GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Apple
  • Store
  • Mac
  • iPad
  • iPhone
  • Watch
  • Vision
  • AirPods
  • Home
  • Entertainment
  • Accessories
  • Support
  • 0+
  • Apple Platform Security

This view

  • Original page
  • New address

GeezerVison is showing support.apple.com — Boot process for an Intel-based Mac

    Table of Contents

    Apple Platform Security

    • Welcome
    • Intro to Apple platform security
      • Hardware security overview
      • Apple SoC security
      • The Secure Enclave
        • Biometric security
        • Magic Keyboard with Touch ID
        • Optic ID, Face ID, Touch ID, passcodes, and passwords
        • Optic ID matching security
        • Facial matching security
        • Uses for Optic ID, Face ID, and Touch ID
        • Secure intent and connections to the Secure Enclave
      • Hardware microphone disconnect
      • Mac on-screen camera indicator light
      • Express Cards with power reserve
      • System security overview
        • Boot process for iPad and iPhone devices
        • Memory safe iBoot implementation
          • Boot process
          • Boot modes
          • Paired recoveryOS restrictions
          • Startup Disk security policy control
          • LocalPolicy signing-key creation and management
          • Contents of a LocalPolicy file for a Mac with Apple silicon
          • Boot process
          • Boot modes
          • Startup Security Utility
          • Firmware password protection
          • recoveryOS and diagnostics environments
      • Signed system volume security
      • Secure software updates
      • Background Security Improvements
      • Operating system integrity
        • Physical pairing model security
        • Activating data connections securely
        • Verifying accessories
        • Automatically unlock Apple devices
      • BlastDoor for Messages and IDS
      • Lockdown Mode security
        • Additional macOS system security capabilities
        • System Integrity Protection
        • Trust caches
        • Peripheral processor security
        • Rosetta 2 on a Mac with Apple silicon
        • Direct memory access protections
        • Securely extending the kernel
        • Option ROM security
        • UEFI firmware security in an Intel-based Mac
      • System security for watchOS
      • Random number generation
      • Communicating emergency information using satellites
      • Apple Security Research Device
      • Encryption and Data Protection overview
      • Quantum-secure cryptography with Apple devices
      • Passcodes and passwords
        • Data Protection overview
        • Data Protection
        • Data Protection classes
        • Keybags for Data Protection
        • Protecting keys in alternate boot modes
        • Protecting user data in the face of attack
        • Sealed Key Protection (SKP)
        • Role of Apple File System
        • Keychain data protection
        • Volume encryption with FileVault
        • Managing FileVault
        • Protecting app access to user data
        • Protecting access to user’s health data
      • Digital signing and encryption
      • App security overview
      • App code signing process
        • Intro to app security for iOS, iPadOS, and visionOS
        • About App Store security
        • Security of runtime process
        • App protection and app groups
        • Intro to app security for macOS
        • App code signing process
        • Gatekeeper and runtime protection
        • Protecting against malware
        • Terminal and script protections
        • Controlling app access to files
      • Supporting extensions
      • Secure features in the Notes app
      • Secure features in the Shortcuts app
      • Services security overview
        • Apple Account security
        • Managed Apple Account security
        • iCloud security overview
        • iCloud encryption
        • Advanced Data Protection for iCloud
        • iCloud Backup security
        • Search on iCloud.com security
        • iCloud Private Relay security
        • Account recovery contact security
        • Legacy Contact security
        • Passcode security overview
        • Sign in with Apple security
        • Automatic strong passwords
        • Password AutoFill security
        • App access to saved passwords
        • Password security recommendations
        • Password Monitoring
        • Sending passwords
        • Credential provider extensions
          • iCloud Keychain security overview
          • Secure keychain syncing
          • Secure iCloud Keychain recovery
          • Escrow security for iCloud Keychain
        • Apple Pay security overview
        • Apple Pay component security
        • How Apple Pay keeps users’ purchases protected
          • Card provisioning security overview
          • Adding credit or debit cards to Apple Pay
        • Payment authorization with Apple Pay
        • Paying with cards using Apple Pay
        • Contactless passes in Apple Pay
        • Rendering cards unusable with Apple Pay
        • Apple Card security
        • Apple Cash security
        • Tap to Pay on iPhone
        • Access using Apple Wallet
        • Access key types
          • Car key security
          • Car key transactions
        • Adding transit and eMoney cards to Apple Wallet
          • IDs in Apple Wallet
          • Security of IDs in Apple Wallet
        • iMessage security overview
        • How iMessage sends and receives messages
        • Check In security
        • Secure iMessage name and photo sharing
      • Secure Apple Messages for Business
      • FaceTime security
      • SharePlay security
      • Nearby sharing security
        • Find My security
        • Locating missing devices
        • Continuity security overview
        • Handoff security
        • iPhone cellular call relay security
        • iPhone Text Message Forwarding security
        • Instant Hotspot security
      • Network security overview
      • TLS security
      • IPv6 security
      • VPN security
        • Security features when connecting to wireless networks
        • Wi-Fi security with Apple devices
        • Privacy features when connecting to wireless networks
        • Wi-Fi privacy with Apple devices
      • Bluetooth security
      • Ultra Wideband security in iOS
      • Single Sign-on security
      • AirDrop security
      • Wi-Fi password sharing security
      • Firewall security in macOS
      • Developer kit security overview
      • ARKit security
      • DriverKit security
      • EnergyKit data security
        • Communication security
        • Data security
        • Securing routers with HomeKit
        • Camera security
        • Security with Apple TV
      • NFC & SE Platform security
      • ReplayKit security
      • SiriKit security
      • WidgetKit security
      • Secure device management overview
        • Device management security overview
        • Managed Device Attestation
        • Attestation process security
        • Configuration enforcement
        • Automated Device Enrollment
        • Activation Lock security
        • Managed Lost Mode and remote wipe
        • Shared iPad security
      • Apple Configurator security
      • Screen Time security
    • Glossary
    • Document revision history
    • Copyright and trademarks

