Security

Dedicated Boot ROM

The Secure Enclave includes a dedicated Secure Enclave Boot ROM. Similar to the application processor Boot ROM, the Secure Enclave Boot ROM is immutable code that establishes the hardware root of trust for the Secure Enclave. It also runs a Secure Enclave OS based on an Apple-customized version of the L4 microkernel. This Secure Enclave OS is signed by Apple, verified by the Secure Enclave Boot ROM, and updated through a personalized software update process.

When the device starts up, an ephemeral memory protection key is created by the Secure Enclave Boot ROM, entangled with the device’s unique ID (UID), and used to encrypt the Secure Enclave’s portion of the device’s memory space. Except on the Apple A7, the Secure Enclave memory is also authenticated with the memory protection key. On A11 (and newer) and S4 SoCs, an integrity tree is used to prevent replay of security-critical Secure Enclave memory, authenticated by the memory protection key and nonces stored in on-chip SRAM.

In iOS and iPadOS, when the Secure Enclave saves files to the file system, all files are encrypted with a key entangled with the UID and an anti-replay nonce. On A9 (and newer) SoCs, the anti-replay nonce uses entropy generated by the hardware random number generator. The anti-replay nonce support is rooted in a dedicated nonvolatile memory integrated circuit (IC). In Mac computers, the FileVault key hierarchy is similarly linked to the UID of the Secure Enclave.

In devices with A12 (and newer) and S4 SoCs, the Secure Enclave is paired with a secure storage IC for anti-replay nonce storage. The secure storage IC is designed with immutable ROM code, a hardware random number generator, cryptography engines, and physical tamper detection. To read and update nonces, the Secure Enclave and storage IC employ a secure protocol that ensures exclusive access to the nonces.

Hilfreich?

Apple Platform Security

Dedicated Boot ROM