Apple internals #8: Pointer authentication
Summary
This article explains Apple’s arm64e pointer authentication (PAC), detailing how signatures are stored in pointer bits and verified at use, and how keys and modifiers shape security guarantees. It includes hands-on demonstrations, explores failure modes, and discusses state-of-2026, showing that PAC does not fix all bugs and that some attacks shift to the detector or fault rather than the pointer. The piece ties PAC to real-world risks like return-oriented programming, discriminator reuse, and kernel continuities, offering a deep dive into current defenses and remaining gaps.