4 ms·
Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for exam
by philistine 6y ago
Does this mean that the Secure Enclave is accessible by the user? If so, it prompts so many questions. How much disk space is available on the Enclave, for example.
- lunixbochs 6y agoYou don’t actually need to store Secure Enclave protected data in the enclave. Can “wrap” it with the enclave’s key and store it on your own disk.
- GekkePrutser 6y agoThis is not what it does though. It says the private key can't be exported, and this wouldn't be the case if it was just a regular SSH keyfile encrypted using the Enclave's key.
- acdha 6y agoYou can ask the Secure Enclave or a smart card to perform operations using a key pair which is generated on and never leaves the device. In the case of SSH, you can use that directly as long as your SSH client and server support that algorithm: the client advertises the key fingerprint and just passes the server’s challenge through without modification. Apple has had native support built-in for using PIV/CAC tokens for years. For storing arbitrary sized things, you’d typically use that key pair to sign an AES key used to encrypt the actual file so your device only needs to store the comparatively small keys.
- dchest 6y agoUnwrapping it puts the private key into memory, from which it can be extracted (it’s hard, of course, but looking at the state of Intel security, everything is possible). Secure Enclave is supposed to sign with non-extractable private key without putting it into RAM.
- bdcravens 6y agoTotally a tangent, but it's interesting that we still refer to things as "disk space" even in the era of flash storage
- philistine 6y agoI know! But I wanted to write something very clear, and I chose the clearest word in my mind to convey my idea. That word is steeped in old tech, it so happens. Oh and by the way, I was shopping for a cheap laptop for a non-profit this week, and I still had to be careful to pick a laptop with an SSD. Those spinning horrors are still jammed into laptop cases to this day.
- epistasis 6y agoI wonder what a better term for disk storage would be. Block storage, in the way that cloud services refer to it? Just plain "storage"?
- jbverschoor 6y agoNon Volatile Memory Volatile Memory gets “erased” when powered off
- epistasis 6y agoAccurate, and in usage in technical circles already. But I've always found it awkward, and names based on what something is not are always unsettling to me.
- jbverschoor 6y agoThen just Memory. That’s what elderly and nontechies usually call it. And it’s correct. Even more correct with always-on-computing and automatic state saving
- saagarjha 6y agoWait until people confuse that with NVRAM.
- techslave 6y agothanks for not saying ‘begs’. no, the secure enclave is not available to the user as such. a few crypto primitives are exported. that’s what this uses. there have been any number of such “agents” over the last few years.
- morpheuskafka 6y agoThere is an API to store custom keys in the Secure Enclave. It only supports 256-bit ECC keys and the private keys cannot be read or written, only operated on by the Enclave itself. There is no official storage limit, it seems, but one Stack Overflow answer put the number at around 400. Interestingly, there appears to be no quota system for preventing one app from using them all.
- almostdigital 6y agoNot sure about how much is actually available but you can generate about 1000 keypairs before it starts to throw errors at you