3 ms·

The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it

by x0054 11y ago

The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.

andyjohnson0 11y ago
A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures. https://en.wikipedia.org/wiki/Bit-flipping_attack https://en.wikipedia.org/wiki/Bit-flipping_attack
- venomsnake 11y ago
  No - I meant literal bit flipping in a processor when you play tricks with ambient temperature, voltage and so on ...
venomsnake 11y ago
I know about the OS. But the key is fused, not in flash in the CPU. So they probably have cmos style persistence and not true one. Which is vulnerable to erasing. Low voltage attacks: A low-voltage fault attack is a fault attack where the fault is induced by feeding the hardware with a lower-than-normal voltage (in the "smart card" model, the card has its own CPU, RAM and ROM, but the current and clock signals are provided externally, i.e. are under the control of the attacker). For instance, if the card expect 3.3V, you give it only 2V. The real trick here is that the attacker can lower the voltage for only very short durations, a few clock cycles, so as to induce a fault in a specific part of the algorithm execution We try to get the hardware crazy. http://security.stackexchange.com/questions/69279/what-actually-happens-in-low-voltage-fault-attacks http://security.stackexchange.com/questions/69279/what-actua...
makomk 11y ago
However, its flash is supposedly not inside the processor but in the form of an external flash chip, and it's not really possible for Apple to move the flash onto the main processor because the manufacturing processes they use don't support it. That's why everyone uses one-time programmable eFuses instead.
mikeash 11y ago
There is no indication that the Secure Enclave has its own flash. I've looked everywhere, and while there are lots of hopeful people who think it should, there's no evidence that it does. If you read through Apple's security document, you'll see that the Secure Enclave achieves separation from the rest of the system by encrypting everything with keys that can't be replicated on the outside, and by having its own secure boot verification. It's possible that there's some internal storage that they just don't mention, but it doesn't look like the way to bet. This means that even devices with the Secure Enclave are still vulnerable to flash cloning. You can't understand the contents of the Secure Enclave's stuff, but you can still save and restore them once you desolder the flash. The attack described in the comment you're replying to won't work, of course. The counter is stored in the flash, so cutting power won't do anything. There was a bug where the OS would report an unlock failure before updating the flash memory, so if you were quick to cut the power you could bypass the counter, but that's been fixed. What does work (in theory) is to desolder the flash and hook it up so you can save and restore its contents. Then you turn on the phone, try a few passcodes, shut down, restore flash to original state, repeat until success. Of course, this only works if the passcode is simple enough that a brute force is feasible. You can attack a four-digit passcode in a few days this way. A six-digit passcode would take maybe a year, and proper passphrase would still be completely infeasible.

by x0054 11y ago

The Secure Enclave does have it's own flash, it apparently even has it's own OS. What do you mean by bit flip attack? I am actually really interested in how it would be possible.

andyjohnson0 11y ago

A bit flipping attack is where a change to the cyphertext results in a predictable change to the (decrypted) plaintext [1]. Re venomsnake's comment, I'm not sure how this applies to the secure enclave though, or the relevance of low temperatures. https://en.wikipedia.org/wiki/Bit-flipping_attack https://en.wikipedia.org/wiki/Bit-flipping_attack

venomsnake 11y ago
No - I meant literal bit flipping in a processor when you play tricks with ambient temperature, voltage and so on ...

venomsnake 11y ago

I know about the OS. But the key is fused, not in flash in the CPU. So they probably have cmos style persistence and not true one. Which is vulnerable to erasing. Low voltage attacks: A low-voltage fault attack is a fault attack where the fault is induced by feeding the hardware with a lower-than-normal voltage (in the "smart card" model, the card has its own CPU, RAM and ROM, but the current and clock signals are provided externally, i.e. are under the control of the attacker). For instance, if the card expect 3.3V, you give it only 2V. The real trick here is that the attacker can lower the voltage for only very short durations, a few clock cycles, so as to induce a fault in a specific part of the algorithm execution We try to get the hardware crazy. http://security.stackexchange.com/questions/69279/what-actually-happens-in-low-voltage-fault-attacks http://security.stackexchange.com/questions/69279/what-actua...

makomk 11y ago

However, its flash is supposedly not inside the processor but in the form of an external flash chip, and it's not really possible for Apple to move the flash onto the main processor because the manufacturing processes they use don't support it. That's why everyone uses one-time programmable eFuses instead.

mikeash 11y ago

There is no indication that the Secure Enclave has its own flash. I've looked everywhere, and while there are lots of hopeful people who think it should, there's no evidence that it does. If you read through Apple's security document, you'll see that the Secure Enclave achieves separation from the rest of the system by encrypting everything with keys that can't be replicated on the outside, and by having its own secure boot verification. It's possible that there's some internal storage that they just don't mention, but it doesn't look like the way to bet. This means that even devices with the Secure Enclave are still vulnerable to flash cloning. You can't understand the contents of the Secure Enclave's stuff, but you can still save and restore them once you desolder the flash. The attack described in the comment you're replying to won't work, of course. The counter is stored in the flash, so cutting power won't do anything. There was a bug where the OS would report an unlock failure before updating the flash memory, so if you were quick to cut the power you could bypass the counter, but that's been fixed. What does work (in theory) is to desolder the flash and hook it up so you can save and restore its contents. Then you turn on the phone, try a few passcodes, shut down, restore flash to original state, repeat until success. Of course, this only works if the passcode is simple enough that a brute force is feasible. You can attack a four-digit passcode in a few days this way. A six-digit passcode would take maybe a year, and proper passphrase would still be completely infeasible.