Secure Attention Key (Trusted Path)¶
A reserved user-invoked attention input that moves a sensitive exchange from an ordinary interface to a distinguishable trusted system path when enabled and correctly handled.
Core Idea¶
A secure attention key is a reserved action that lets a user ask the system for a protected interaction before entering a password or issuing another sensitive command. The value comes from the route: an ordinary application should not be able to replace the system's trusted response with its own convincing imitation. Pressing a key is only the request; the protected interaction is the result. The action does not itself authenticate the user.[ref-859715ebaa5b][ref-edb456812eea][^ref-f6193e49e898]
The inspected Winlogon/GINA-era Windows design uses Ctrl+Alt+Del to switch to the protected Winlogon desktop. On an AIX terminal with SAK enabled, Ctrl-X followed by Ctrl-R can establish a trusted path to a new login screen or trusted shell. These are two implementations of the same reserved-event, trusted-handler, protected-outcome pattern, with different keys and transition mechanics.[ref-859715ebaa5b][ref-edb456812eea][ref-f6193e49e898][ref-fcd9b5e67233]
Scope of Application¶
Use this entry when a deliberate attention input has a registered or configured trusted handler and produces a distinguishable protected system interaction. Check all three conditions in the actual deployment. A disabled AIX terminal or an ordinary application-drawn login prompt does not satisfy the role test, even if the keys or screen look familiar.[ref-859715ebaa5b][ref-edb456812eea][^ref-fcd9b5e67233]
The sources establish the described historical Windows design and configured AIX route, not every modern operating-system configuration. The Linux kernel document treats Alt-SysRq-K as a disfavored shortcut and reports that Linux SAK is said not to meet the C2 notion, though its author does not know why. That document is a warning against treating a process-killing key as proof of the stronger trusted-path guarantee.[^ref-b28a409d4e6d]
Clarity¶
“The user pressed Ctrl+Alt+Del” can refer to the physical chord, a registered secure attention event, the protected desktop transition, or a later authentication dialogue. The security claim depends on the chain between them. The Windows design also permits authorized alternate SAS notification routes, so “only the kernel ever receives this event” would be too broad.[ref-859715ebaa5b][ref-edb456812eea]
On AIX, the resulting screen matters: IBM describes a new login screen or trusted shell prompt as ways to recognize the trusted path. This says something about the interaction route, not whether the user's identity has been verified.[^ref-f6193e49e898]
Manages Complexity¶
Four questions make the mechanism easier to inspect: What ordinary screen could be spoofed? What input is reserved and who handles it? What protected state appears? What should the user do next? These questions apply to both a Windows desktop and an AIX terminal without assuming they use the same keys or stop the same processes.[ref-859715ebaa5b][ref-edb456812eea][^ref-f6193e49e898]
The shorthand has limits. A user who enters credentials before invoking the route does not protect that earlier exchange. A compromised privileged login component can still steal credentials. AIX can enable SAK for one terminal and disable it for another.[ref-edb456812eea][ref-fcd9b5e67233]
Abstract Reasoning¶
Trace the action from input through its handler to the resulting screen. Ask whether an ordinary application can intercept or imitate that transition. If the handler does not produce a protected interaction, the keypress alone does not establish a trusted path. If the user does not use that path before a sensitive exchange, the path cannot retroactively protect it.[ref-859715ebaa5b][ref-edb456812eea][^ref-fcd9b5e67233]
Knowledge Transfer¶
The same route test transfers from a protected desktop to a configured terminal, while keys, policies, and handler components must be checked anew. Outside operating-system interaction, a request for a trusted channel may be an analogy, but it is not automatically this named mechanism. The live Boundary Prime is an internal constituent: an operative line separates ordinary spoofable interaction from the protected side, with selective crossing through the authorized route. Boundary exists in many other systems without a secure attention key.
Example¶
In the inspected Windows design, Winlogon registers Ctrl+Alt+Del before applications can hook it and switches to its protected desktop for the ensuing dialogue. Brown recommends invoking SAS before entering a password. The application desktop is the spoofable surface, the registered sequence is the reserved event, and the desktop switch supplies the protected outcome.[ref-859715ebaa5b][ref-edb456812eea]
On an AIX terminal where SAK is enabled, Ctrl-X then Ctrl-R can replace an ordinary terminal interaction with a trusted login screen or shell. IBM warns that this action may stop processes accessing that terminal; process termination is a specific implementation cost, not a necessary feature of every secure attention key.[ref-f6193e49e898][ref-fcd9b5e67233]
Relationships to Other Abstractions¶
Current abstraction Secure Attention Key (Trusted Path) Domain-specific
Parents (1) — more general patterns this builds on
-
Secure Attention Key (Trusted Path) is part of Boundary Prime
An operative Boundary between ordinary and protected interaction is an identity-bearing constituent of the trusted attention route.
Hierarchy path (1) — routes to 1 parentless root
- Secure Attention Key (Trusted Path) → Boundary
Neighborhood in Abstraction Space¶
Secure Attention Key (Trusted Path) sits in a sparse region of the domain-specific corpus (100th percentile for distinctiveness): few abstractions share its structure, so a faithful description tends to retrieve it precisely.
Family — Unclustered & Miscellaneous (2721 abstractions)
Nearest neighbors
- File Association — 0.75
- Object-Oriented Operating System — 0.73
- Rate-Limit Absence — 0.73
- Secure Channel — 0.73
- Keyboard Accessibility — 0.73
Computed from structural-signature embeddings · 2026-10-17
Not to Be Confused With¶
Authentication may occur after the transition, but the key itself does not issue an identity verdict. Access Control concerns authorization decisions that this event does not itself make. Interface has a fuller contract and independent-evolution structure not established by these cases. Boundary is the constituent separating ordinary and protected interaction; the key is a user-invoked route across it. A disabled hotkey, a convincing fake prompt, or Linux Alt-SysRq-K alone does not prove the claimed path.[ref-edb456812eea][ref-fcd9b5e67233][^ref-b28a409d4e6d]
References¶
[^ref-859715ebaa5b]: Microsoft, “Initializing Winlogon,” Microsoft Learn, https://learn.microsoft.com/en-us/windows/win32/secauthn/initializing-winlogon. Official full page consulted, especially registration of Ctrl+Alt+Del and the protected Winlogon desktop, lines 31–43. [^ref-edb456812eea]: Keith Brown, “Customizing GINA, Part 1,” Security Briefs, Microsoft Learn archive of MSDN Magazine (2005), https://learn.microsoft.com/en-us/archive/msdn-magazine/2005/may/security-briefs-customizing-gina-part-1. Full authored article consulted, especially lines 54–58, 68–73 and 153–169. Printed article heading is “Security Briefs: Customizing GINA, Part 1.” [^ref-f6193e49e898]: IBM, “Using the Secure Attention Key,” IBM AIX 7.2 Documentation, https://www.ibm.com/docs/en/aix/7.2.0?topic=options-using-secure-attention-key. Official full page consulted, lines 4–16. [^ref-fcd9b5e67233]: IBM, “Configuring the Secure Attention Key,” IBM AIX 7.2 Documentation, https://www.ibm.com/docs/en/aix/7.2.0?topic=options-configuring-secure-attention-key. Official full page consulted, lines 4–15. [^ref-b28a409d4e6d]: Andrew Morton, “Linux Secure Attention Key (SAK) handling,” The Linux Kernel Documentation, original text dated 18 March 2001, https://docs.kernel.org/security/sak.html. Full maintained documentation page consulted, especially lines 15–35 and 57–65; its C2 remark explicitly records uncertainty.