• Apple
      • Store
      • Mac
      • iPad
      • iPhone
      • Watch
      • Vision
      • AirPods
      • TV & Home
      • Entertainment
      • Accessories
      • 0+
    Apple Platform Security
    Open Menu Close Menu
    • Communities
    Table of Contents

    Apple Platform Security

    • Welcome
    • Intro to Apple platform security
      • Hardware security overview
      • Apple SoC security
      • Secure Enclave
        • Biometric security
        • Magic Keyboard with Touch ID
        • Optic ID, Face ID, Touch ID, passcodes, and passwords
        • Optic ID matching security
        • Facial matching security
        • Uses for Optic ID, Face ID, and Touch ID
        • Secure intent and connections to the Secure Enclave
      • Hardware microphone disconnect
      • Express Cards with power reserve
      • System security overview
        • Boot process for iPhone and iPad devices
        • Memory safe iBoot implementation
          • Boot process
          • Boot modes
          • Paired recoveryOS restrictions
          • Startup Disk security policy control
          • LocalPolicy signing-key creation and management
          • Contents of a LocalPolicy file for a Mac with Apple silicon
          • Boot process
          • Boot modes
          • Startup Security Utility
          • Firmware password protection
          • recoveryOS and diagnostics environments
      • Signed system volume security
      • Secure software updates
      • Rapid Security Responses
      • Operating system integrity
        • Pairing model security
        • Activating data connections securely
        • Verifying accessories
        • iPhone Mirroring security
      • BlastDoor for Messages and IDS
      • Lockdown Mode security
        • Additional macOS system security capabilities
        • System Integrity Protection
        • Trust caches
        • Peripheral processor security
        • Rosetta 2 on a Mac with Apple silicon
        • Direct memory access protections
        • Securely extending the kernel
        • Option ROM security
        • UEFI firmware security in an Intel-based Mac
      • System security for watchOS
      • Random number generation
      • Apple Security Research Device
      • Encryption and Data Protection overview
      • Passcodes and passwords
        • Data Protection overview
        • Data Protection
        • Data Protection classes
        • Keybags for Data Protection
        • Protecting keys in alternate boot modes
        • Protecting user data in the face of attack
        • Sealed Key Protection (SKP)
        • Role of Apple File System
        • Keychain data protection
        • Volume encryption with FileVault
        • Managing FileVault
        • Protecting app access to user data
        • Protecting access to user’s health data
      • Digital signing and encryption
      • App security overview
      • App code signing process
        • Intro to app security for iOS, iPadOS, and visionOS
        • About App Store security
        • Security of runtime process
        • App protection and app groups
        • Intro to app security for macOS
        • App code signing process
        • Gatekeeper and runtime protection
        • Protecting against malware
        • Controlling app access to files
      • Supporting extensions
      • Secure features in the Notes app
      • Secure features in the Shortcuts app
      • Services security overview
        • Apple Account security
        • Managed Apple Account security
        • iCloud security overview
        • iCloud encryption
        • Advanced Data Protection for iCloud
        • Security of iCloud Backup
        • iCloud Private Relay security
        • Account recovery contact security
        • Legacy Contact security
        • Passcode security overview
        • Sign in with Apple security
        • Automatic strong passwords
        • Password AutoFill security
        • App access to saved passwords
        • Password security recommendations
        • Password Monitoring
        • Sending passwords
        • Credential provider extensions
          • iCloud Keychain security overview
          • Secure keychain syncing
          • Secure iCloud Keychain recovery
          • Escrow security for iCloud Keychain
        • Apple Pay security overview
        • Apple Pay component security
        • How Apple Pay keeps users’ purchases protected
          • Card provisioning security overview
          • Adding credit or debit cards to Apple Pay
        • Payment authorization with Apple Pay
        • Paying with cards using Apple Pay
        • Contactless passes in Apple Pay
        • Rendering cards unusable with Apple Pay
        • Apple Card security
        • Apple Cash security
        • Tap to Pay on iPhone
        • Access using Apple Wallet
        • Access key types
        • Car key security
        • Adding transit and eMoney cards to Apple Wallet
          • IDs in Apple Wallet
          • Security of IDs in Apple Wallet
        • iMessage security overview
        • How iMessage sends and receives messages
        • Check In security
        • Secure iMessage name and photo sharing
      • Secure Apple Messages for Business
      • FaceTime security
        • Find My security
        • Locating missing devices
        • Continuity security overview
        • Handoff security
        • iPhone cellular call relay security
        • iPhone Text Message Forwarding security
        • Instant Hotspot security
      • Network security overview
      • TLS security
      • IPv6 security
      • VPN security
        • Security features when connecting to wireless networks
        • Wi-Fi security with Apple devices
        • Privacy features when connecting to wireless networks
        • Wi-Fi privacy with Apple devices
      • Bluetooth security
      • Ultra Wideband security in iOS
      • Single sign-on security
      • AirDrop security
      • Wi-Fi password sharing security
      • Firewall security in macOS
      • Developer kit security overview
        • Communication security
        • Data security
        • Securing routers with HomeKit
        • Camera security
        • Security with Apple TV
      • SiriKit security
      • WidgetKit security
      • DriverKit security
      • ReplayKit security
      • ARKit security
      • NFC & SE Platform security
      • Secure device management overview
        • MDM security overview
        • Managed device attestation security
        • Configuration enforcement
        • Automated Device Enrollment
        • Activation Lock security
        • Managed Lost Mode and remote wipe
        • Shared iPad security
      • Apple Configurator security
      • Screen Time security
    • Glossary
    • Document revision history
    • Copyright
    iBoot and beyond, but it also tells iBoot that it should accept some boot objects being signed by the Secure Enclave with the same key used to sign the LocalPolicy. This policy level supports users that are building, signing, and booting their own custom XNU kernels.

    If the LocalPolicy indicates to LLB that the selected operating system is running in Full Security, LLB evaluates the personalized signature for iBoot. If it’s running in Reduced Security or Permissive Security, it evaluates the global signature. Any signature verification errors cause the system to boot to recoveryOS to provide repair options.

    After LLB hands off to iBoot, it loads macOS-paired firmware such as that for the Secure Neural Engine, the Always On Processor, and other firmware. iBoot also looks at information about the LocalPolicy handed to it from LLB. If the LocalPolicy indicates that there should be an Auxiliary Kernel Collection (AuxKC), iBoot looks for it on the file system, verifies that it was signed by the Secure Enclave with the same key as the LocalPolicy, and verifies that its hash matches a hash stored in the LocalPolicy. If the AuxKC is verified, iBoot places it into memory with the Boot Kernel Collection before locking the full memory region covering the Boot Kernel Collection and AuxKC with the Protecting keys in alternate boot modes

    Download this guide as a PDF

    Helpful?
    Character limit: 250
    Maximum character limit is 250.
    Thanks for your feedback.
    Previous Memory safe iBoot implementation Next Boot modes

    Apple Footer

     Apple
    1. Support
    2. Apple Platform Security
    3. Boot process for a Mac with Apple silicon
    United States
    Copyright © 2025 Apple Inc. All rights reserved.
    Site Map

    Follow Lee on X/Twitter - Father, Husband, Serial builder creating AI, crypto, games & web tools. We are friends :) AI Will Come To Life!

    Check out: eBank.nz (Art Generator) | Netwrck.com (AI Tools) | Text-Generator.io (AI API) | BitBank.nz (Crypto AI) | ReadingTime (Kids Reading) | RewordGame | BigMultiplayerChess | WebFiddle | How.nz | Helix AI Assistant