TouchID explained: Apple shows how the iPhone 5s fingerprint scanner works

Apple has put out a new document which has given a detailed explanation of how exactly the TouchID fingerprint scanner and the new A7 chip’s Secure Enclave work on iOS to ensure that user data remains protected. Details of this whitepaper by Apple were put out by TechCrunch, and you can check out the complete document here.   The document reads, “When an iOS device is turned on, its application processor immediately executes code from read-only memory known as the Boot ROM. This immutable code is laid down during chip fabrication, and is implicitly trusted. The Boot ROM code contains the Apple Root CA public key, which is used to verify that the Low-Level Bootloader (LLB) is signed by Apple before allowing it to load. This is the first step in the chain of trust where each step ensures that the next is signed by Apple. When the LLB finishes its tasks, it verifies and runs the next-stage bootloader, iBoot, which in turn verifies and runs the iOS kernel.   For devices with an A7 processor, the Secure Enclave coprocessor also utilizes a secure boot process that ensures its separate software is verified and signed by Apple.”   So what exactly is the Secure Enclave in a device with the A7 processor? According to the document, it is “The Secure Enclave is a coprocessor fabricated in the Apple A7 chip…provides all cryptographic operations for Data Protection key management and  maintains the integrity of Data Protection even if the kernel has been compromised.” [caption id=“attachment_219137” align=“alignnone” width=“640”]  Fingerprint scans are not accessible to third parties[/caption]   Apple says that the each Secure Enclave has its own Unique ID not accessible to other parts and is not known to Apple. Data that is saved to the file system by the Secure Enclave is encrypted with a key tangled with the UID. This is also the part of the A7 chip that deals with the fingerprint data which is collected by the TouchID sensor on the iPhone 5s . Apple’s documents spells out how A7 processor helps gather the fingerprint data, but can’t actually read the information itself. “Communication between the A7 and the Touch ID sensor takes place over a serial peripheral interface bus. The A7 forwards the data to the Secure Enclave but cannot read it. It’s encrypted and authenticated with a session key that is negotiated using the device’s shared key that is built into the Touch ID sensor and the Secure Enclave.”   Apple has also spelt out that it has strict no-third party app rule when it comes to TouchID data. “Touch ID authentication and the data associated with the enrolled fingerprints are not available to other apps or third parties,” reads the document.   Apple’s document also gives a detailed account of how the TouchID unlocks an iPhone 5s. It states that, “On iPhone 5s with Touch ID turned on, the cryptographic class keys are not discarded when the device locks; instead, they’re wrapped with a key that is given to the Touch ID subsystem. When a user attempts to unlock the device, if Touch ID recognizes the user’s finger- print, it provides the key for unwrapping the Data Protection keys and the device is unlocked. This process provides additional protection by requiring the Data Protection and Touch ID subsystems to cooperate in order to unlock the device. The decrypted class keys are only held in memory, so they’re lost if the device is rebooted. Additionally, as previously described, the Secure Enclave will discard the keys after 48 hours or 5 failed Touch ID recognition attempts.”   There’s also a new section on  iCloud Keychain, where Apple says that the system is designed to prevent unauthorised access to iCloud Keychain stored information in the event of a compromised iCloud account.   Apple’s security for iOS 7 devices has recently been under the scanner. Researchers at FireEye published a post about how they were able to track  keyboard presses, physical button presses, and TouchID interaction on even non-jailbroken iOS devices by running a monitoring app which records these interactions. Researchers say that it could be used attack iOS devices and hackers could get access to all input data on the device.  Apple has not commented on this security flaw.