Microsoft Pluton vs M1 chips?

[iphonefreak450]

I’m still running on an M1 MacBook Pro which I assume the M1 is the Apple Silicon chip. Not really a tech person. Sorry.

My question is, recently, MS announced their chip called the Pluton and I’m just wondering if these Pluton chips would be the equivalent of the M1 Apple Silicon chips?

 

[mr_roboto]

I’m still running on an M1 MacBook Pro which I assume the M1 is the Apple Silicon chip. Not really a tech person. Sorry.

My question is, recently, MS announced their chip called the Pluton and I’m just wondering if these Pluton chips would be the equivalent of the M1 Apple Silicon chips?

Pluton was announced many years ago and is just a security chip, not anything comparable to a whole M1 chip. It's roughly the equivalent of Apple's Secure Enclave, a subsystem built into all Apple Silicon chips (including M1).

I actually shouldn't say Pluton is a "chip" because Microsoft put it out there as a licensable subsystem other companies could incorporate into their chip designs. Intel, AMD, and Qualcomm have all talked about incorporating it into their chips. AMD and Qualcomm have a couple products on the market with a Pluton security processor.

 

[FreakinEurekan]

M1 is closer to the “Windows on ARM” processors, e.g. the Qualcomm Snapdragon.

 

[iphonefreak450]

So actually Pluton is like the equivalent of Apple’s Security Enclave on Apple Silicon such as the M1 and beyond?

So if I decide to want more security should I choose the Pluton machines or stick with the MacBook Pro which has the Security Enclave?

 

[FreakinEurekan]

You have excellent security on your M1.

 

[dmccloud]

Given the issues just discovered with Microsoft's new Recall feature (the supposedly secure storage of user data is actually in a plaintext, non-encrypted SQL database), I wouldn't trust Microsoft with anything even remotely related to security and privacy.

 

[deconstruct60]

Given the issues just discovered with Microsoft's new Recall feature (the supposedly secure storage of user data is actually in a plaintext, non-encrypted SQL database), I wouldn't trust Microsoft with anything even remotely related to security and privacy.

Not sure Microsoft ever claimed it was 'secure storage'. It was more local storage ( as opposed to harvested to the clould. ). Most Windows 11 laptops have some basic bitlocker encryption (in part why TPM is being pushed as a 'requirement'. ) . So the data 'at rest' could be encrypted. This extended security issue is more so trying to hide the data from other programs run by the same user on their system.

" ...
We built privacy and security into Recall's design from the ground up. With Copilot+ PCs, you get powerful AI that runs locally on your device. No internet or cloud connections are required or used to save and analyze snapshots. Your snapshots aren't sent to Microsoft. Recall AI processing occurs locally, and your snapshots are securely stored on your local device only.

Snapshots are encrypted by Device Encryption or BitLocker, which are enabled by default on Windows 11. Recall doesn't share snapshots with other users that are signed into Windows on the same device. Microsoft can't access or view the snapshots. ...
..."

Privacy and control over your Recall experience - Microsoft Support

support.microsoft.com

It is basically the same security you have from your apps snooping in data stored by other programs.


Apple for years allowed just about any program to snoop into your contacts app data.

Likely a bigger issue with Recall is churning the write data on your SSD at significantly higher levels. Turning it off because it doing that would just sidestep the security issues.

 

[deconstruct60]

So actually Pluton is like the equivalent of Apple’s Security Enclave on Apple Silicon such as the M1 and beyond?

"Equivalent" is the wrong connotation. There is a common subset of things they do, but also substantive differences.

Pluton was mainly trying to be a "next gen" TPM solution. A proposed standard across implementations for security, but doing away with the aspect of being implemented as a discrete chip.

" ...
Microsoft Pluton is designed to provide the functionality of the Trusted Platform Module (TPM) and deliver other security functionality beyond what is possible with the TPM 2.0 specification, and allows for other Pluton firmware and OS features to be delivered over time via Windows Update. For more information, see Microsoft Pluton as TPM.
..."

Microsoft Pluton security processor

Learn more about Microsoft Pluton security processor

learn.microsoft.com

Pluton doesn't throw out UEFI boot process. Apple's approach does. Part of the security issue here is how does on validate the 'stack' of the root of trust all the way down to the hardware. How the boot firmware gets validated is part of the security issue. What is common here between "Secure Enclave" and "Pluton" is securing the communication path between the central processor and the 'helper' security processor by putting them all on the same die ( hence no path for a man-in-the-middle attack ).

Pluton is 'open enough' that there is some nominal Linux support.

Linux 6.3 To Support Pluton's CRB TPM2 On AMD Ryzen CPUs - Phoronix

www.phoronix.com

Portions of the "free software" base protested about TPM signed checks for operating systems , so protests against Pluton were not surprising. Putting the security subsysem inside the central processor package means it isn't 'optional' or a 'discrete add-on'. Folks choices are more limited as to whether it is there or not.

So if I decide to want more security should I choose the Pluton machines or stick with the MacBook Pro which has the Security Enclave?

Choosing Pluton is mainly choosing Windows. It isn't so much as 'more security' issue , but a different boot security approach issue. Pluton is choosing Window's boot security preferences and likely future requirements.
Choosing Apple's implementation is choosing Apple's boot preferences and requirements.

Intel's recent Lunar Lake has introduced a "Partner Security Engine". System vendors can implement a compatible Pluton implementation with it. Or something else if they think that "something else" is 'better' ( what is 'better' varies among individuals/organizations. By Windows 13 (or so) integrated security processor could be the evolution of the TPM 'functionality' requirement that Windows 11 laid down.


" ...
Dell, quoted by the Register, mentioned the following regarding Microsoft Pluton:

“Pluton does not align with Dell’s approach to hardware security and our most secure commercial PC requirements…as with all new technologies, we will continue to evaluate Pluton to see how it compares against existing TPM implementations in the future.”
..."

Microsoft Pluton Security

Find out about Microsoft Pluton — a new hardware security chip from Microsoft, and what challenges does it meet

www.starwindsoftware.com

Intel's VPro was another approach ( and since Dell was at that time a super Intel fan.. pluton wasn't for them). What Microsoft is mainly doing with Pluton is trying to get some standard that would cross SoC vendor lines.


The general overall industry push toward 'passkeys' only going to push for required "secure key handler' hardware just be present in all new systems. If buying something with a new SoC going forward there isn't going to be a gap here. [ long time ago a floatpoint processing was an optional 'add-on' for PCs. Further back didn't necessarily have a GPU. Now those are basically assumed 'givens' in the PC space. Same thing about basic 'key handling' by 2025 point. ]

 

[iphonefreak450]

The reason why I’m asking to be honest, is that I use Windows as well along with my Mac and due to attackers with physical access to the devices running Bitlocker on Windows could bypass the Bitlocker encryption using what’s called a DMA attack. And Pluton would mitigate these types of attacks.

So my question is, are the Macs also susceptible to these DMA attacks running on Apple Silicon chips with FileVault encryption enabled?

 

[CWallace]

The reason why I’m asking to be honest, is that I use Windows as well along with my Mac and due to attackers with physical access to the devices running Bitlocker on Windows could bypass the Bitlocker encryption using what’s called a DMA attack. And Pluton would mitigate these types of attacks.

So my question is, are the Macs also susceptible to these DMA attacks running on Apple Silicon chips with FileVault encryption enabled?

If an attacker has physical access to your machine, the chances of it being compromised rise significantly, regardless of the hardware OEM and OS it is running.

 

[mr_roboto]

The reason why I’m asking to be honest, is that I use Windows as well along with my Mac and due to attackers with physical access to the devices running Bitlocker on Windows could bypass the Bitlocker encryption using what’s called a DMA attack. And Pluton would mitigate these types of attacks.

So my question is, are the Macs also susceptible to these DMA attacks running on Apple Silicon chips with FileVault encryption enabled?

Current Macs do support DMA peripherals, because Thunderbolt supports DMA. However, they are not vulnerable to DMA attacks since Apple isolates all DMA devices to approved address ranges using an IOMMU. Basically, when first attached, a DMA peripheral is completely untrusted and not allowed to read or write anything. Later, once a device driver initializes and sets up some memory buffers for the DMA device to use, macOS reconfigures the IOMMU to permit the device to access just those approved buffers and nothing else.

There's an additional layer of defense for FileVault boot volumes on internal SSDs: on T2 Intel Macs and all Apple Silicon Macs, the decryption key for such volumes is stored inside the Secure Enclave, does not have to leave the SE to unlock the FileVault volume (because the SE does all FV encryption and decryption itself), and nothing inside the SE is addressable from outside the SE. So even if someone figures out how to bypass Apple's IOMMU protections, they can't get at the secrets required to decrypt the whole disk. (They would, however, be able to look at the contents of any files that were currently open and cached in RAM at the time of the attack. FileVault encryption only protects data at rest, i.e. data that's on disk.)

 

[deconstruct60]

The reason why I’m asking to be honest, is that I use Windows as well along with my Mac and due to attackers with physical access to the devices running Bitlocker on Windows could bypass the Bitlocker encryption using what’s called a DMA attack. And Pluton would mitigate these types of attacks.

Previously TPM devices storing authentication , a Opal standard (with competent implementation) drive encryption , and a clean hand off between TPM and drive would close the hole. If I recall correctly the DMA probe is looking for the software Bitlocker encryption key. On an Opal drive the encryption key is inside the drive. But you do need to identify/authenticate yourself to the drive.

In the subset of TPM , Pluton has some Secure Hardware Cryptography Key (SHACK) technology that keeps keys inside of the Pluton 'enclave'. So there is no man-in-the-middle PCI-e channel to perhaps pluck off the authentication keys if transfered from TPM to Opal Drive.

Part of the root cause of the DMA attack is kernel code being able to probe anywhere in the kernel address space unrestricted. Putting the drive encryption softare in an 'air gapped' RAM keeps it from DMA access also. But that swaps for an authentication step to the remote RAM space. Pulling the encryption step inside the a isolated place on CPU chip mean outsides can 'jump in' and pretend to be something else.

So my question is, are the Macs also susceptible to these DMA attacks running on Apple Silicon chips with FileVault encryption enabled?

Apple SSDs are encrypted whether you have FileVault turned on or not. ( it is whether the systems using a composed key to open the drive or waits for an authentication to use the key. )