Micron 7400 SSD Controller Sub Chip Security Subsystem

Certificate

Approved Algorithms (12)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Micron 7400 SSD Controller Sub Chip Security Subsystem
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>Firmware Load<br/>Update</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>bootloader<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C6 clue;
  class I2,I3,I6 infer;
  class R2,R3,R6 risk;
  class E2,E3,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Micron 7400 SSD Controller Sub Chip Security Subsystem
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>Firmware Load<br/>Update</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>bootloader<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C6 clueLow;

Security Policy, page by page

Micron Technology Micron Technology Micron 7400 SSD Controller Sub Chip Security Subsystem Non-Proprietary FIPS 140-3 Security Policy Document Version: 1.3 Date: April 11th, 2024 Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology Table of Contents Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology List of Tables Table 4

• Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed List of Figures Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Controller Security Subsystem module, hereafter denoted as the Module. The Module is a Single Chip Hardware sub-chip cryptographic subsystem, as defined in FIPS 140-3 Implementation Guidance 2.3.B. The FIPS 140-3 security levels for the Module are as follows: Table 1

• Security Levels ISO/IEC 24759 Section FIPS 140-3 Section Title Security Level 6. [Number Below]

1 General 2

2 Cryptographic Module Specification 2

3 Cryptographic Module Interfaces 2

4 Roles, Services and, Authentication 2

5 Software/Firmware Security 2

6 Operational Environment N/A

7 Physical Security 2

8 Non-Invasive Security N/A

9 Sensitive Security Parameter Management 2

10 Self-Tests 2

11 Life-Cycle Assurance 2

12 Mitigation of Other Attacks N/A

Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

The Module is a Single Chip Hardware Sub-Chip cryptographic module operating on a single chip embodiment. The Module is intended for use by US Federal agencies or other markets that require FIPS 140-3 validated cryptographic controllers. The Module is embedded in the ASIC 7400 Controller package (see Figure 1 below). Figure 1

• Micron 7400 ASIC

The cryptographic module is tested on the following operational environment. Table 2

• Cryptographic Module Tested Configuration Model Hardware [Part Number and Firmware version Distinguishing version] Features Micron 7400 SCCS v1.0 Runtime SCSS v2.3 Tested Configuration: SSD Controller Bootloader v1.0 7400 SSD Security Controller v20190703 Function ROM v2.0 Subsystem Boot ROM v1.0 Module operational environment information is provided from the Module from the get status service and is returned from the controller as TCG Level 0 discovery content.

The physical form of the Module is depicted above in Figure 1. The cryptographic boundary of the Module is defined by the Security Subsystem and includes all cryptographic algorithm implementations. The physical embodiment is the Micron 7400 Controller ASIC and includes its package. The cryptographic boundary is depicted by the red outline line in Figure 2 below. The Module is a Single Chip Hardware Sub-Chip cryptographic module operating on a single chip embodiment. Table 2 above specifies the firmware components of the module. Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology M7400 SSD M7400 Controller NAND NAND NAND NAND NAND NAND NAND NAND NVMe Security Subsystem NAND NAND NAND NAND Figure 2

• Module

The Module only supports an Approved mode and cannot be configured to operate otherwise. To verify that the Module is in the Approved mode of operation, the operator may invoke the “Get Status” service, which will indicate the Approved mode of operation, as well as the version information for the Module. The following states are defined for the module.

• Firmware Load State
• In this state, the Module is capable of performing self-tests, key manifest verification, and firmware loading.
• NVMe State
• In this operating state, TCG ownership of the drive has not been taken. In this state the SSD provides services through NVME industry standard commands.
• TCG State
• Once TCG ownership has been taken the Module shall operate in this state. In this state the SSD provides services through NVME industry standard commands as well as TCG commands addressed to both the TCG Admin SP and the TCG locking SP. In addition, extra features are provided through the TCG commands. These commands are processed within the controller and are translated into security subsystem services. The Module provides these services to support the TCG mode of operation but is not responsible for TCG management functions. To initialize in this mode, the Module owner must take ownership of the device by invoking the Activate method on the Locking SP. This State has the capability to have multiple Users with independent access control to read, write or erase the data areas (LBA ranges). Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Note: By default, the drive is issued with a single namespace encompassing the whole capacity of the drive. Once the drive is TCG activated this default namespace’s attributes are managed by the TCG “Global Range”.

