I think you misunderstand.

The idea is that if your keyboard is replaced with a keyboard that has modified (hacked) firmware, your computer will refuse to let you use it.

To do this, it must obtain a cryptographic attestation from the keyboard firmware, proving that it has not been modified. Further, to avoid replay attacks it must include the current time in the message it signs. NTP is used by macOS to determine the current time, so as to verify the signature provided by the keyboard.

So, if NTP is slow to respond or time out, you are stuck waiting for your Mac to verify your keyboard's signature.

If I was an attacker I would simply hook into the key matrix. The extra obfuscation in firmware is just user-hostile and stupid.

So they introduce a major usability breaker (consider opening up your macbook on a plane with no internet access) to prevent a really obscure security issue that requires an attacker to replace the entire system's top case without you noticing. Nice.

At least give the user the ability to turn that off.

What happens if you have networking turned off or your WiFi isn't configured for the local network?

Per the grandparent...

> At the same time, if you were to not be connected to a network, this kind of verification wouldn't do anything.

> Further, to avoid replay attacks it must include the current time in the message it signs.

Use a counter...?

I'm not trying to defend Apple here, just explain the mechanism to the parent.

Oh, okay. You said "must" so I was wondering if there was another important factor.

Sorry, that wasn't the best word choice. Certainly a counter is another viable way of performing that check. (And obviously comes with its own set of trade-offs which I'm not interested in performing value judgments on!)

I was thinking of an external keyboard. That might be the cause of confusion.