Researchers extract Intel's secret key for encrypting and decrypting security updates that patch vulnerabilities on its Goldmont architecture-based CPUs
Dan Goodin / Ars Technica : Tweets: @dangoodin001 Tweets: Dan Goodin / @dangoodin001 : The research behind this hack is stellar. It opens the door to tethered jailbreaks and rooting like those done on iOS and Android devices or the 2010 hack of the Sony PS3. The security consequences still aren't clear, but the researchers' comparison to the red pill is spot on. https://twitter.com/...
Context & Ripple Effects
This is a different class of break than the extraction research Intel has been living with. Earlier work pulled per-device secrets — disk encryption keys out of Qualcomm-powered Android devices in 2016, data via Intel's power-monitor interface, and unpatchable key leakage from Apple's M-series chips in 2024. What the researchers extracted here is Intel's own root key for encrypting and decrypting security updates on Goldmont CPUs — the credential that vouches for the patch pipeline itself.
That distinction is why the researchers' comparison to the PS3 break and to mobile jailbreaks lands: a compromised root key doesn't expose one machine's data, it lets arbitrary code present itself as an official Intel security update. For a vendor whose patch credibility is the product, that is the worst layer to lose.
First-order effects
- Intel's Goldmont update channel can no longer be treated as authentic on its own: anything signed with the extracted key decrypts and installs as a legitimate security update, so every Goldmont deployment — a low-power architecture widely embedded in appliances, IoT, and industrial hardware — is now in trust-limbo until Intel responds.
- Security researchers gain a tethered-jailbreak primitive on Goldmont silicon: with the key in hand, unsigned code can be dressed as official updates, the same unlock dynamic that reshaped iOS and Android research after root keys leaked.
Second-order effects
- Intel is pushed toward revocation and re-keying mechanisms for already-shipped Goldmont parts — a costly retrofit problem, since the key lives in deployed silicon that cannot be recalled, and the 2020 power-monitor disclosure shows Intel's side-channel surface was already forcing patch cycles that same quarter.
- The finding hands every chip vendor's customers a fresh question about attestation: Apple's unpatchable M-series key leak and this Intel root-key extraction together make 'the key is safe because it's in the chip' a claim buyers will start auditing rather than accepting.
Third-order effects
- If extraction techniques keep maturing from per-device secrets toward vendor root keys — the trajectory running from the 2016 Qualcomm work through this Goldmont result — the industry's signed-update model shifts from 'secret key, indefinitely trusted' to keys designed for rotation, revocation, and hardware-level compartmentalization from day one.
- Regulators and enterprise buyers are likely to start treating root-of-trust key custody as a disclosed, auditable property of silicon procurement, the way side-channel resistance became a spec line after a decade of Meltdown-class disclosures.
The trend: Silicon vendors' root-of-trust keys are proving extractable one architecture at a time, pushing the industry from perpetual secret keys toward revocable, rotatable update infrastructure baked into chip design.