The Module implements the cryptographic functions listed in table 3 below. The numbers and letters within square brackets reference standards which are defined in the References and Definitions section of this Security Policy. Table 3

• Approved Algorithms CAVP Cert Algorithm Mode/Method Description / Key Size(s) / Key Use / Function and Strength(s) Standard AES-KW [38F] Key Sizes: 256 Authenticated Encrypt, A2520 AES [197] Authenticated Decrypt (Uses Auxiliary ECB) Encrypt, Decrypt AES-ECB [38A] Key Sizes: 256 (Auxiliary) A2522 AES [197] AES-XTS 1 Testing Encrypt, Decrypt Key Sizes: 256 Revision 2.0 [38E] (Auxiliary) Encrypt, Decrypt AES-ECB [38A] Key Sizes: 256 (Datapath) A2523 AES [197] AES-XTS1 Testing Encrypt, Decrypt Key Sizes: 256 Revision 2.0 [38E] (Datapath) [133] Sections 4 and 6.1 Direct symmetric key generation using unmodified DRBG output [133] Section 6.2.2 Symmetric Keys Derived from a VA CKG [IG D.H] Pre-existing Key Key Generation [133] Section 6.2.3 Derivation of symmetric keys from a password [133] Section 6.3 Symmetric Keys Produced by Combining Multiple Keys and Other Data Deterministic Random HASH DRBG A2520 HASH DRBG SHA2-256 Bit Generation [90A] Security Strength = 256 HMACKey Size: 256 Key derivation. Data A2521 SHA2-256 SHA2-256 MAC = 256 Authentication [198] HMAC-SHA2-256 Counter Mode Supported Lengths: 256 A2521 KDF [108] Key Based Key Derivation KDF SP800-108 Fixed Data Order: Before Fixed Data The XTS algorithm implementation includes a check to ensure Key_1 ≠ Key_2. XTS may only be used in storage applications. Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology CAVP Cert Algorithm Mode/Method Description / Key Size(s) / Key Use / Function and Strength(s) Standard Counter Length: 8 Custom Key in Length: 0 CSP A2520 KTS [38F] AES-KW Key Sizes: 256 Wrapping/Unwrapping Key transport methodology provides KTS-IFC n = 20482 SHA2-256 between 112 and 128 A2520 KTS-OAEP-basic [56Br2] n = 30722 SHA2-256 bits of encryption strength; Encapsulation Only. Password Based Key Derivation. Keys derived from passwords may only be used in storage applications. Password length is 32 bytes and sLen = 256 only five attempts are A2520 PBKDF [132] Option 1a C = 300 permitted before a reset HMAC-SHA2-256 is required. The PBKDF iteration count (C) is chosen to be as high as can be tolerated without impacting system boot up performance. n = 2048 SHA2-256 n = 3072 SHA2-256 RSA SigVer A2521 PKCS1_v1.5 Signature verification [186] Public Exponent Mode: Fixed Fixed Public Exponent: 010001 SHA2-256 Message Digest A2522 SHA2-256 [180] Generation The module does not implement any “Non-Approved Algorithms Allowed in the Approved Mode of Operation” or “Non-Approved Algorithms Not Allowed in the Approved Mode of Operation” per SP800140B. Only “Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed” are supported per Table 4 below. Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology Table 4

• Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed Algorithm Caveat Use / Function No security claimed per IG 2.4.A. Generates a 64-byte personalization string for the DRBG. Per [90A], the personalization is entirely optional, is RBG not required to contain any entropy, and may be provided by a nonApproved RBG.

The following table shows the Security Function Implementations that the module implements: Table 5 - Security Function Implementation Name Type Description SF Properties Algorithms/CAVP Cert AES-KW

• AES Key establishment methodology provides 256 KTS KTS Cert. #A2520 bits of encryption strength AES-KW/Cert. #A2520 KTS-IFC - RSA Key transport methodology provides between KTS-IFC KTS Cert. #A2520 112 and 128 bits of encryption strength KTS-IFC/Cert. #A2520

1. The Module provides one distinct operator role: Controller, which acts as the Cryptographic Officer
2. The Module provides role-based authentication.
3. The Module clears previous authentications on reset.
4. An operator does not have access to any cryptographic services prior to assuming an authorized role.
5. The Module allows the operator to initiate power-up self-tests by power cycling power or resetting the Module.
6. Power up self-tests do not require any operator action.
7. Data outputs are inhibited during firmware loading, self-tests, zeroization, and error states.
8. Status information does not contain CSPs or sensitive data that if misused could lead to a compromise of the Module.
9. There are no restrictions on which keys or SSPs are zeroized by the zeroization service, except for the KManifestPUB_ROM.
10. The Module does not support concurrent operators.
11. The Module does not support a maintenance interface or role.
12. The Module does not support manual SSP establishment method.
13. The Module does not have any proprietary external input/output devices used for entry/output of data.
14. The Module does not output plaintext CSPs or intermediate key values. Micron Technology, Inc. Public Material – May be reproduced only in its original entirety (without revision).

