As much as it pained me, Friday morning I slipped out of my house at 3:30am, drove to the nearest Apple Store, set up my folding chair, and waited patiently to acquire an iPhone 5s. I was about number 150 in line, and it was a good thing I didn’t want a gold or silver model. This wasn’t my first time in a release line, but it is most definitely the first time I have stood in line since having children and truly appreciated the value of sleep.
It wasn’t that I felt I must have new shiny object, but because, as someone who writes extensively on Apple security, I felt it was important to get my hands on a Touch ID equipped phone as quickly as possible, to really understand how it works. I learned even more than I expected.
The training process is straightforward and rapid. Once you enable Touch ID you press and lift your finger, and if you don’t move it around at all the iPhone prompts you to slightly change positioning for a better profile. Then there is a second round of sensing the fringes of your finger. You can register up to five fingers, and they don’t have to all be your own.
What does this tell me from a security perspective? Touch ID is clearly storing an encrypted fingerprint template, not a hashed one. The template is modified over time as you use it (according to Apple statements). Apple also, in their Touch ID support note, mentions that there is a 1 in 50,000 chance of a match of the section of fingerprint. So I believe they aren’t doing a full match of the entire template, but of a certain number of registered data points. There are some assumptions here, and some of my earlier assumptions about Touch ID were wrong.
Apple has stated from the start that the fingerprint data is encrypted and stored in the Secure Enclave of the A7 chip. In my earlier Macworld and TidBITS articles I explained that I thought they really meant hashed, like a passcode, but I now believe not only that I was wrong, but that there is even more to it.
Touch ID itself is insanely responsive. As someone who has used many fingerprint scanners before, I was stunned by how quickly it works, from so many different angles. The only failures I have are when my finger is really wet (it still worked fine during a sweaty workout). My wife had more misreads after a long bath when her skin was saturated and swollen. This is the future of unlocking your phone – if you want. I already love it.
I mentioned that the fingerprint template (Apple prefers to call it a “mathematical representation”, but I am sticking with standard terms) is encrypted and stored. I believe that Touch ID also stores your device passcode in the Secure Enclave. When you perform a normal swipe to unlock, then use Touch ID, it clearly fills in your passcode (or Apple is visually faking it). Also, during the registration process you must enter your passcode (and Apple ID passwords, if you intend to use Touch ID for Apple purchases).
Again, we won’t know until Apple confirms or denies, but it seems that your iPhone works just like normal, using standard passcode hashing to unlock and encrypt the device. Touch ID stores this in the Secure Enclave, which Apple states is walled off from everything else. When you successfully match an enrolled finger, your passcode is loaded and filled in for you. Again, assumptions abound here, but they are educated.
The key implication is that you should still use a long and complicated passcode. Touch ID does not prevent brute-force passcode cracking!
The big question is now how the Secure Enclave works, and how secure it really is. Based on a pointer provided by James Arlen in our Securosis chat room, and information released from various sources, I believe Apple is using ARM TrustZone technology. That page offers a white paper in case you want to dig deeper than the overview provides, and I read all 108 pages.
The security of the system is achieved by partitioning all of the SoC hardware and software resources so that they exist in one of two worlds – the Secure world for the security subsystem, and the Normal world for everything else. Hardware logic present in the TrustZone-enabled AMBA3 AXI(TM) bus fabric ensures that Normal world components do not access Secure world resources, enabling construction of a strong perimeter boundary between the two. A design that places the sensitive resources in the Secure world, and implements robust software running on the secure processor cores, can protect assets against many possible attacks, including those which are normally difficult to secure, such as passwords entered using a keyboard or touch-screen. By separating security sensitive peripherals through hardware, a designer can limit the number of sub-systems that need to go through security evaluation and therefore save costs when submitting a device for security certification.
Seems pretty clear.
We still don’t know exactly what Apple is up to. TrustZone is very flexible and can be implemented in a number of different ways. At the hardware level, this might or might not include ‘extra’ RAM and resources integrated into the System on a Chip. Apple may have some dedicated resources embedded in the A7 for handling Touch ID and passcodes, which would be consistent with their statements and diagrams. Secure operations probably still run on the main A7 processor, in restricted Secure mode so regular user processes (apps) cannot access the Secure Enclave. That is how TrustZone handles secure and non-secure functions sharing the same hardware.
So, for the less technical, part of the A7 chip is apparently dedicated to the Secure Enclave and only accessible when running in secure mode. It is also possible that Apple has processing resources dedicated only to the Secure Enclave, but either option still looks pretty darn secure.
