3 ms·
More recent ARM chips (A9+) come bundled with ARM TrustZone[1]. In a nutshell, the processor has two (hardware) isolated execution environments each running a d
by Cyph0n 10y ago
More recent ARM chips (A9+) come bundled with ARM TrustZone[1]. In a nutshell, the processor has two (hardware) isolated execution environments each running a different OS and different software. By default, the secure environment of TrustZone runs an L4 kernel (edit: this is incorrect, see reply below).
Could it be the case that Apple is leveraging TrustZone but with a customized L4 kernel? Or is it confirmed that the Secure Enclave is a custom IC designed by Apple? I wouldn't be surprised if it's the former as it becomes much cheaper to implement the required security features.
Edit: Check out this previous discussion on this exact topic: https://news.ycombinator.com/item?id=8410700 https://news.ycombinator.com/item?id=8410700
[1]: https://www.arm.com/products/security-on-arm/trustzone https://www.arm.com/products/security-on-arm/trustzone
- CalChris 10y agoTrustZone was announced 2012 (?). The Security Enclave is a separate very Apple designed chip. They've patented aspects of it, dated also 2012: https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-Demystifying-The-Secure-Enclave-Processor.pdf https://www.blackhat.com/docs/us-16/materials/us-16-Mandt-De... https://www.google.com/patents/US8832465 https://www.google.com/patents/US8832465
- bryanbuckley 10y ago> TrustZone was announced 2012 No, 2012 was when Trustonic was formed from competing TEE vendors: ARM, Gemalto, and Giesecke & Devrient. TrustZone has been around since before that. TI OMAP were front-runners of using it.
- bryanbuckley 10y ago> By default, the secure environment of TrustZone runs an L4 kernel. By default no SW runs on HW. "Mobicore" (now called "Kinibi" from Trustonic) is based on L4.
- Cyph0n 10y agoI know that mate, no need to get snarky. What I meant is that it was bundled with the core by default, but thanks for the correction. I thought I read it somewhere, but judging by a quick search, it seems I'm mistaken.
- bryanbuckley 10y agoDepends on the HW manufacturer and SKU on what is bundled or not.. Even ROM code can be different per SKU.