Apple Silicon-based Macs have a LocalPolicy file that controls the secure boot process. To prevent replay attacks of the LocalPolicy, hashes of nonces are used. From here:

The lpnh is used for anti-replay of the LocalPolicy. This is an SHA384 hash of the LocalPolicy Nonce (LPN), which is stored in the Secure Storage Component and accessible using the Secure Enclave Boot ROM or Secure Enclave. The raw nonce is never visible to the Application Processor, only to the sepOS. An attacker wanting to convince LLB that a previous LocalPolicy they had captured was valid would need to place a value into the Secure Storage Component, which hashes to the same lpnh value found in the LocalPolicy they want to replay.

The way this is explained, the lpnh and the LPN can't really serve as an anti-replay mechanism. If the lpnh is a hash only of the LPN, then the rest of the LocalPolicy's contents can be changed without failing any sort of validation. The lpnh would need to incorporate the contents of the LocalPolicy file into it to serve as an anti-replay mechanism, in which case Apple can just ditch the nonce and the nonce hash, and store the hash of the LocalPolicy in the Secure Storage Component instead.

How does this system actually work?

  • @defalt That doesn't explain how hashing the nonce prevents replay attacks.
    – Melab
    Oct 17, 2023 at 16:41

1 Answer 1


Contents of a LocalPolicy file for a Mac with Apple silicon

The LocalPolicy is an Image4 file signed by the Secure Enclave.

To prevent an attacker from replaying older versions of signed LocalPolicy:

  1. It first verifies the signature of the LocalPolicy.
  2. Then it computes the hash of LocalPolicy Nonce (LPN) which is stored in the LocalPolicy image and compares it with the LocalPolicy Nonce Hash (lpnh) which is stored in the Secure Storage Component.
  • But what is the purpose of including the nonce's hash? Just include the nonce in the clear and it should accomplish the same thing.
    – Melab
    Oct 20, 2023 at 21:54
  • It's purely a design decision. The secure storage component has a limited capacity.
    – defalt
    Oct 21, 2023 at 8:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .