iphone 5s touch idA hacker released what he claimed to be a firmware decryption key for Apple's Secure Enclave on Thursday, initially sparking fears that iOS security had been compromised.

Apple's Secure Enclave Processor (SEP) handles all cryptographic operations for the Apple Watch Series 2, the A7 processor that powers the iPhone 5s, the iPad Air, the iPad mini 2 and 3, and subsequent A-series chips. The encrypted SEP is completely isolated from the rest of the system and handles Touch ID transactions, password verifications, and other security processes on a separate OS to maintain data protection integrity even if the kernel has been compromised.

One of the ways the SEP does this is by generating a Unique ID (UID) for each device for authentication purposes. The UID automatically changes every time a device is rebooted and remains unknown to other parts of the system, further enhancing its security.

Beyond that, little is known about how the SEP actually works outside of Apple, but that's by design – the enclave's isolation serves to obfuscate it from the rest of the system, preventing hackers from rifling through its code to make it as secure as possible.


The decryption key posted on GitHub yesterday would not enable hackers to access data stored inside the Secure Enclave, but it could allow hackers and security researchers to decrypt the firmware that controls it and potentially spot weaknesses in the code.

Speaking to TechRepublic, the hacker that released the key claimed that Apple's effort to obfuscate the code was itself cause for concern.

"The fact that the SEP was hidden behind a key worries me," said xerub. "Is Apple not confident enough to push SEP decrypted as they did with kernels past iOS 10?" He added that while SEP is amazing tech the fact that it's a "black box" adds very little, if anything to security. "Obscurity helps security — I'm not denying that," he said, but added that relying on it for security isn't a good idea.

"I think public scrutiny will add to the security of SEP in the long run," xerub said, noting that was also his intention with releasing the key.

Xerub claimed it's theoretically possible that the decryption key could be used to watch the SEP do its work, which could potentially allow hackers to reverse-engineer its process and gain access to its contents, including passwords and fingerprint data. However, he admitted that a lot of additional work would need to go into exploiting the decrypted firmware.

It's still unclear what the longer term repercussions could be, but an Apple source who wished to remain anonymous told TechRepublic that the release of the SEP key doesn't directly compromise customer data.

"There are a lot of layers of security involved in the SEP, and access to firmware in no way provides access to data protection class information," they said. "It's not an easy leap to say it would make getting at customer data possible."

More accurately, it makes research into the structure of the SEP possible, which could allow hackers to find flaws in its workings. Apple said it did not plan to roll out a fix at this time.

Top Rated Comments

RichTF Avatar
86 months ago
This is why good security generally involves lots of layers, the "onion" strategy. Getting past one layer is a problem, but not one that (in isolation) is a meaningful security breach.

Another way to think of it — The SEP came out with the iPhone 5s 4 years ago. So this encryption layer has prevented 4 years worth of hacking attempts on the deeper layers, which is time Apple has most likely been spending improving those layers. It might also be possible for Apple to re-apply this outer layer in subsequent iPhones, or maybe even with a firmware patch, thereby resetting the clock again.

So yeah, it's unfortunate that it's been hacked, but I still feel relaxed about my iPhone's security.
Score: 19 Votes (Like | Disagree)
Kabeyun Avatar
86 months ago
As far as privacy and security go, I still sleep just fine at night in Apple's ecosystem.
Score: 10 Votes (Like | Disagree)
Northgrove Avatar
86 months ago
"Obscurity helps security — I'm not denying that," he said, but added that relying on it for security isn't a good idea.
No, it is not, but am I missing something here or is there no indication Apple is doing that? Just because they have now _added_ a layer of security doesn't imply that they're _relaxing_ another layer of security and not taking auditing their SEP code seriously?

