3 ms·

Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do

Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images.

autoexec 10d ago
The NSA has probably already forced Apple to hand the keys over to them.
- propaganja 10d ago
  Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general. We already know it's happening right now, and they know we know, but we can't do shit about it.
  - alwillis 10d ago
    > Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general. I'm aware. The point is they can't give the NSA something they don't have. The photo sensor generates its own ECDSA P-256 signing key pair and never releases the private half. Every device has a unique key pair and the private key is unavailable… there's not a way to give the NSA that would help them. The system is setup so that the image data, meta data, etc can't be accessed by anyone including Apple.
    - microtonal 9d ago
      I believe them, but the process is hard to check. How do we verify that they don’t have the sensor burn in a private key generated by them? (Similar to how many PGP hardware keys allow generating a private key on-device or writing your own provided key.)
  - alwillis 9d ago
    Here's a flow chart; tell us at what point there's something Apple can be compelled by a 3-letter organization to produce: https://news.ycombinator.com/item?id=49735284 https://news.ycombinator.com/item?id=49735284
    - microtonal 9d ago
      I think the chart exactly shows the weakness that some people have pointed out. Apple's PCC servers at some point in time know the signing identity for a photo and Apple's generated replacement signature. The relevant steps from your chart: - verifies each link and its certificate chain, sensor signature over pixels, SEP signature, device manifest signature - PCC Submits the commitment (the JPEG hash) to Apple's signing service. So, at some point in time, Apple's servers have both the original certificate chain and the new replacement signature. If this is recorded, Apple can deanonimize photos and check whether two photos were from the same device/sensor. Apple's system protects against most state actors, except Apple and the US, unless you fully trust that their PCC is watertight. (Remember that Apple was part of PRISM and probably also its successor.) I don't think law enforcement needs it, because when sending/posting a picture, people leak so much metadata anyway. But people outside the US should certainly distrust these systems.
- alwillis 10d ago
  > The NSA has probably already forced Apple to hand the keys over to them. Again, that's not how it works. There's no set of keys and certificates they could give to the NSA. Every iPhone 18 Pro and Pro Max has a unique set of cryptographic keys, most of which can't be accessed by Apple. The first thing that happens is when photo sensor is initialized at the factory, it creates its own ECDSA P-256 signing key pair; the private key is never disclosed. The public key is signed by the factory's certificate authority. This ain't X.509 where VeriSign's key pair is sitting in a HSM at their HQ and in theory could be forced to sign a fraudulent certificate or revoke someone's valid website certificate.
  - microtonal 9d ago
    They don’t need the signing keys though. Apple could roll out a separate version of sepOS to assist law enforcement that signs at they will. Also, while the unique device ID is supposed to be burned into fuses by the SE during production, it is kinda hard to prove for anyone that is not Apple that this indeed happens in the way they state. Personally I’m not a strong believer in such theories though. I think it’s more mundane and Apple helps law enforcement by having some weak defaults. Like how iMessage is end-to-end encrypted, but most chats are available to law enforcement because most people turn on iCloud Backups/Messages in iCloud and not ADP, resulting in chats only being encrypted at-rest in iCloud. This is only stated somewhere in a footnote in one of their security documents. There are more weak defaults like that in various crucial apps (e.g. WhatsApp) that makes most important stuff available to law enforcement when needed.
alwillis 10d ago
> Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images. That's not how this works. Let's pretend they're able to extract the sensor key and the SEP key. Then what? An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest. More encryption and checking happens until the secure digital negative is sent to Private Cloud Compute: PCC recomputes the digest embedded in the frame and verifies the sensor's signature over the pixels and that digest, verifying the certificate chain back to the sensor CA. PCC also verifies the SEP signature and chains it to the BAA CA, and it verifies the signature on the device manifest and chains it to the CA that signs device manifests at the factory. It then confirms that the sensor and SEP named in those chains belong to the same device. Only if all these checks pass does processing continue. Only PCC can create an Apple Reference Image; an attacker having the image and sensor private keys doesn't enable them to create a reference image.
- monocasa 10d ago
  > An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. Sure they can, they have everything needed to prove to Apple's servers that they're a real iPhone since pulling the keys means they have the cryptographic root of trust, and Apple's servers will happily be a signature oracle for them in that case. > When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest. And when you know what is measured into those manifests and the keys at the root of trust you can manufacture those too. The entire scheme is dependent on not being able to extract device specific keys. At the end of the day, those are almost certainly efuses burnt based on a on-chip HRNG as a manufacturing step which is intended to never leave the device, but instead only signatures and associated public keys. But when you have chip development hardware of the kind you'd have at a decent fabless semiconductor company, you can very clearly see burnt efuses.

