alt Hacker News> What happens here is that the secure enclave, cryptographic accelerator and flash controllers are all packaged together. This gives you sick speeds and performance while also making it more secure than your average OPAL TCG trash that often isn't even implemented at all.
Apples SSD performance is nothing special, and if they wisely don't want to trust OPAL TCG they can encrypt the data in their own trusted silicon before handing it over to the untrusted SSD controller. That's pretty much what the Playstation 5 does, it supports standard NVMe drives but the disk encryption is done in custom Sony silicon so the third party SSD controller never sees the plaintext.
I'm not convinced there's any purpose for the way Apple does their storage aside from vendor lock-in.
Replies
You don't become a $3tn company by respecting and liberating users.
I don't think you can get a mass market SSD that does what this thing does. Not unless you change some parameters. The speeds and bandwidth you get is always with full encryption for all blocks. That might not be special to you, but doing this mass market in a way that doesn't make exploits and bypasses appear faster than the manufacturers can patch it (looking at TCG, BitLocker etc) is definitely special to me.
As for that other methods may work (making the chain longer by introducing a separate bus, two transceivers, an additional controller from another vendor, extra firmware, extra power buses), they have done that in the past. In practically every shape:
- SCSI
- ATA/IDE
- SATA
- NVMe over custom physical port before M.2 was broadly available with the same specs, but probably also cheaper for them
So technology wise, it's not like they haven't gone back and forth with many, many combinations.
Business-wise:
> I'm not convinced there's any purpose for the way Apple does their storage aside from vendor lock-in.
First of all, I highly doubt Apple gives a shit. Their model of lock-in is making a better combined experience than the competition. If they could do that with some random western digital black SSD while making the same amount of money, they would do it. But more importantly: if Apple would do that, they would still charge you $1000 for that SSD, even if it's only 1TB. The concept of lock-in is making it so that people don't want to pay the cost of leaving. You can't lock people in with just the stick (an SSD-shaped stick with a $1000 price tag) if you don't have a carrot.
Secondly: I don't want or need to convince you, but trying to shoehorn a business in such a one-dimensional take is not exactly a good way to spend your energy.
There's a lot of reasons but IMHO the engineering answer is that the firmware is stored on the SSD, not on a random SPI NOR sitting on the PCB. So rather than having to support a wide variety of SATA controllers or do PCIe training (because few vendors implement the spec well so you gotta do a bunch of hacks to get it to work), they have a single storage controller that the SecureROM talks to. Then LLB and iBoot bring up more and more of the storage stack. Apple documents some of it here:
https://support.apple.com/guide/security/boot-process-secac7...