Demystifying the Secure Enclave Processor

Memory Encryption Setup
• Use “True Random Number Generator” to generate
192 bits of randomness and store it in the TZ0 area
(not encrypted yet).
• Use a standard key generation format (used for
generating ART for example) to generate final
encryption key:
▫ [4 byte magic = 0xFF XK1][4 bytes of 0s][192-bits of
randomness]
• Copy key from AES result registers through SEP
registers directly into encryption controller registers
(without touching memory).