I am absolutely certain that Apple's security experts have heard of the saying "Security through obscurity" and its fallacies... It is a fallacy to replace one with the other, but not use both in tandem.
Score: 7 Votes (Like | Disagree)
apolloa Avatar
86 months ago
It's only a matter of time, but this is what you get when hackers and script kiddies are never jailed for their crimes, hack the defence networks oh sure jail you, hack a mass market consumer device or steal millions of people's details and passwords then you get a slapped wrist, and a nicely paid job in a security firm....
Score: 7 Votes (Like | Disagree)
rtomyj Avatar
86 months ago
Only going to help the users out but;

How does he criticize apple for obfuscation of the SEP (makes it hard to read) claiming that Apple doesn't have confidence in it being uncrypted like it's kernels but then adds that right now there's no way of knowing if obfuscation is the only form of security. How can you criticize obfuscation as Apples plan for hackers when you don't know if that's all they do....
Score: 6 Votes (Like | Disagree)
thefourthpope Avatar
86 months ago
I'm going to go out on a limp and say . . .
Apropos of nothing, I love this typo.
Score: 5 Votes (Like | Disagree)

Popular Stories

iPhone 16 Camera Lozenge 2 Perspective Gray

Five Key Upgrades Coming to iPhone 16

Friday March 15, 2024 1:45 pm PDT by
The iPhone is Apple's top-selling product, and it gets an update every year. In 2024, we're expecting the iPhone 16 and iPhone 16 Pro lineup, with an arguably more interesting feature set than we got with the iPhone 15 and iPhone 15 Pro. Subscribe to the MacRumors YouTube channel for more videos. Capture Button All four iPhone 16 models are set to get a whole new button, which will be...
iphone se 4 modified flag edges

iPhone SE 4 Expected to Depreciate Heavily

Tuesday March 12, 2024 9:04 am PDT by
Resale value trends suggest the iPhone SE 4 may not hold its value as well as Apple's flagship models, according to SellCell. According to the report, Apple's iPhone SE models have historically depreciated much more rapidly than the company's more premium offerings. The third-generation iPhone SE, which launched in March 2022, experienced a significant drop in resale value, losing 42.6%...
apple wallet drivers license feature

Apple Said iPhone Driver's Licenses Would Expand to These 8 U.S. States… Two Years Ago

Thursday March 14, 2024 7:33 am PDT by
In just four U.S. states, residents can add their driver's license or ID to the Apple Wallet app on the iPhone and Apple Watch, providing a convenient and contactless way to display proof of identity or age at select airports, businesses, and venues. Adoption of the feature has been slow since Apple first announced it in September 2021, with IDs in the Wallet app only available in Arizona,...
airpods 3 orange

Two New AirPods 4 Models Expected to Launch in September or October

Sunday March 17, 2024 7:56 am PDT by
Apple suppliers will begin production of two new fourth-generation AirPods models in May, according to Bloomberg's Mark Gurman. Based on this production timeframe, he expects the headphones to be released in September or October. Gurman expects both fourth-generation AirPods models to feature a new design with better fit, improved sound quality, and an updated charging case with a USB-C...
OLED iPad Air

iPad Air Next on Apple's OLED Tablet Roadmap Following iPad Pro

Friday March 15, 2024 3:30 am PDT by
The iPad Air will be the next Apple tablet to adopt OLED display panel technology following its upcoming OLED iPad Pro models, according to an updated forecast from research firm Omdia (via The Elec). "In 2028, we expect the iPad Air to go OLED as well, with the iPad Air using single-stack and the iPad Pro using two-stack tandem OLEDs," said Omdia researcher Kang Min-soo, speaking on...
Walmart MacBook Air M1

Walmart Begins Selling MacBook Air With M1 Chip for $699 in U.S.

Friday March 15, 2024 6:57 am PDT by
Walmart today announced that it has started selling the MacBook Air with the M1 chip in the U.S., with pricing set at a very reasonable $699. The laptop can be ordered now on Walmart.com, and it will be available soon at select Walmart stores. This is the first time that customers can purchase a Mac that is sold directly by Walmart, the company said in a press release. Some other retailers...
AirPods Pro Case With Screen

AirPods Case With Touchscreen Knock-Off Copies Apple Patent

Thursday March 14, 2024 4:29 am PDT by
Apple registers many patents most of which never see the light of day as consumer products – officially, that is. One burgeoning knock-off merchant in China has apparently taken cues from an idea Apple had in 2021 for AirPods featuring a case with a built-in touchscreen display. Pictures and video shared on X (Twitter) by occasional leaker @lipilipsi show production units of counterfeit...