Thread

1. tgsovlerkhgsel · 1789535685 · focus · HN ↗

   This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally".

   There are already plenty of insurances that require you to submit claims through a smartphone app that tries to essentially do this by capturing sensor metadata etc. - those don't need to be nation-state resilient, just Joe the Crackhead Insurance Scammer resilient, so this works. Likewise, more and more things online require identity verification (either officially or disguised as age verification).

   Edit: And while "a nation state actor can spoof this" is a problem for the journalism use case, the insurance/ID verification use cases are perfectly fine with anything that raises the bar but could be bypassed with enough effort. Also, the journalism use case suffers from the same fundamental issue all of these use cases suffer from: People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

   1. alwillis · 1789551144 · focus · HN ↗

      > This is really clever from Apple. The journalist use case is just the PR story. This will be really useful for identity verification and insurance apps, and has the potential to shift from "you need a smartphone to be able to live normally" to "you need an iPhone to be able to live normally".

      You have it all wrong.

      Apple Reference Image is not an id system; it's primarily a way to attest that the pixels recorded by the camera sensor have not been altered in any way; the pixels, metadata and timestamp are all cryptographically signed.

      There's no way to link a reference image to a person; it's also not possible to determine if a pair of images came from the same device.

      > And while "a nation state actor can spoof this" is a problem for the journalism use case

      This is incorrect:

          When the image sensor is first initialized in the factory, it creates a
          cryptographic signing identity, sharing only the public key with the
          factory. The SEP similarly creates a separately-attested signing
          identity. These identities are bound together into the device manifest,
          allowing us to later check whether a particular sensor and SEP are from
          the same device.
      
          The final signature on a reference image is a composite post-quantum
          signature combining RSA-3072 and ML-DSA-87. To our knowledge, Apple
          Reference Image is the only image provenance system that provides
          quantum-secure defenses.
      

      So… a nation-state can't really do anything here unless they acquire alien technology. If something crazy happens (solar flare or EMP?), a fraudulent reference image can be revoked.

      > Also, the journalism use case suffers from the same fundamental issue all of these use cases suffer from: People will "verify" the picture by looking at the repost of a screenshot of the verification UI, not by verifying the original themselves.

      I would imagine there will be a way to confirm an Apple Reference Image on the web. Pretty soon, 3rd parties will be able to verify the image themselves:

          Reference images can be viewed in the Photos app alongside the main
          image, like a digital negative, to visually compare the two assets and
          determine if any edits were made. APIs are available in iOS, iPadOS, and
          macOS 27 for third-party apps to enable viewing of these reference images.

      1. monocasa · 1789561959 · focus · HN ↗

         Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively.

         They can then sign their own fraudulent images.

         1. alwillis · 1789579957 · focus · HN ↗

            > Nation states almost certainly have the ability to extract the private keys out of an image sensor and SEP. Outside of superpowers even if you're willing to do it destructively. They can then sign their own fraudulent images.

            That's not how this works.

            Let's pretend they're able to extract the sensor key and the SEP key. Then what?

            An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service.

            When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest.

            More encryption and checking happens until the secure digital negative is sent to Private Cloud Compute:

                PCC recomputes the digest embedded in the frame and verifies the
                sensor's signature over the pixels and that digest, verifying the
                certificate chain back to the sensor CA. PCC also verifies the SEP
                signature and chains it to the BAA CA, and it verifies the signature
                on the device manifest and chains it to the CA that signs device
                manifests at the factory. It then confirms that the sensor and SEP
                named in those chains belong to the same device. Only if all these
                checks pass does processing continue.
            

            Only PCC can create an Apple Reference Image; an attacker having the image and sensor private keys doesn't enable them to create a reference image.

            1. monocasa · 1789593035 · focus · HN ↗

               > An attacker won't have the ECDSA P-256 over SHA-256 signed timestamp token from the Apple Push Notification Service.

               Sure they can, they have everything needed to prove to Apple's servers that they're a real iPhone since pulling the keys means they have the cryptographic root of trust, and Apple's servers will happily be a signature oracle for them in that case.

               > When Reference mode starts, the operating system supplies a SHA-256 digest to be embedded at a fixed location in the captured frame’s metadata. The digest is computed from the most recent secure timestamp, the device manifest, and the device's secure boot manifest.

               And when you know what is measured into those manifests and the keys at the root of trust you can manufacture those too.

               The entire scheme is dependent on not being able to extract device specific keys. At the end of the day, those are almost certainly efuses burnt based on a on-chip HRNG as a manufacturing step which is intended to never leave the device, but instead only signatures and associated public keys.

               But when you have chip development hardware of the kind you'd have at a decent fabless semiconductor company, you can very clearly see burnt efuses.

               1. alwillis · 1789608827 · focus · HN ↗

                  I made a flow chart of the Apple Reference Image process; hopefully it clears up some misconceptions [1].

                  [1]: &quot;How pixels become an Apple Reference Image&quot; - <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49735284">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=49735284

                  1. monocasa · 1789670359 · focus · HN ↗

                     That matches what I said.

Unofficial Hacker News client; not affiliated with Y Combinator.