Micron Technology

15. The Module does not provide bypass services.
16. The Module zeroizes temporary values generated and used during self-tests.

The Module is embedded within the Micron 7400 controller of the SSD. The Module shall be operated according to Section 11. Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

The Module’s ports and associated FIPS defined logical interface categories are listed in Table 5 above. Table 6

• Ports and Interfaces Physical Port Logical Interface Data that passes over port/interface AESE (encryption engine) Control in | Data in | User data Data out | Status out AESD (decryption engine) Control in | Data in | User data Data out | Status out Mbox (Mailbox) Control in | Status out Service info input Controller output (response to Mbox) Data out Service info output External Interrupt (JTAG, AHB bypass Disabled Disabled and inter-CPU interrupts) Reset/Interrupt Control in None BMG-128 (S-DMA Interface) Data in | Data out Service info data (command/response) Power Power in None JTAG / AHB-32 bypass Disabled Disabled LDPC Decoder Data In Firmware Images UART Status out Status Data Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

The Module supports one distinct operator role, Controller (Cryptographic Officer). Table 6 lists the operator role supported by the Module and their related services. In addition to the services listed in Table 6, the Module also supports a Self-Test service, which is invoked by power cycling the Module. The Module does not support a maintenance role or bypass capability. The Module does not support concurrent operators. Table 7

• Roles, Service Commands, Input and Output Role Service Input Output Any Self-Test N/A N/A Controller SUP Authenticate Password Response Controller SUP Generate None Encrypted blob Controller TCG Authenticate Wrapped RdsKey or Response SumRdsKey, Password Controller Clear TCG Authentications None Response Controller Random Size/Location Random Value Controller NVMe Allocate and associate Key Namespace Information Response Controller NVMe Deallocate and disassociate Namespace information Response Key Controller NVMe Update Key Namespace information Response Controller Public HMAC Generation Target input HMAC Controller Load Range and Key Range and key (index) Response Information Controller AWOR None Encrypted block Controller TCG Allocate and associate Key Range Information Response Controller TCG Deallocate and disassociate Key Range Information Response Controller TCG Update Key Range Information Response Controller TCG Set PIN Password Response Controller TCG Revert, Activate, Reactivate Command information Response Controller TCG HMAC Generation Target HMAC HMAC Controller Manifest Load Manifest Verification status Controller CSP Load CSP Block Verification status Controller Write/Read Read/Write Location Read information Status Controller Get Status None Status Controller Firmware Signature Check Firmware block Verification status Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Role Service Input Output Controller Factory Auth Signature Verification status Controller* Device Deprovision Deprovision ID Status Controller* Generate KeyDerivationKey Mode Status Controller* Zeroize None Status *Requires additional authorization

The role-based authentication methods are defined in Table 8 below. Table 8

• Roles and Authentication Role Authentication Method Authentication Strength Controller Signature Verification RSA 2048/3072 has a key strength of 112/128 bits. The probability of a successful verification from a single random attempt is at least 1/2112 which is < 1/1,000,000. This effectively eliminates the possibility of determining the private key through exhaustive methods. Using a conservative estimate of 1ms per verification attempt, the maximum number of attempts which can be made in 1 minute is 60,000. This results in a probability of at least 60,000/2112 that multiple attempts in a given minute of time is successful, which is less than 1/100,000.

All services implemented by the Module are listed in the Table 9 below. The services provided by the Module are defined in terms of the services being exposed at the Module (logical) boundary. Each service description also describes the operator roles involved along with the interface command associated with the service. The SSPs modes of access shown in Table 9 are defined as:

• G = Generate: The Module generates or derives the SSP.
• R = Read: The SSP is read from the Module (e.g., the SSP is output).
• W = Write: The SSP is updated, imported, or written to the Module.
• E = Execute: The Module uses the SSP in performing a cryptographic operation. Implicitly include Read.
• Z = Zeroize: The Module zeroizes the SSP. The service indicator for approved services is the return code from an approved security service call (CCS). CCS = Command completion status, complies with the Approved Security Service Indicator defined in IG 2.4.C, Example Scenario #2. Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Table 9

