Appendix: Apple Silicon Secure Boot Tags
The format of an Image4 manifest.
Overview
Objects used in the APTicket include:
Boot Firmware | Four Character Code | Activator | Executable Code | Purpose |
|---|---|---|---|---|
Apple Converged IO |
| Yes | CIO image | |
Apple Neural Engine |
| Yes | ANE image | |
Apple Neural Engine |
| Yes | ANE image | |
Apple Video Encoder |
| Yes | AVE image | |
Device Tree |
| iBoot | Device tree that is patched by iBoot and handed forward to the kernel | |
FDR Trusted Root CA for AP |
| No | Hash of FDR Trusted Root CA, used for the AP | |
FDR Trusted Root CA for SEP |
| No | Hash of FDR Trusted Root CA, used for the SEP | |
Graphics |
| Yes | GPU firmware | |
Kernel Cache |
| iBoot | The kernel image, including all extensions | |
Local Storage iBoot |
| Boot ROM | The iBoot booted by Boot ROM during a normal boot | |
NAND Services |
| iBoot | Basic NAND support | |
OS Image |
| Restore OS | The OS image which is restored to the system volume | |
Power Management services |
| Yes | Power Management Processor | |
Restore ANE |
| Yes | ANE image which boots in restore OS | |
Restore Converged IO |
| Yes | Basic CIO support in restore OS | |
Restore FDR Trusted Root CA for AP |
| No | Hash of Restore FDR Trusted Root CA, used for the AP | |
Restore FDR Trusted Root CA for SEP |
| No | Hash of Restore FDR Trusted Root CA, used for the SEP | |
Restore Kernel Cache |
| iBoot | The kernel image which boots in the restore OS | |
Restore NAND Services |
| Basic NAND support in restore OS | ||
Restore RAM Disk |
| The operating system RAM disk that boots in the restore OS | ||
Restore Secure Page Table Monitor |
| The SPTM image which boots in the restore OS | ||
Restore TMU |
| Yes | TMU image used in restore OS. See | |
Restore Trust Cache (RAM Disk) |
| iBoot | The trust cache covering the contents of the Restore RAM Disk | |
Restore Trust Cache |
| No | The trust cache covering the contents of the restore OS | |
Restore Trusted Execution Monitor |
| The TXM image which boots in the restore OS | ||
Restore sepOS |
| The sepOS which boots in the restore OS | ||
Secure Page Table Monitor |
| The SPTM image | ||
Smart IO |
| Yes | ||
System Volume Sealing Metadata |
| Restore OS | Metadata describing the normal form of the file system. Applied prior to sealing. | |
System Volume Seal |
| iBoot | Root of hash tree covering the system volume | |
Time Management Unit |
| Yes | TMU image. Synchronizes time across Thunderbolt (and USB4) links. | |
Static Trust Cache |
| iBoot | No | The trust cache covering the contents of the OS Image |
Trusted Execution Monitor |
| iBoot | The TXM image | |
USB Recovery iBoot |
| Boot ROM | The iBoot downloaded over USB and booted during recovery scenarios | |
iBoot Data |
| iBoot | iBoot tunables that can be revised independently of iBoot itself | |
iBoot Second Stage |
| Boot ROM | The iBoot booted by Boot ROM during DFU | |
iBoot |
| Boot ROM | ||
sepOS |
| sepOS |
Cryptexes use an additional set of objects:
Component | Four Character Code | Use | Activator | Action |
|---|---|---|---|---|
Info.plist |
| Metadata about the cryptex |
| Reserves cryptex identifier. May specify custom mount point |
Disk Image |
| The cryptex disk image |
| Excluded from the cryptex ticket, disk image integrity is protected by |
Seal |
| The root of the file system’s hash tree | APFS file-system driver | Pins root hash to file-system hash tree |
Trust Cache |
| The code directory hashes of all executable content | Permits listed cdhashes to execute |
For additional information about trust cache objects, see Appendix: Apple Silicon Trust Cache Format.
An Image4 manifest can specify the following constraints:
Constraint | Four Character Code | Purpose |
|---|---|---|
Chip ID |
| Identifies a specific SoC |
Security Domain |
| Security policy domain of the SoC |
Board ID |
| Identifies a specific product, within the scope of the Chip ID and Security Domain |
Unique Chip ID |
| Unique value assigned to each individual SoC, within the scope of a specific Chip ID |
Unique Device ID |
| Combination of Chip ID and ECID, providing a unique identifier |
Effective Production Status |
| Effective development or production fusing status of an SoC |
Effective Security Status |
| Effective insecure or secure fusing status of an SoC |
Certificate Production Status |
| Development or production fusing status of the signing certificate |
Certificate Security Status |
| Insecure or secure fusing status of the signing certificate |
Certificate Epoch |
| Minimum certificate epoch of the device |
Extended Security Domain |
| Additional security policy information (such as research fusing) |
Restore Version |
| A version tuple to ensure a minimum OS version for accepting a manifest |
Long OS Version |
| C-string formatted data representing the OS version |
Allow Mix-N-Match |
| Allows using a heterogeneous manifest chain for verifying objects (relaxes the constraint for enforcing |
Data Only |
| Constraint to enforce rejection of the manifest by the environment that authorizes the use of trust caches |
Boot Nonce Hash |
| Digest of the boot nonce used to enforce anti-replay by Boot ROM and iBoot |
SEP Nonce |
| Nonce used to enforce anti-replay for SEP objects |
Cryptex1 Nonce Hash |
| Digest of the Cryptex1 nonce used to enforce anti-replay for Cryptex1 manifests |
Nonce Domain |
| Domain of the nonce to use to enforce anti-replay |
Research Mode |
| Constrains manifest to only research mode devices |
Object Digest |
| Enforce an object’s digest matches the listing in the manifest |
Boot Manifest Hash |
| Digest of the manifest used to boot the system, used to enforce use of a single manifest chain |