Appendix: Apple Silicon Secure Boot Ticket Canonicalization
The construction of a release from an Image4 ticket.
Overview
When CloudAttestation is producing canonical Image4 tickets, the 4CC uniq in personalized tickets determines which fields are redacted to produce canonical tickets.
At the time of publication, these fields are:
Field | Four Character Code | Provenance | Ticket | Purpose |
|---|---|---|---|---|
AP Nonce Hash |
| Randomly generated by requestor and unique to each ticket | AP | Anti-replay |
Certificate Epoch |
| Injected by signing service | AP, Cryptex1 | Establishes authority of the certificate over the silicon |
Unique Chip Identifier |
| Unique to SoC | AP | Binds manifest to specific SoC instance |
Unique Device Identifier |
| Unique to SoC | Cryptex1 | Binds manifest to specific SoC instance |
Cryptex1 Nonce Hash |
| Randomly generated by requestor and unique to each ticket | Cryptex1 | Anti-replay |
SEP Nonce Hash |
| Randomly generated by requestor and unique to each ticket | AP | Anti-replay |
Software Update Freshness Nonce |
| Randomly generated by requestor and unique to each ticket | AP | Anti-replay |
Server Nonce |
| Injected by signing service | AP, Cryptex1 | Salts the resulting ticket |
Unique Tag List |
| Injected by signing service | AP, Cryptex1 | Lists all tags whose values should be replaced with null to produce a canonical representation |