• Approved Services Keys and/or SSPs Roles Access Indicator rights to Approved Security Service Description Keys Functions and/or SSPs Self-Test Run KAT tests on all All NA Any N/A CCS cryptographic algorithms. This service is unauthenticat ed. SUP Authenticate Unwrap SUP blob using PBKDF, AES-KW Password; Controller W, E CCS PBKDF derived key. PasswordWrapKey G, E SUP Generate KTS-IFC wrap an internally DRBG, CKG DrbgState; Controller W, E; CCS generated random. KTS-IFC, KDeviceWrappingPub; E; AES-KW, PasswordWrapKey; G, E, Z; PBKDF SUP Seed G, E, Z TCG Authenticate Unwrap TCG SSP using PBKDF PBKDF, AES-KW, CKG Password; Controller E; CCS derived key. SumRDSKey; W; RdsKey; W; PasswordWrapKey; G, E, Z; AuthenticatedUseHmacKey; E; EphemeralSumRdskWrapKey E Clear TCG Remove status of all past NA NA Controller N/A CCS Authentications authentication and their privileges Random Returns a 256-bit random DRBG DrbgState Controller E, W CCS number NVMe Allocate and Generate a key, wrap key and DRBG, AES-KW, CKG DrbgState; Controller E, W; CCS associate Key associate key with an entity. WrapKey; E; RdsKey; G, E, R; SumRdsKey; G, E, R; NamespaceDEK; G, R; AuthenticatedUseHmacKey; E; EphemeralSumRdskWrapKey E NVMe Deallocate Zeroize key and disassociate AES-KW NamespaceDEK; Controller Z; CCS and disassociate key from an entity. WrapKey; E; Key AuthenticatedUseHmacKey E NVMe Update Key Erase user data in a DRBG, AES-KW, CKG DrbgState; Controller E; CCS namespace by changing the WrapKey; E; encryption key RdsKey; E; SumRdsKey W, E; NamespaceDEK; Z, G, R; LockingObjectDEK; Z, G, R; AuthenticatedUseHmacKey; E; EphemeralSumRdskWrapKey E Public HMAC Generate an HMAC over the HMAC SHA2-256 RootPublicMacKey; Controller E; CCS Generation prescribed content. PspHmacKey E Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Keys and/or SSPs Roles Access Indicator rights to Approved Security Service Description Keys Functions and/or SSPs Load Range and Key Load DEK into DPE for AES-KW TweakKey; Controller W; CCS indicated range LockingObjectDEK; W; NamespaceDEK; W; RdsKey; E; SumRdsKey; W, E; WrapKey; E; EphemeralSumRdskWrapKey E; AWOR Save, restore security KDF, AES-KW, HMAC, AworWrapKey; Controller E; CCS operational context. CKG AworHmacKey; E; DrbgState; W, R; WrapKey; W, R; AuthenticatedUseHmacKey; W, R; PspHmacKey; W, R; TweakKey; W, R; RdsKey; W, R; SumRdsKey; W, R; RootHmacKey; W, R; RootKeyWrapKey; W, R; RootPublicMacKey; W, R; EphemeralSumRdskWrapKey W, R TCG Allocate and Generate a key, wrap key and DRBG, DrbgState; Controller E; CCS associate Key associate key with an entity. WrapKey; E; AES-KW, RdsKey; G, E, R; CKG SumRdsKey; G, E, R; LockingObjectDEK; G, R; EphemeralSumRdskWrapKey E; ; E AuthenticatedUseHmacKey TCG Deallocate and Zeroize key and disassociate NA WrapKey; Controller E; CCS disassociate Key key from an entity. LockingObjectDEK Z, R; AuthenticatedUseHmacKey E; TCG Update Key Erase user data in a DRBG, AES-KW, DrbgState; Controller E; CCS namespace by changing the WrapKey; E; encryption key. CKG RDSKey; E; SumRDSKey; E, W; LockingObjectDEK; Z, G, R; EphemeralSumRdskWrapKey E; ; E AuthenticatedUseHmacKey Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology Keys and/or SSPs Roles Access Indicator rights to Approved Security Service Description Keys Functions and/or SSPs TCG Set PIN Set PIN which is used in PBKDF, Password; Controller W, E, Z; CCS generating a key to wrap a DrbgState; E; TCG credential. DRBG, WrapKey; E; AES-KW, PasswordWrapKey; G, E, Z; CKG, RDSKey; G, W; HMAC SumRDSKey; G, W; EphemeralSumRdskWrapKey E; ; E AuthenticatedUseHmacKey TCG Revert, Revert to FOB, AES-KW, HMAC, DRBG, RootHmacKey; Controller E; CCS Activate, Reactivate Revert to FOB with TCG CKG DrbgState; E; Activated. WrapKey; E; RdsKey; Z; SumRdsKey; Z; NameSpaceDEK; Z, G; LockingObjectDEK; Z, G; AuthenticatedUseHmacKey E TCG HMAC Generate an HMAC over the HMAC AuthenticatedUseHmacKey; Controller E; CCS Generation prescribed TCG content. DrbgState; R; RootKeyWrapKey; E; TweakKey; R; WrapKey; E, R; Password; G, E; PassordWrapKey G, E Manifest Load RSA Verify trusted list of PKs. RSA Verify KManifestPub_ROM Controller E CCS CSP Load Restore persistent SSPs. AES-KW RootHmacKey; Controller E; CCS HMAC RootKeyWrapKey; E; DrbgState; W; WrapKey; W; AuthenticatedUseHmacKey; W; TweakKey; W; PspHmacKey W Write/Read Encryption / Decryption of DPE-AES-XTS NamespaceDEK; Controller E; CCS user data to / from a user LockingObjectDEK; E; data range. TweakKey E Get Status Get information about the NA NA Controller NA CCS operational state of the drive. This service provides the requisite data for the Show module’s versioning information requirement. Firmware Signature Verify firmware image RSA Verify KFWCBootloaderVerify; Controller E; CCS Check signature before persisting. KFWModuleVerify; E; E KFWControllerVerify Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology Keys and/or SSPs Roles Access Indicator rights to Approved Security Service Description Keys Functions and/or SSPs Factory Auth Authentication for factory- RSA Verify, DRBG KAuthPub; Controller E; CSS restricted services. E; KVSAuthPub; DrbgState E, W Device Deprovision Deprovision the device, NA All CSPs Controller Z CCS zeroize all SSPs. Generate Generate a new DRBG, CKG DrbgState; Controller G, E; CCS KeyDerivationKey KeyDerivationKey. KeyDerivationKey; G, E; Entropy Input; W, E; RootHmacKey; G, E; RootKeyWrapKey; G, E; RootPublicMacKey; G; AworHmacKey; G; AworWrapKey; G; WrapKey; G, E; AuthenticatedUseHmacKey; G, E; PspHmacKey; G; TweakKey G Zeroize Destroys all keys. Must be Factory zeroization All CSPs Controller Z CCS performed under the direct process control of the operator.

