That's a great read, still reading it now. I wish it was more specific about how the Secure Enclave times the period between passwords, however. There are 2 way

That's a great read, still reading it now. I wish it was more specific about how the Secure Enclave times the period between passwords, however. There are 2 ways to do it, as I see it: 1. One way would be for the SE to have it's own clock function. 2. The other would be for the SE to send a message to the main CPU and ask the CPU to let it know when x number of seconds has passed. I believe that second option is more likely because of the way the feature works. On full phone reset it restarts the timeout period rather than continue it from where it was. This could be a feature, of course. But I am guessing that the way it works is that the SE asks the System to tell it when x seconds / min has past and sets a timeoutExpired flag to false. Once it get's the notification that the time has passed, it resets the flag to true. If above is how it works, than screwing around with the System clock could be effective. If the system relies on system time, then it might be possible to shift the clock by doing adjustment through a fake cell tower. Not sure how effective that would be. Just some thoughts really. Would be interesting to see if they can unlock the iPhone 6 or not.