Hacker News Reader

Comment by bartvk | Hacker News Reader

I wonder if this has security implications. The T2 houses the "secure enclave" and that's where your private keys, certificates and passwords are stored.

View on HN

The things stored in the enclave are encrypted with a key derived from, among other things, your device password so no jailbreak is going to provide access to them.

It would be a big deal if one could, say, run 'offline' dictionary attacks against secure enclave content.

Same password results in a different hash if you run it again.

that's literally opposite to how hashing works

But with random seeds not

What you are referring too is a salt

Nope. A salt is something different. It is persistent and part of the hash result. A seed is not persistent and not part of the result. ie. it can be generated on T2 power-on.

> run 'offline' dictionary attacks against secure enclave content.

Isn't the T2 chip the only reason they can't do that:: because it sets a minimum time-limit and cooldown period on attempts to authenticate using the device passcode?

So presumably rooting T2 and removing the artificial time limits and/or extracting KDF data would mean game-over because brute-forcing `[0-9]{4,8}`, with even the most expensive hash function - and with a salted hash - can probably be done on a desktop within a day.

...but why can't we do that today by de-capping the T2 chip and looking at its flash storage with an electron-microscope?

The Secure Enclave is just a part of the T2 chip. My understanding is that this is similar to if you jailbreak your iOS device, you won't get any special access to the Secure Enclave.

And as I understand it, it's also the Secure Enclave that enforces the attempt limits.

That’s right, but the T2 chip is based on the A10 one and has the same Secure Enclave; this enclave is vulnerable to the blackbird exploit discovered recently.

De-capping would probably be much harder than rooting T2.

And both would be much harder than just holding a gun to someone's head until they give up their password.

But only one of those could potentially be stealthy enough so that target would not notice anything.

I’m surprised that iOS still doesn’t support duress passcodes.

I don't think it's just that - the design intent is for the crypto operations to run only on the device and also to depend not just on a key derived from the user password but on parameters built into the device that are not accessible to the software. Just controlling the software is not necessarily enough to take the attempts off-device.

I still don't understand why nobody seems to be able to answer the question that everybody would want to know the answer to, which is:

Is it possible to get at the encrypted user data of a locked MacBook or not?

Yes or no, please...

of course. Previously your keys are stored securely in a vault in a security facility but now the doors to the security facility is blown wide open. They still need to figure out the Secure Enclave though, which is no easy feat

It’s been largely figured out already. The actual work is going into A11’s enclave at the moment.

Reply on news.ycombinator.com