The Module is composed of the following firmware components:

• Security Subsystem Operational: Runtime SCSS V2.3
• Security Subsystem Bootloader: Bootloader V1.0
• Function ROM v2.0
• Boot ROM v1.0 The pre-operational firmware integrity tests are performed using RSA SHA2-256 signature verification with a 2048-bit or 3072-bit key. The bootloader and operational runtime firmware are loadable components and are protected with the authentication technique, RSA SHA2-256 signature verification with a 2048-bit or 3072-bit key. Firmware candidates are isolated from load until they have successfully passed the Firmware Load Test. Firmware load and integrity checks are defined in the self-test section of this security policy. The ROM components are implemented in Non-Reconfigurable-Memory and are not subject to firmware integrity test per FIPS 140-3 IG 5.A. The operator can initiate the firmware integrity test on demand by power cycling/resetting the SSD. Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

The Module has a limited operational environment under the FIPS 140-3 definitions. The tested operational environment is listed in Table 2. The Module includes a firmware verification and load service to support necessary updates. Firmware versions validated through the FIPS 140-3 CMVP will be explicitly identified on a validation certificate. Any firmware not identified in this Security Policy does not constitute the Module defined by this Security Policy or covered by this validation. Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

The Module is a Single Chip Hardware sub-chip cryptographic subsystem, and the embodiment is a single chip. The chip is encapsulated in a standard IC package. The IC packaging itself provides the necessary opacity and tamper evidence required for Level 2 conformance. Table 10

• Physical Security Inspection Guidelines Physical Security Recommended Frequency of Inspection/Test Guidance Details Mechanism Inspection/Test IC packaging On initial receipt of the device Inspect for evidence of prying or and periodically afterwards removal of the chip packaging. See Examples below. If tampering is suspected, then the device containing the IC should be removed from service and the site administrator should be contacted. Figure 3
• Tamper Evidence Example

The Module does not implement any mitigation method against non-invasive attack. Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

The SSPs access methods are described in below. The SSPs management methods as shown in Table 11 below are defined as:

• G1 = Externally generated and installed during manufacturing
• G2 = Internally generated using the DRBG
• G3 = Derived using SP 800-108 compliant KBKDF
• G4 = Derived using SP 800-132 compliant PBKDF2
• S1 = Only stored in volatile memory (RAM).
• S2 = Stored in e-Fuse in plaintext
• S3 = Stored in register in plaintext
• S4 = Stored in ROM in plaintext
• E1 = Input in plaintext
• E2 = Input signed and verified using KManifestPub_ROM
• E3 = Input using SP800-38F AES key Transport
• O1 = Output in plaintext public key
• O2 = Output using SP800-38F Key Transport (specify AES key wrap key)
• O3 = Output using KTS-IFC [56Br2]
• Z1 = Zeroized implicitly after use, by Module power cycle, and reset
• Z2 = Zeroized explicitly by the “zeroize” service by overwriting with a fixed pattern