autoexec 10d ago

The NSA has probably already forced Apple to hand the keys over to them.

propaganja 10d ago
Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general. We already know it's happening right now, and they know we know, but we can't do shit about it.
- alwillis 10d ago
  > Apple would be legally restricted from disclosing any government compromises, while still claiming their systems are secure and operating as intended in general. I'm aware. The point is they can't give the NSA something they don't have. The photo sensor generates its own ECDSA P-256 signing key pair and never releases the private half. Every device has a unique key pair and the private key is unavailable… there's not a way to give the NSA that would help them. The system is setup so that the image data, meta data, etc can't be accessed by anyone including Apple.
  - microtonal 9d ago
    I believe them, but the process is hard to check. How do we verify that they don’t have the sensor burn in a private key generated by them? (Similar to how many PGP hardware keys allow generating a private key on-device or writing your own provided key.)
- alwillis 9d ago
  Here's a flow chart; tell us at what point there's something Apple can be compelled by a 3-letter organization to produce: https://news.ycombinator.com/item?id=49735284 https://news.ycombinator.com/item?id=49735284
  - microtonal 9d ago
    I think the chart exactly shows the weakness that some people have pointed out. Apple's PCC servers at some point in time know the signing identity for a photo and Apple's generated replacement signature. The relevant steps from your chart: - verifies each link and its certificate chain, sensor signature over pixels, SEP signature, device manifest signature - PCC Submits the commitment (the JPEG hash) to Apple's signing service. So, at some point in time, Apple's servers have both the original certificate chain and the new replacement signature. If this is recorded, Apple can deanonimize photos and check whether two photos were from the same device/sensor. Apple's system protects against most state actors, except Apple and the US, unless you fully trust that their PCC is watertight. (Remember that Apple was part of PRISM and probably also its successor.) I don't think law enforcement needs it, because when sending/posting a picture, people leak so much metadata anyway. But people outside the US should certainly distrust these systems.
alwillis 10d ago
> The NSA has probably already forced Apple to hand the keys over to them. Again, that's not how it works. There's no set of keys and certificates they could give to the NSA. Every iPhone 18 Pro and Pro Max has a unique set of cryptographic keys, most of which can't be accessed by Apple. The first thing that happens is when photo sensor is initialized at the factory, it creates its own ECDSA P-256 signing key pair; the private key is never disclosed. The public key is signed by the factory's certificate authority. This ain't X.509 where VeriSign's key pair is sitting in a HSM at their HQ and in theory could be forced to sign a fraudulent certificate or revoke someone's valid website certificate.
- microtonal 9d ago
  They don’t need the signing keys though. Apple could roll out a separate version of sepOS to assist law enforcement that signs at they will. Also, while the unique device ID is supposed to be burned into fuses by the SE during production, it is kinda hard to prove for anyone that is not Apple that this indeed happens in the way they state. Personally I’m not a strong believer in such theories though. I think it’s more mundane and Apple helps law enforcement by having some weak defaults. Like how iMessage is end-to-end encrypted, but most chats are available to law enforcement because most people turn on iCloud Backups/Messages in iCloud and not ADP, resulting in chats only being encrypted at-rest in iCloud. This is only stated somewhere in a footnote in one of their security documents. There are more weak defaults like that in various crucial apps (e.g. WhatsApp) that makes most important stuff available to law enforcement when needed.

alwillis 10d ago

> Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images. That's not how this works. Let's pretend they're able to extract the sensor key and the SEP key. Then what? An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest. More encryption and checking happens until the secure digital negative is sent to Private Cloud Compute: PCC recomputes the digest embedded in the frame and verifies the sensor's signature over the pixels and that digest, verifying the certificate chain back to the sensor CA. PCC also verifies the SEP signature and chains it to the BAA CA, and it verifies the signature on the device manifest and chains it to the CA that signs device manifests at the factory. It then confirms that the sensor and SEP named in those chains belong to the same device. Only if all these checks pass does processing continue. Only PCC can create an Apple Reference Image; an attacker having the image and sensor private keys doesn't enable them to create a reference image.

monocasa 10d ago
> An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. Sure they can, they have everything needed to prove to Apple's servers that they're a real iPhone since pulling the keys means they have the cryptographic root of trust, and Apple's servers will happily be a signature oracle for them in that case. > When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest. And when you know what is measured into those manifests and the keys at the root of trust you can manufacture those too. The entire scheme is dependent on not being able to extract device specific keys. At the end of the day, those are almost certainly efuses burnt based on a on-chip HRNG as a manufacturing step which is intended to never leave the device, but instead only signatures and associated public keys. But when you have chip development hardware of the kind you'd have at a decent fabless semiconductor company, you can very clearly see burnt efuses.