The next piece is the hardware. The Touch ID sensor itself may be running on a dedicated bus that only allows it to communicate with the Secure Enclave. Even if it is running on the main bus, TrustZone tags it at the hardware level so it only works in the secure zone. I don’t expect any fingerprint sniffing malware any time soon.
TrustZone can also commandeer a screen and keyboard, which could be how Apple pulls the encrypted passcode out of the Secure Enclave to enter it for you, without exposing it to sniffing. That entire transaction would run from the Secure Zone, injecting your passcode or passphrase into data entry fields as if you punched it in yourself by hand. The rest of iOS operates normally, without change, and the Secure Enclave takes over the hardware as needed to enter passcodes on your behalf. The rest of the system can’t access the Secure Enclave, because it is walled off from the Secure Zone by the hardware architecture, which is why the risk of storing an encrypted passcode as opposed to a hashed one is minimal.
Depending on Apple’s implementation, they may or may not be using unique hardware keys embedded in the A7 that would be impossible to extract without pulling the chip and scanning it with special microscopes in a lab. Or not. We really don’t know.
I am really reading between the lines here, based on some research and hands-on experience with Touch ID, but I think I am close. What’s fascinating is that this architecture can enable a number of other security options. For example, there is no reason TrustZone (the Secure Enclave) couldn’t take over the Bluetooth radio for secure authentication or payment.
I suspect Apple will eventually release more details in response to public pressure – they still tend to underestimate the level of security information the world needs before placing trust in Apple (or anyone else). But if my assumptions are even close to accurate, Touch ID looks like a good part of a strong system that avoids a bunch of potential pitfalls and will be hard to crack.
Reader interactions
8 Replies to “Investigating Touch ID and the Secure Enclave”
Rich,
Your analysis is in line with what I’ve been assuming, but you’ve done some research, so that’s nice. It wouldn’t take much in terms of resources (time/money) for Apple to have embedded some separate secure/tamper-resistant/tamper-proof memory, isolated in this “enclave”, and the payback would be well worth-it.
Phil, it’s entirely possible that a code-signing certificate is embedded in the enclave, and it may become inaccessible if it’s being called by unsigned code. That’ll be interesting to watch though.
Cheers!
Yeah, I went back and listened to that again. Maybe I’m being a bit harsh. The comments do seem to suggest that the Mac has little malware due to its obscurity — the implication being that it will have serious malware problems if it becomes less obscure.
But maybe you’re right: If Apple has patched holes that existed four years ago, that might have prevented big problems from arising by today.
No matter if Touch ID is as insecure as a 4 digit passcode (which isn’t very secure at all) if Apple can get more people to use it than use a passcode then they’ve done a great service. Since approximately 50% of smartphone users don’t even bother with a passcode at all, every little bit helps. It is amazing to hear people on other websites arguing whether Touch ID can be hacked/cracked when half of phones don’t even have a passcode to defeat.
I’m curious what impact jailbreaking the phone has on the integrity of Touch ID security…
Darel,
I really doubt I said that. Since even Gartner days I’ve considered mobile malware far over-hyped. It could be possible, I drink a lot sometimes when I podcast, but if I said that it was just around the corner I definitely was wrong.
But please look at everything I’ve written on this topic. Apple has come a hell of a long way since then. iOS is pretty much the most secure thing out there these days.
I’ll go back and check that episode to make sure. Also, Apple did really change their security posture starting with Lion and the closed a ton of gaps. Entirely different company in many ways.
“When you perform a normal swipe to unlock, then use Touch ID, it clearly fills in your passcode (or Apple is visually faking it).”
I notice you get the same “filling in” animation when using a “wrong” finger. I don’t think that this invalidates your premise, but perhaps is not quite so indicative of anything other than a UI choice.
“I suspect Apple will eventually release more details in response to public pressure – they still tend to underestimate the level of security information the world needs before placing trust in Apple (or anyone else).”
Not meaning to be antagonistic, but weren’t you on a podcast (Network Security #144) over four years ago, with Dino Dai Zovi, warning that serious malware problems were just around the corner for Apple’s platforms? Whatever came of that?
Even if I honestly thought Apple wasn’t doing enough to secure its systems, it would give me pause if I had publicly warned of that, year after year, while nothing much bad ever happened.
I am not so much interested in the convenience aspect of Touch ID. Here are 2 features that I would like to see implemented.
1. Touch ID is used to bring up the passcode entry screen; a two-step authentication so to speak.
2. Assigning one of the five scans to act as a lockdown or “self-destruct” method. That would help thwart “law enforcement” strong-arm enactment. It would also be nice if after a given number of home button scans the iPhone goes into lockdown mode indicating that the device has been handled by others.
Ian