleep/Wake button was held down too long. """ [1] https://www.apple.com/business/docs/iOS_Security_Guide.pdf https://www.apple.com/business/docs/iOS_Security_Guide.pdf
  - acdha 11y ago
    That doesn't say whether the Secure Enclave code can be updated, only the main phone OS.
    - metric10 11y ago
      But we agree that the Secure Enclave code CAN be updated, correct? I know that it can, because I remember an iOS update that fixed a problem with Touch ID on my iPhone 5s. If the DFU mode can't do it, then you just need to load an OS that will do it. The only question is, does the existing firmware blank the store keys before flashing the new update. I didn't see any indication that it does.
      - acdha 11y ago
        It seems like it can be updated but it's not clear whether there are any restrictions on that process. It might accept any signed update but that wouldn't be enough if it required Touch ID or the phone to be unlocked to avoid clearing the HSM.
- tlrobinson 11y ago
  Not definitive proof, but a former Apple security engineer suggests it is: https://twitter.com/JohnHedge/status/699882614212075520 https://twitter.com/JohnHedge/status/699882614212075520 A possible mitigation against the "FBI attack" (which I don't know if Apple has implemented), while still allowing SEP firmware updates, would be to have a simple routine in ROM that the SEP always runs upon boot (before running the SEP firmware blob) to verify that as hash of the firmware blob matches the one previously recorded by the SEP. If it doesn't, it could either wipe and update the hash, or refuse to boot until the previous blob is restored. When updating the firmware normally, the SEP would simply verify the user enters their pin before updating the hash. Or simply require pin entry (or wipe) for all DFU firmware updates, which seems like a much safer option.
  - HappyTypist 11y ago
    Yeah, this changes everything. It's concerning, but I feel Apple will most likely implement given recent events.

ajross 11y ago

Yes, but there was a long subthread yesterday dealing with the theoretical aspects of the case: whether it was possible for Apple to ship a phone where compliance with the kind of court order would be impossible. Lots of people felt (IMHO with poor understandings of the situation) that it was, and that a modern iPhone would never be "hackable" by the government in this way. That turns out not to be the case, for the obvious reason that Apple needs to be able to ship modified firmware for the enclave, and that modified firmware can always contain modifications to emit the encryption keys in a way that the original security metaphor wouldn't have permitted.

sjwright 11y ago
It would be entirely possible for the secure enclave to refuse a firmware update while the device is locked. Or as an alternative to refusing, it could ensure the NVRAM is reset in the process, rendering the encryption keys permanently lost.
- ajross 11y ago
  Arrgh, no What you suggest is not possible if the firmware for the enclave is stored off-chip in mutable storage. Or rather, you could do it, but you'd have to hash the firmware and simply refuse to run any new firmware without a data wipe. Things like eMMC's RPMB partitions are designed to work around this (by having the transactions encrypted by a secret key stored on the SoC, generally in wrote-once fuses), but then you have the problem that you'd have to wipe all data on any firmware update, which relevant to this thread we now know is not the case. Basically: people are hanging their determination that "the iPhone is secure from government snooping by technological measures" on a completely unattested fantasy design. The real device almost certainly doesn't work like that, and even Apple hasn't claimed that it does.
  - sjwright 11y ago
    So what you're saying is it's possible, but your speculation is different to my speculation? I'm not sure it's useful to have a battle of hypotheses and assumptions couched in the language of confidence and certainty.