Hacker News Reader

Comment by dzhiurgis | Hacker News Reader

Can't a decent shop desolder it tho?

All the data is encrypted and the key is held inside the secure enclave within the CPU. If the CPU fails then the data is unrecoverable.

That's a big ask. Probably only work the few hundred it'd take to do that, then get the data off it, if you had some super important documents // crypto wallet.

Is it really? In China you can upgrade your iPhone storage this way. Sure it's not for your average phone case store, but it's not exactly rocket science either.

Unfortunately not really a lot of places to do this in the US. And unlike shipping new devices from China to US, shipping used devices from US to China and back is prohibitively expensive.

That’s a wipe and restore type option. Because the RAM and SSD are part of the SOC chip that also includes the CPU cores, the GPU cores, etc….

So, afterwards you effectively have a new iPhone with upgraded storage. Which you then have to restore somehow.

That is, unless you can find someone who can de-lid the SOC, remove the tiny RAM and/or SDD storage chips, and replace them with new ones. But then you’d have the same problem that the data was on the old chips, and encrypted. And so you can’t just copy that data over to the new chips, you have to decrypt all the data using the key stored on the Secure Enclave and copy it out in unencrypted format, then once the old chips are removed from the SOC and replaced, you then have to copy back all that data onto those new chips and have it re-encrypted from the Secure Enclave.

Anyone who can do that could just give you a new iPhone with more storage.

Key is held on a separate chip unfortunately

encrypted by both a boot password and a secure enclave held key

And the owners of the computer can't get the key in the secure enclave? Are they part of the threat model?

“Some person with physical access to the computer” absolutely is part of the threat model.

Some person, yes. The owner, no.

The standard way you distinguish "adversary with physical possession" from "owner" is "do they have the owner's passphrase".

I am not familiar with Macs so I might have been wrong from the very start, but if the owner put the key in the secure enclave then the same user should have no problem at putting the same key in the secure enclave of another Mac. If the user can't write into the secure enclave, then the Mac is protecting the data against the very same user that is supposed to own those data. It is protecting against wrench attacks too but what's the most frequent scenario?

I mean the most frequent scenario is that the person trying to unlock the device is the one who owns it, yet we still have account passwords. You have to protect against the worst case. There is not a trusted enclave in existence (Apple, Intel, etc.) that will let you read its contents. That’s the point!

The actual key cannot be exfiltrated from the Secure Enclave. All the encryption/decryption is done inside the Secure Enclave. Knowing the owner’s password is just enough to let you pass data through the Secure Enclave to do the appropriate encryption/decryption operations.

So, you can’t copy that key over to a different Secure Enclave. If you could, then it would no longer be a Secure Enclave.

Are you suggesting that both keys should be required for decryption?

How would you restore the backup if your secure hardware device is lost/stolen/damaged?

The backup would live someplace other than on the broken machine. It would be encrypted some other way (or maybe not at all, depending on threat profile).

No point in encrypting those family photos burned to disc.

Reply on news.ycombinator.com