Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09SCP18TA and MG09SCP16TA

Certificate

Approved Algorithms (9)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09SCP18TA and MG09SCP16TA
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C2["[low] Firmware update / recovery<br/>/ rollback (referenced in<br/>text)<br/><i>firmware load<br/>recovery</i>"]
    C3["[low] Self-test / status surface<br/>(referenced in text)<br/><i>Self-Test<br/>Status output<br/>Show status</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I2["Possible only, trusted<br/>code is reachable through<br/>update and recovery paths."]
    I3["Possible only, some<br/>services may process input<br/>before, or without,<br/>operator authentication."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E2["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C2,C3,C6 clue;
  class I2,I3,I6 infer;
  class R2,R3,R6 risk;
  class E2,E3,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09SCP18TA and MG09SCP16TA
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C2["[low] Firmware update / recovery / rollback (referenced in text)<br/><i>firmware load<br/>recovery</i><br/>src: text:keyword"]
    C3["[low] Self-test / status surface (referenced in text)<br/><i>Self-Test<br/>Status output<br/>Show status</i><br/>src: text:keyword"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C2,C3,C6 clueLow;

Security Policy, page by page

Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series MG09SCP18TA and MG09SCP16TA Prepared by: Rev 2.4.0

The Toshiba Secure TCG Opal SSC Self-Encrypting Drive Series (MG09SCP18TA and MG09SCP16TA) is used for hard disk drive data security. The security levels for this Cryptographic Module (CM) are as follows: Table 1: Security Levels This document is non-proprietary and may be reproduced in its original entirety.

TCG SWG Trusted Computing Group Storage Work Group TOEPP Tested Operational Environment’s Physical Perimeter

2. Cryptographic Module Specification This CM provides various cryptographic services using approved algorithms. Services include hardware-based data encryption, cryptographic erase, independently protected user data LBA ranges, and FW Download. The CM always encrypts the user data, protects CSPs from unauthorized access, and provides secure sanitization methods by supporting TCG Opal SSC features. The operational rules described in this document adheres to TCG Opal. This CM is a multiple-chip-embedded hardware cryptographic module. The cryptographic boundary of the CM is the entire HDD. The physical interface for power-supply and for communication is one SAS connector. The CM is connected with host system by this SAS connector. The logical interface is the SAS, TCG SWG and Opal SSC. The CM has the non-volatile storage area for not only user data but also the keys, CSPs, and FW. The latter storage area is called the “system area”, which is not logically accessible / addressable by the host application. The CM has one approved mode of operation and CM is always in approved mode of operation. The CM provides only approved services defined in 4.2. Non-approved security functions are not implemented.

The Toshiba Secure TCG Opal SSC SED has been validated in the following versions: The tested platform is Toshiba Cryptographic Hardware 88i1215-B1. The CM does not employ any operating system. Table 2: Cryptographic Module Tested Configuration

The CM does not implement any non-approved algorithms allowed in the approved mode of operation. It does not implement any non-approved algorithms allowed in the approved mode of operation with no security claimed. It does not implement any non-approved algorithms not allowed in the approved mode of operation.

CAVP Certs         Algorithm and    Mode/Method       Description / Key Size(s) /   Use/Function There are algorithms, modes, and keys that have been CAVP tested but not used by the module. Only the algorithms, modes/methods, and key lengths/curves/moduli shown in this table are used by the module. Table 3: Approved Algorithms Figure 1: MG09SCP16TA                    Figure 2: MG09SCP18TA             Figure 3: PCA side

Figure 4: Side of the device Figure 5: SAS port Figure 6: Side of the device Figure 7 shows the CM's block diagram. In this diagram, the cryptographic boundary of the CM, defined by the enclosure of the MG09SCP18TA and the MG09SCP16TA, is indicated by a dashed line. It includes the SAS connector, the SoC, the buffer DRAM, the flash ROM and the magnetic storage medium. Figure 7: Block Diagram 3. Cryptographic Module Interfaces The CM does not implement any control output interface. All data, status, control, and power interfaces above use a single SAS connector that contains multiple pins for power supply, data transmission, and signal exchange. Table 4: Ports and Interfaces

4. Roles, Services, and Authentication This section describes roles and services the CM supports. The CM supports 14 Crypto Officer roles listed in Table
5. The roles listed in Table 5 are all Crypto Officer roles. The CM does not implement any Non-Approved Services.

1 TCG Authority (LockingSP.Admin1-4, AdminSP.Admin1, LockingSP.User1-9 or AdminSP.SID)

can be assumed by using TCG Start Session method.

The CM is always in 140-3 approved mode of operation regardless of this functionality.

