How do regular software updates to Apple’s secure enclave remain secure?

Question

The Secure Enclave is isolated from the main processor to provide an extra layer of security and is designed to keep sensitive user data secure even when the Application Processor kernel becomes compromised.

This information is sourced Apple's website itself.

Firstly, I am fairly sure that the secure enclave does undergo regular software updates in conjunction with OS updates, such as iOS 17, (because otherwise the SE couldn’t keep up with the OS.)

Although the SE and OS ‘communicate’ indirectly often, this is usually requesting AES keys or storing small amounts of information in the NAND flash memory. Therefore, my thinking is that a software update, where a relatively huge amount of data is transferred, would be the perfect opportunity to sneak in some unwanted software.

So, does anyone actually know how is it ensured that no malicious software is snuck into the software update package, compromising the secure enclave?

Or is this obscured information?

And I am definitely not talking about compromising the update package on every iPhone it reaches, as this would involve the impossible task of compromising Apple’s secured servers first. I am just talking about hijacking the update software for one phone, if malicious code has already compromised the main OS.

Answer 1

The Secure Enclave has an immutable boot ROM which is responsible for loading the operating system that runs on the Secure Enclave Processor (called sepOS), as explained in the Apple Platform Security documentation. Unlike the boot ROM, the sepOS image can be updated. To prevent malicious updates, all official sepOS images are cryptographically signed by Apple. The boot ROM verifies the image signature and only loads the sepOS if the verification was successful, i.e., the image comes from Apple and hasn't been manipulated.

This scheme isn't perfect, though. If there are vulnerabilities in the boot ROM, then it may be possible to circumvent the protection. Even worse, since the ROM is immutable, it cannot be patched and must be replaced at hardware level.