3 ms·
I would think the Secure Enclave would handle such things. That said I’m not sure what you or GP mean by “update exclave”. It’s just part of the kernel binary
by MBCook 2y ago
I would think the Secure Enclave would handle such things.
That said I’m not sure what you or GP mean by “update exclave”. It’s just part of the kernel binary loaded up at system start. Wouldn’t it be updated the same way the rest of the kernel is, probably requiring a restart?
- brookst 2y agoNo, because that way a rogue kernel could overwrite the exclave itself and the next reboot would be insecure. You can’t trust a low-trust environment to update a high-trust environment.
- MBCook 2y agoIs that why everything is cryptographically secured in the boot chain? To ensure only trusted code is loaded?
- kennysoona 2y agoExactly.