Role1 Service Input Output Table 5: Roles, Service Commands, Input and Output

The CM supports the TCG Single User Mode functionality defined in the Single User Mode feature set of TCG Opal. A single role (LockingSP.Userx) is assigned to manage the associated range (range X) during the TCG single user mode. The LockingSP.Reactivate or LockingSP.Activate method enables this mode. Authorized roles of some services differ when the CM is in single user mode. About such services, the Role(s) column in Table 6 is divided into two rows. The upper row shows authorized roles in non-single user mode (normal mode), while the lower row shows authorized roles against range X in single user mode. The CM provides the following services to operators per Section 7.4.3.1 of ISO/IEC 19790_2012_2015:  Show module's versioning information: Show versioning information service  Show status: Show Status service  Perform self-test: Reset (run POSTs) service  Perform zeroization: Zeroization (with RKey) service, Zeroization (without RKey) services  Perform approved security functions: Services indicated with Approved Security Functions in Table 6 The modes of access to SSPs shown in Table 6 are defined as: G = Generate: The module generates or derives the SSP. R = Read: The SSP is read from the module (e.g. the SSP is output). W = Write: The SSP is updated, imported, or written to the module. E = Execute: The module uses the SSP in performing a cryptographic operation. Z = Zeroise: The module zeroises the SSP.

Service        Description                        Approved      Keys     Role(s)       Access    Indicator Functions     SSPs                   to Keys SSPs

Service         Description                      Approved     Keys      Role(s)       Access    Indicator Security     and/or                  rights Functions    SSPs                    to Keys and/or SSPs 3AdminSPObj.Revert, LockingSP.RevertSP, LockingSPObj.Revert are methods of TCG Opal SSC. 4PSID (Printed SID) is public drive-unique value which is used for the TCG Revert AdminSP method. PSID is printed on the HDD’s product label.

Service Description Approved Keys Role(s) Access Indicator Security and/or rights Functions SSPs to Keys and/or SSPs Table 6: Approved Services FW integrity check is performed at power on. Signature verification using RSASSA-PKCS#1-v1_5 of the FW codes (in the flash ROM and in the disk media) and EDC verification of the FW code in the Mask ROM are done. The operator can initiate the on-demand FW integrity check by power cycling. All firmware components are in executable form, which cannot be dynamically modified. 6. Operational Environment The CM is a hardware module and operates in a non-modifiable operational environment, that is its firmware cannot be modified and no code can be added or deleted. SSPs are controlled by the CM itself, and uncontrolled access to CSPs and uncontrolled modifications of SSPs are prevented. Although firmware can be updated by “Firmware Download” service, whole FW codes (in the flash ROM and in the disk media) are replaced by this service, and the module becomes another module

which requires new 140-3 certification.

7. Physical Security The CM has the following physical security: ⚫ Production-grade components with standard passivation ⚫ Exterior of the drive is opaque The operator is required to periodically inspect the enclosure condition of the CM.
8. Non-Invasive Security The CM does not employ non-invasive mitigation techniques referenced in NIST SP800-140F.
9. Sensitive Security Parameters Management The CM uses SSPs in the following tables: c

Security c c c c c Table 8: SSPs Note that there is no security-relevant audit feature and audit data.

Entropy source

0.6 / 1

Physical noise source used to seed the approved Hash- DRBG. The overall amount of generated entropy is 48 bytes. This entropy source meets NIST SP800-90B requirements.

Entropy sources Minimum number of bits of Details Table 9: Non-Deterministic Random Number Generation Specification If the source may deteriorate to the point when the generation of the sufficient amount of entropy can no longer be guaranteed, health test detects the source deterioration, enter an error state, and halts the CM. When the CM continuously enters in error state in spite of several trials of reboot, the CM shall be sent back to factory to recover from error state. 10. Self-Tests The CM runs self-tests in the following table.

The public verification key “PubKey2” used in firmware integrity check resides within the MaskROM code and is not a SSP. SHA2-256(A1637) is embedded in RSASSA-PKCS#1-v1_5, while SHA2-256(A1638) is used in HMAC, and SHA2-256(A1645) is employed in Hash DRBG. The CM does not implement reseed function of Hash DRBG. Table 10: Self-Tests If the CM fails the self-test, it enters one of three error states: Error State (Conditional Test), Error and for other self-tests, it transitions to Boot Error State. Status indicator for each error state is CM is currently in Boot Error State). When in the error state, the CM does not perform any cryptographic operations or output data. A power cycle is required to clear the error state. When the CM continuously enters the error state despite several reboot attempts, the CM should be returned to the factory for recovery from the error The CM does not support any degraded operation.

11. Life-Cycle Assurance The following are the secure initialization procedure for the CM. The CM is always in approved mode of operation in a deployed environment. In addition to this, the following procedure of initial settings will allow further secure operation during power cycling. Please refer to TCG Opal specification (TCG Storage Security Subsystem Class: Opal Version 2.01 Revision 1.00) for the details. (1) Activate LockingSP by “TCG Activate” service. (2) Set LockOnReset in Download port to “Power Cycle”. (3) Set ReadLockEnabled and WriteLockEnabled to 1(true) and LockOnReset to “Power Cycle”. (4) Do a power-on-reset. The longest service life of the CM under suitable conditions and treatment is 5 years. By the end of this period the operator is required to follow the CM’s end of life procedures below. (1) Initialize internal sensitive data in the host system. (2) Initialize parameters and user information in the CM by “Zeroization (with RKey)” service. For additional details, refer to the guidance documents provided with the CM:

12. Mitigation of Other Attacks The CM does not mitigate other attacks beyond the scope of 140-3 requirements.