All CSPs and PSPs used by the Module are described in this section. All usage of these SSPs by the Module is described in the services detailed in Section 4.3. The numbers and letters within square brackets reference standards which are defined in the References and Definitions section of this Security Policy. Table 11

• SSPs Key/SSP/Name/T Strength Security Gene- Import /Export Establish Storage Zeroiza- Use & Related ype Function ration ment tion keys and Cert. Number AuthenticatedUse 256 HMAC G2 E3 / O2 by N/A S1 Z1, Z2 Integrity HmacKey #A2521 RootKeyWrapKey verification of or AworWrapKey TCG table data AworWrapKey 256 KTS G3 from N/A N/A S1 Z1, Z2 Key encryption #A2520 KeyDerivat ionKey AworHmacKey 256 HMAC G3 from N/A N/A S1 Z1, Z2 Integrity #A2521 KeyDerivat verification of ionKey TCG context data DrbgState 256 HASH G2 E3 / O2 by N/A S1 Z1, Z2 HASH_DRBG DRBG RootKeyWrapKey internal state (V #A2520 or AworWrapKey and C are each 55 bytes) Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Key/SSP/Name/T Strength Security Gene- Import /Export Establish Storage Zeroiza- Use & Related ype Function ration ment tion keys and Cert. Number EphemeralSumRd 256 KTS G2 E3 / O2 by N/A S1 Z1, Z2 Key wrap of skWrapKey #A2520 AworWrapKey SumRdsKey Entropy Input 256 HASH G1 E1 N/A S1 Z1 128 bytes of DRBG Entropy and 64 #A2520 bytes of Nonce KeyDerivationKey 256 KDF G2 N/A N/A S2 Z2 Master key used #A2521 to derive other keys LockingObjectDEK 256 AES G2 E3 / O2 by RdsKey, N/A S1, S3 Z1, Z2 Data encryption #A2523 SumRdsKey or WrapKey NamespaceDEK 256 AES G2 E3 / O2 by RdsKey, N/A S1, S3 Z1, Z2 Data encryption #A2523 SumRdsKey or WrapKey Password 256 PBKDF N/A E1 N/A S1 Z1 Used with #A2520 PBKDF2 to derive the PasswordWrapKe y, Password is 32 bytes in length PasswordWrapKe 256 KTS G4 N/A N/A S1 Z1 Key wrap of y #A2520 RdsKey or SumRdsKey PspHmacKey 256 HMAC G2 E3 / O2 by N/A S1 Z1, Z2 Integrity #A2521 RootKeyWrapKey verification of or AworWrapKey public TCG content RdsKey 256 KTS G2 E3 / O2 by N/A S1 Z1, Z2 Key wrap of #A2520 PasswordWrapKey LockingObjectDE or AworWrapKey K and NameSpaceDEK RootHmacKey 256 HMAC G3 from E3 / O2 by N/A S1 Z1, Z2 Integrity checking #A2521 KeyDerivat AworWrapKey ionKey RootKeyWrapKey 256 KTS G3 from E3 / O2 by N/A S1 Z1, Z2 Key wrapping #A2520 KeyDerivat AworWrapKey ionKey RootPublicMacKe 256 HMAC G3 from E3 / O2 by N/A S1 Z1, Z2 Integrity y #A2521 KeyDerivat AworWrapKey verification of ionKey external TCG content SumRdsKey 256 KTS G2 E3 / O2 by N/A S1 Z1, Z2 Key wrap of AworWrapKey, LockingObjectDE #A2520 EphemeralSumRds K and kWrapKey, or by NameSpaceDEK PasswordWrapKey Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology Key/SSP/Name/T Strength Security Gene- Import /Export Establish Storage Zeroiza- Use & Related ype Function ration ment tion keys and Cert. Number SUP Seed 256 PBKDF G2 O3 by N/A S1 Z1 Random value #A2520 KDeviceWrappingPub used in password creation TweakKey 256 AES G2 E3 / O2 by N/A S1, S3 Z1, Z2 Data encryption #A2523 RootKeyWrapKey or AworWrapKey WrapKey 256 KTS G2 E3 / O2 by N/A S1 Z1, Z2 Key wrap of #A2520 RootKeyWrapKey LockingObjectDE or AworWrapKey K and NameSpaceDEK KAuthPub 112 RSA N/A E2 / O1 N/A S1 Z1 RSA 2048/3072 SigVer Public Key for (FIPS186- Factory-restricted 4) services signature #A2521 verification KDeviceWrappingPub 112 KTS-IFC N/A E2 / O1 N/A S1 Z1 RSA 2048/3072 #A2520 Public Key for SUP Generate KFWCBootloaderVerify 112 RSA N/A E2 N/A S1 Z1 RSA 2048/3072 SigVer Public Key for (Not an SSP) 128 (FIPS186- Bootloader 4) firmware #A2521 signature verification KFWControllerVerify 112 RSA N/A E2 N/A S1 Z1 RSA 2048/3072 SigVer Public Key for (FIPS186- Controller 4) signature #A2521 verification KFWModuleVerify 112 RSA N/A E2 N/A S1 Z1 RSA 2048/3072 SigVer Public Key for (Not an SSP) 128 (FIPS186- runtime firmware 4) signature #A2521 verification KManifestPub_ROM 112 RSA N/A N/A. Pre-installed. N/A S4 N/A. RSA 2048/3072 (Not an SSP) SigVer Used Public Key for (FIPS186- solely for manifest 4) self-tests signature #A2521 and can verification be revoked KVSAuthPub 112 RSA N/A E2 / O1 N/A S1 Z1 RSA 2048/3072 SigVer Public Key for (FIPS186- Factory-restricted 4) signature #A2521 verification Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

