5
$\begingroup$

SEDs use a user password (PIN) to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges and each of these ranges uses its own MEK (say MEK1 - MEK9). There are also 4 Admins and 8 Users, each has its own password. Which of these passwords are used to generate the KEK, or are there multiple KEKs? The TCG core spec and the Opal SSC spec don't detail the relation of a password to the MEK of any locking-range. Self Encrypting Drive Encryption key flow

Links:

TCG Storage architecture core spec: https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage_Architecture_Core_Spec_v2.01_r1.00.pdf

TCG-Opal: https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage-Opal_SSC_v2.01_rev1.00.pdf

TCG and NVMe Joint white paper: https://nvmexpress.org/wp-content/uploads/TCGandNVMe_Joint_White_Paper-TCG_Storage_Opal_and_NVMe_FINAL.pdf

Improve this question
$\endgroup$
2
  • $\begingroup$ From page 5 Zero or more Users can be assigned permission to unlock Locking Ranges. It indicates that a MEK is not protected directly by users's password. The details are hidden, we can only predict. You can ask them and they must respond if you want to use this product. Then you can post here? $\endgroup$
    – kelalaka
    Aug 27, 2020 at 9:02
  • $\begingroup$ Agree, these users are permitted to unlock a locking-range, but do not seem to take part in the creation of KEK, or maybe there is no KEK at all? This is not likely, because: a. the SED keys flow (the figure in the question) appears in many TCG-storage documents, b. it doesn’t feel secure enough that an SED has MEKs that do not require external input (password) to unwrap them. I’m looking into it and will publish what I find of course, but I don’t have anyone to ask (except this platform). $\endgroup$
    – alonco
    Aug 27, 2020 at 9:54

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.