    Boot process for an Intel-based Mac

    Intel-based Mac with an Apple T2 Security Chip

    When an Intel-based Mac computer with the Apple T2 Security Chip is turned on, the chip performs a secure boot from its Boot ROM in the same fashion as iPad, iPhone, and a Mac with Apple silicon. This verifies the iBoot bootloader and is the first step in the chain of trust. iBoot checks the kernel and kernel extension code on the T2 chip, which then checks the Unified Extensible Firmware Interface (UEFI) firmware. The UEFI firmware and the associated signature are initially available only to the T2 chip.

    The macOS T2 secure boot chain process.

    After verification, the UEFI firmware image is mapped into a portion of the T2 chip memory. This memory is made available to the Intel CPU through the enhanced Serial Peripheral Interface (eSPI). When the Intel CPU first boots, it fetches the UEFI firmware through the eSPI from the integrity-checked, memory-mapped copy of the firmware located on the T2 chip.

    The evaluation of the chain of trust continues on the Intel CPU, with the UEFI firmware evaluating the signature for the macOS bootloader (Boot.efi). The Intel-resident macOS secure boot signatures are stored in the same Image4 format used for iOS, iPadOS, and T2 chip secure boot, and the code that parses the Image4 files is the same hardened code from the current iOS and iPadOS secure boot implementation. Boot.efi in turn verifies the signature of a new file, called immutablekernel. When secure boot is enabled, the immutablekernel file represents the complete set of Apple kernel extensions required to boot macOS. The secure boot policy terminates at the handoff to the immutablekernel, and after that, macOS security policies (such as System Integrity Protection and signed kernel extensions) take effect.

    If there are any errors or failures in this process, the Mac enters Recovery mode, Apple T2 Security Chip Recovery mode, or Apple T2 Security Chip Device Firmware Upgrade (DFU) mode.

    Microsoft Windows on an Intel-based Mac with a T2 chip

    By default, an Intel-based Mac that supports secure boot trust only content signed by Apple. However, to improve the security of Boot Camp installations, Apple also supports secure booting for Windows. The UEFI firmware includes a copy of the following Microsoft Bootloader certificates, which are used to authenticate the Microsoft bootloaders:

    • Microsoft Corporation KEK 2K CA 2023

    • Windows UEFI CA 2023

    • Microsoft UEFI CA 2023

    • Microsoft Option ROM UEFI CA 2023

    Note: It’s a known issue that Windows doesn’t report the presence of these bootloader certificates when updating to a newer macOS updates.

    Intel-based Mac computers without a T2 chip

    Because an Intel-based Mac without a T2 chip doesn’t support secure boot, the UEFI firmware loads the boot.efi from the file system without verification and the booter loads the kernel (prelinked kernel) from the file system without verification. To protect the integrity of the boot chain, users should enable all of the following security mechanisms:

    • System Integrity Protection (SIP): Enabled by default, this protects the booter and kernel against malicious writes from within a running macOS.

    • FileVault: This can be enabled in two ways: by the user or by a device management service administrator. This protects against a physically present attacker using target disk mode to overwrite the booter.

    • Firmware Password: This can be enabled in two ways: by the user or by a device management service administrator. This helps prevent a physically present attacker from launching alternate boot modes such as recoveryOS, Single User Mode, or target disk mode from which the booter can be overwritten. This also helps prevent booting from alternate media, by which an attacker could run code to overwrite the booter.

    The unlocking process of an Intel-based Mac without a T2 chip.
    See alsoStartup Security Utility on a Mac with an Apple T2 Security ChipFirmware password protection in an Intel-based MacrecoveryOS and diagnostics environments for an Intel-based MacSecure software updates

    Download this guide as a PDF

    Helpful?
    Character limit: 250
    Maximum character limit is 250.
    Thanks for your feedback.
    You are visitor 01402503 — GeezerVison does not store the pages you look up.
    Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.