Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09ACP18TA and MG09ACP16TA

Certificate

Approved Algorithms (9)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09ACP18TA and MG09ACP16TA
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>firmware load<br/>recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>Status output<br/>Show status</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C6 clue;
  class I2,I3,I6 infer;
  class R2,R3,R6 risk;
  class E2,E3,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09ACP18TA and MG09ACP16TA
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>firmware load<br/>recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>Status output<br/>Show status</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C6 clueLow;

Security Policy, page by page

Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09ACP18TA and MG09ACP16TA Prepared by: Rev 2.3.1

2 Apr. 26, 2024

The Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series (MG09ACP18TA and MG09ACP16TA) is used for hard disk drive data security. The security levels for this Cryptographic Module (CM) are as follows: Table 1: Security Levels This document is non-proprietary and may be reproduced in its original entirety.

TCG SWG Trusted Computing Group Storage Work Group TOEPP Tested Operational Environment’s Physical Perimeter

2. Cryptographic Module Specification This CM provides various cryptographic services using approved algorithms. Services include hardware-based data encryption, cryptographic erase, independently protected user data LBA ranges, and FW Download. The CM always encrypts the user data, protects CSPs from unauthorized access, and provides secure sanitization methods by supporting TCG Opal SSC features. The operational rules described in this document adheres to TCG Opal. This CM is a multiple-chip-embedded hardware cryptographic module. The cryptographic boundary of the CM is the entire HDD. The physical interface for power-supply and for communication is one SATA connector. The CM is connected with host system by this SATA connector. The logical interface is the SATA, TCG SWG and Opal SSC. The CM has the non-volatile storage area for not only user data but also the keys, CSPs, and FW. The latter storage area is called the “system area”, which is not logically accessible / addressable by the host application. The CM has one approved mode of operation and CM is always in approved mode of operation. The CM provides only approved services defined in 4.2. Non-approved security functions are not implemented.

The Toshiba Secure TCG Opal SSC SED has been validated in the following versions: The tested platform is Toshiba Cryptographic Hardware 88i1215-B1. The CM does not employ any operating system. Table 2: Cryptographic Module Tested Configuration

The CM does not implement any non-approved algorithms allowed in the approved mode of operation. It does not implement any non-approved algorithms allowed in the approved mode of operation with no security claimed. It does not implement any non-approved algorithms not allowed in the approved mode of operation.

CAVP       Algorithm and      Mode/Method     Description / Key Size(s) /   Use/Function Certs      Standard                           Key Strength There are algorithms, modes, and keys that have been CAVP tested but not used by the module. Only the algorithms, modes/methods, and key lengths/curves/moduli shown in this table are used by the module. Table 3: Approved Algorithms Figure 1: MG09ACP16TA                     Figure 2: MG09ACP18TA                    Figure 3: PCA side Figure 4 shows the CM's block diagram. In this diagram, the cryptographic boundary of the CM,

defined by the enclosure of the MG09ACP18TA and the MG09ACP16TA, is indicated by a dashed line. It includes the SATA connector, the SoC, the buffer DRAM, the flash ROM and the magnetic storage medium. Figure 4: Block Diagram

3. Cryptographic Module Interfaces The CM does not implement any control output interface. All data, status, control, and power interfaces above use a single SATA connector that contains multiple pins for power supply, data transmission, and signal exchange. Table 4: Ports and Interfaces
4. Roles, Services, and Authentication This section describes roles and services the CM supports. The CM supports 16 Crypto Officer roles listed in Table
5. The roles listed in Table 5 are all Crypto Officer roles. The CM does not implement any Non-Approved Services.

1 TCG Authority (LockingSP.Admin1-4, AdminSP.Admin1, LockingSP.User1-9 or AdminSP.SID)

can be assumed by using TCG Start Session method, while ATA Security role (Master or User) can be assumed by using ATA Security command.

The CM is always in 140-3 approved mode of operation regardless of this functionality.

None

Reset (run POSTs) Data read / write Random number generation Show status Zeroization (with RKey) (using PSID) Cryptographic Sanitization Show versioning information Non-security relevant HDD service

Power on reset command Read/Write commands with User data Trusted Send command Read Status Register command Trusted Send command Sanitize command Identify Device command ATA command

Command response Command response, User data Command response, Random number Command response, Status Command response Command response, Versioning information Command response

Role1 Service Input Output Table 5: Roles, Service Commands, Input and Output

The CM supports two security modes: ATA security mode and TCG Opal security mode. A set of available services is different depending on the mode. The CM also supports the TCG Single User Mode functionality defined in the Single User Mode feature set of TCG Opal. A single role (LockingSP.Userx) is assigned to manage the associated range (range X) during the TCG single user mode. The LockingSP.Reactivate or LockingSP.Activate method enables this mode. Authorized roles of some services differ when the CM is in single user mode. About such services, the Role(s) column in Table 6 is divided into two rows. The upper row shows authorized roles in non-single user mode (normal mode), while the lower row shows authorized roles against range X in single user mode. The CM provides the following services to operators per Section 7.4.3.1 of ISO/IEC 19790_2012_2015:  Perform self-test: Reset (run POSTs) service  Perform zeroization: Zeroization (with RKey) service, Zeroization (without RKey) services

 Perform approved security functions: Services indicated with Approved Security Functions in Table 6 The modes of access to SSPs shown in Table 6 are defined as: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP.