The DRBG Randomness source (i.e., entropy) is loaded at manufacturing. Per IG 9.3.A, Example 2A, there is no assurance of the minimum strength of generated SSPs. The DRBG mechanism is SHA2-256, which has a security strength of 256-bits (per SP800-57, Part 1, Revision 5). The HASH DRBG is seeded with 128 bytes of entropy and 64 bytes of nonce material during manufacturing and is assumed to initialize the HASH DRBG to the full 256-bits security strength.

The Module performs self-tests to ensure the proper operation of the Module. Per FIPS 140-3 these are categorized as either pre-operational self-tests or conditional self-tests. Pre-operational and conditional self-tests are available on demand by resetting or power cycling the Module. The self-tests error states and status indicator are described in Table 12 below: Table 12

• Error States and Indicators Error Description Indicator state ES1 The Function ROM fails a KAT Triggered by cryptographic KAT failure. The Module enters the ES1 error state and outputs A Cryptographic Self-Test Failure status in response to any service request ES2 The Module fails the firmware load test or The Module enters the ES2 error state and outputs a the Firmware Integrity test verification failure status in response to the firmware load test or the firmware integrity test ES3 The Module fails conditional KAT self-test. The Module enters the ES3 error state and will output a Non-operational state. No services beside self-test failure status to any service request status services are allowed The Module performs the following pre-operational self-tests: Table 13
• Pre-Operational Self-Test Security Function Method Description Error state Bootloader Firmware RSA SHA2-256 An RSA 2048 or 3072-bit Signature Verification is ES2 (Bootloader V1.0) Signature Verification executed on the whole Bootloader copied into integrity test the Module SEE Firmware RSA SHA2-256 An RSA 2048 or 3072-bit Signature Verification is ES2 (Runtime SCSS V2.3) Signature Verification executed on the whole Bootloader copied into integrity test the Module The Module performs the following conditional self-tests: Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Table 14

• Conditional Self-Tests Security Function Method Description Error state ROM HMAC HMAC_ HMAC SHA2-256 KAT. This test occurs before the Pre- ES1 SHA2-256 Operational firmware integrity test. ROM RSA SHS/RSA 2048 RSA PKCS#1_v1.5 Verification KAT with SHA2-256 KAT, ES1 which satisfies the self-test requirements for KTS-IFC per IG D.G; the Module only supports the public key operations for RSA Signature Verification and KTS-IFC Encapsulation. This test occurs before the Pre-Operational firmware integrity test. AES
• KW (Key KAT (Auxiliary) AES-256 KW encryption KAT
• Inclusive of AES ECB ES3 Wrap) testing with 256-bit key per IG 10.3.B. AES
• KW (Key KAT (Auxiliary) AES-256 KW decryption KAT
• Inclusive of AES ECB ES3 Unwrap) testing with 256-bit key per IG 10.3.B. AES XTS
• AUX and Comparative 256-bit AES-XTS encryption Comparative Answer Test with the ES3 DPE Encryption AES-AUX and DPE AES-XTS implementations. AES XTS
• AUX and Comparative 256-bit AES-XTS decryption Comparative Answer Test with the ES3 DPE Decryption AES-AUX and DPE AES-XTS implementations. DRBG KAT HASH_DRBG (SHA2-256) instantiation, generate, and reseed ES3 KATs performed before the first random data generation. PBKDF KAT Option 1a using HMAC SHA2-256. Password size is 32 Bytes. Key ES3 generated is 256 bits. KBKDF KAT Known answer test. Inclusive of HMAC-SHA2-256 KAT. Key size ES3 requested is 256 bits. BootLoader RSA A 2048 or 3072-bit RSA Signature Verification is executed on the ES2 Firmware Load test PKCS#1_v1.5 bootloader copied into the Module. SHA2-256 SEE Firmware Load RSA A 2048 or 3072-bit RSA Signature Verification is executed on the ES2 test PKCS#1_v1.5 SEE firmware copied into the Module. SHA2-256 DPE self-tests are initiated when functionality is requested. All other self-tests are initiated automatically when the module boots. The self-tests cannot be interrupted and will run to completion.

