> An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. Sure they can, they have everything need

> An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service. Sure they can, they have everything needed to prove to Apple's servers that they're a real iPhone since pulling the keys means they have the cryptographic root of trust, and Apple's servers will happily be a signature oracle for them in that case. > When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest. And when you know what is measured into those manifests and the keys at the root of trust you can manufacture those too. The entire scheme is dependent on not being able to extract device specific keys. At the end of the day, those are almost certainly efuses burnt based on a on-chip HRNG as a manufacturing step which is intended to never leave the device, but instead only signatures and associated public keys. But when you have chip development hardware of the kind you'd have at a decent fabless semiconductor company, you can very clearly see burnt efuses.