var img = document.createElement('img'); img.src = "https://calabrone.net/piwik.php?idsite=2&rec=1&url=https://stinger.io" + location.pathname; img.style = "border:0"; img.alt = "tracker"; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(img,s);
Skip to main content

Secure Boot

Each step in the Secure Boot process serves a specific role in the process of booting the device, ensuring that only trusted software can be executed. Here's a brief overview of each component:

StageNameDescription
1LLBLow-Level Bootloader
2iBootSecond-Stage Bootloader
3iBSSiBoot Single Stage
4iBECiBoot Epoch Change
5SEPSecure Enclave Processor

LLB (Low-Level Bootloader)​

  • The LLB is the first significant code that runs on an iOS device. It's stored in the device's ROM and is responsible for initializing hardware and security checks. The LLB verifies the signature of the next-stage bootloader (iBoot) to ensure its signed by Apple before executing it. It acts as the root of trust and is pivotal in the secure boot process.

iBoot (Second-Stage Bootloader)​

  • iBoot comes into play after LLB has finished its tasks. It's a higher-level bootloader responsible for several critical functions, including further hardware initialization, loading the operating system kernel, and enforcing device security policies. iBoot also performs signature checks on the firmware it loads to ensure it's not tampered with, providing a second layer of security verification after LLB.

iBSS (iBoot Single Stage) and iBEC (iBoot Epoch Change)​

  • Both iBSS and iBEC are variants of the iBoot process and are used during the device's firmware upgrade and restore processes.

  • iBSS: Acts as a preliminary stage to iBoot, preparing the device for a software update or restore. It's a minimal bootloader used to bring the device to a state where it can communicate more effectively with iTunes or Finder on a Mac for firmware updates or system restores.

  • iBEC: Comes into play after iBSS and essentially serves as an extension of iBoot for the restore process. iBEC includes additional commands specific to the restore process, enabling the device to receive and install the new iOS version. It might perform tasks like preparing the system partition or verifying the integrity of the firmware being installed.

SEP (Secure Enclave Processor) Firmware​

  • The SEP is a coprocessor found in Apple devices starting with the iPhone 5s. It's designed to handle sensitive data and tasks, such as encryption, secure boot, and Touch ID/Face ID processing, in a secure and isolated environment. The SEP firmware is the software that runs on the Secure Enclave Processor.

  • The SEP firmware is responsible for handling cryptographic operations and protecting sensitive user information, ensuring that even the main processor (and the OS running on it) cannot directly access the data. It plays a crucial role in device security, particularly in data protection, biometrics, secure boot, and secure payments (Apple Pay).

Each of these components is digitally signed by Apple to ensure integrity and authenticity. The secure boot chain verifies the signature of each component before executing it, starting from the LLB and moving up the chain. This process ensures that only trusted software signed by Apple can run on the device, significantly enhancing the security of iOS devices against unauthorized modifications and malware.