6 AdminSPObj.Revert, LockingSP.RevertSP, LockingSPObj.Revert are methods of TCG Opal SSC.

7 PSID (Printed SID) is public drive-unique value which is used for the TCG Revert AdminSP

method. PSID is printed on the HDD’s product label.

Table 6: Approved Services

5. Software/Firmware Security FW integrity check is performed at power on. Signature verification using RSASSA-PKCS#1-v1_5 of the FW codes (in the flash ROM and in the disk media) and EDC verification of the FW code in the Mask ROM are done. The operator can initiate the on-demand FW integrity check by power cycling. All firmware components are in executable form, which cannot be dynamically modified.
6. Operational Environment The CM is a hardware module and operates in a non-modifiable operational environment, that is its firmware cannot be modified and no code can be added or deleted. SSPs are controlled by the CM itself, and uncontrolled access to CSPs and uncontrolled modifications of SSPs are prevented. Although firmware can be updated by “Firmware Download” service, whole FW codes (in the flash ROM and in the disk media) are replaced by this service, and the module becomes another module which requires new 140-3 certification.
7. Physical Security The CM has the following physical security: ⚫ Production-grade components with standard passivation ⚫ Exterior of the drive is opaque The operator is required to periodically inspect the enclosure condition of the CM. The CM does not employ non-invasive mitigation techniques referenced in NIST SP800-140F.

9. Sensitive Security Parameters Management The CM uses SSPs in the following tables: c

Security c c c c Table 8: SSPs Note that there is no security-relevant audit feature and audit data. Table 9: Non-Deterministic Random Number Generation Specification can no longer be guaranteed, health test detects the source deterioration, enter an error state, and

halts the CM. When the CM continuously enters in error state in spite of several trials of reboot, the CM shall be sent back to factory to recover from error state. 10. Self-Tests The CM runs self-tests in the following table.

Entropy source Conditional SP800-90B Start-up Power-cycle Boot error state cryptographic health test (repetition The CM is not accessible algorithm test count test, adaptive via SATA interface The public verification key “PubKey2” used in firmware integrity check resides within the MaskROM code and is not a SSP. SHA2-256(A1637) is embedded in RSASSA-PKCS#1-v1_5, while SHA2-256(A1638) is used in HMAC, and SHA2-256(A1645) is employed in Hash DRBG. Table 10: Self-Tests If the CM fails the self-test, it enters one of three error states: Error State (Conditional Test), Error and for other self-tests, it transitions to Boot Error State. The status indicator for each error state is specified in Table 10 (e.g., The “Random Number Generation” service resulting in “Status Field: 0x53, When in the error state, the CM does not perform any cryptographic operations or output data. A power cycle is required to clear the error state. When the CM continuously enters the error state despite several reboot attempts, the CM should be returned to the factory for recovery from the error The CM does not support any degraded operation. 11. Life-Cycle Assurance The following are the secure initialization procedure for the CM. The CM is always in approved mode of operation in a deployed environment. In addition to this, the following procedure of initial settings will allow further secure operation during power cycling. Initialization in TCG Opal security mode: Please refer to TCG Opal specification (TCG Storage Security Subsystem Class: Opal Version

(1) Activate LockingSP by “TCG Activate” service.

(2) Set LockOnReset in Download port to “Power Cycle”.13 (3) Set ReadLockEnabled and WriteLockEnabled to 1(true) and LockOnReset to “Power Cycle”.14 (4) Do a power-on reset. Initialization in ATA security mode: (1) Enable ATA role (Master) with “Enable ATA role” service. (2) Enable ATA role (User) with “Enable ATA role” service and set Master Password Capability to “Maximum”. (3) Disable Software Settings Preservation (SSP) feature set. 13,14 (4) Do a power-on reset. The longest service life of the CM under suitable conditions and treatment is 5 years. By the end of this period the operator is required to follow the CM’s end of life procedures below. (1) Initialize internal sensitive data in the host system. (2) Initialize parameters and user information in the CM by “Zeroization (with RKey)” service. For additional details, refer to the guidance documents provided with the CM:

12. Mitigation of Other Attacks The CM does not mitigate other attacks beyond the scope of 140-3 requirements.

13 This procedure configures the CM to disable Firmware Download feature after power-cycling.

14 This procedure configures the CM to lock all range(s) after power-cycling.