This section documents the operational behavior of the device.

The device is shipped from the factory in the Approved mode of operation and no further initialization is required to operate in the Approved mode. Going further, it is not possible to configure the module in such a way that it would operate in a non-compliant state or non-Approved mode. On receipt of the Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).

Micron Technology Module, examine the product to ensure it has not been tampered with during shipping according to the procedures outlined in Section 7.

The Module does not implement any mitigation method against other attacks.

The following standards are referred to in this Security Policy. Table 15

• References Abbreviation Full Specification Name [FIPS140-3] Security Requirements for Cryptographic Modules, March 22, 2019 [ISO19790] International Standard, ISO/IEC 19790, Information technology
• Security techniques
• Test requirements for cryptographic modules, Third edition, March 2017 [ISO24759] International Standard, ISO/IEC 24759, Information technology
• Security techniques
• Test requirements for cryptographic modules, Second and Corrected version, 15 December 2015 [IG] Implementation Guidance for FIPS PUB 140-3 and the Cryptographic Module Validation Program, May 16, 2022 [108] NIST Special Publication 800-108, Recommendation for Key Derivation Using Pseudorandom Functions (Revised), October 2009 [131A] Transitions: Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths, Revision 2, March 2019 [132] NIST Special Publication 800-132, Recommendation for Password-Based Key Derivation, Part 1: Storage Applications, December 2010 [133] NIST Special Publication 800-133, Recommendation for Cryptographic Key Generation, Revision 2, June 2020 [186] National Institute of Standards and Technology, Digital Signature Standard (DSS), Federal Information Processing Standards Publication 186-4, July 2013. [197] National Institute of Standards and Technology, Advanced Encryption Standard (AES), Federal Information Processing Standards Publication 197, November 26, 2001 [198] National Institute of Standards and Technology, The Keyed-Hash Message Authentication Code (HMAC), Federal Information Processing Standards Publication 198-1, July, 2008 [180] National Institute of Standards and Technology, Secure Hash Standard, Federal Information Processing Standards Publication 180-4, August, 2015 [38A] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation, Methods and Techniques, Special Publication 800-38A, December 2001 Micron Technology, Inc. Public Material
• May be reproduced only in its original entirety (without revision).

Micron Technology Abbreviation Full Specification Name [38B] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication, Special Publication 800-38B, May 2005 [38E] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices, Special Publication 80038E, January 2010 [38F] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping, Special Publication 800-38F, December 2012 [56Br2] NIST Special Publication 800-56B Revision 2, Recommendation for Pair-Wise Key Establishment Schemes Using Finite Field Cryptography, March 2019 [90A] National Institute of Standards and Technology, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, Special Publication 800-90A, Revision 1, June 2015. [90B] National Institute of Standards and Technology, Recommendation for the Entropy Sources Used for Random Bit Generation, Special Publication 800-90B, January 2018. [ACS-3] ACS-3 Reporting Security Compliance December 1,2009 [TCG-SSC- TCG Storage Security Subsystem Class: Opal, Specification Opal] [TCG-SACS] TCG Storage Architecture Core Specification [TCG-SIIS] TCG Storage Interface Interactions Specification Table 16– Acronyms and Definitions Acronym Definition KAT Known Answer Test SSP Sensitive Security Parameter AK Authentication key DEK Data Encryption Key LBA Logical Block Address MSID Manufacturing SID. Public value used as part of the default PIN PSID Physical SID, a public unique value for each drive SED Self-Encrypting Drive SID Security ID, PIN for Drive Owner CO Role - TCG OPAL TCG Trusted Computing Group Micron Technology, Inc. Public Material

• May be reproduced only in its original entirety (without revision).