Samsung NVMe TCG Opal SSC SEDs PM1743 Series

Certificate

Approved Algorithms (8)

Security Levels (Table 1)

Derived Review-Risk Graph (review prompts, not findings)

flowchart LR
  %% Deterministic review-risk graph for Samsung NVMe TCG Opal SSC SEDs PM1743 Series
  %% Review prompts and evidence gaps, NOT vulnerability findings.
  subgraph CMVP["CMVP-disclosed clues"]
    C1["[high] Firmware / bootloader<br/>versions disclosed<br/>(identity, not provenance)<br/><i>OPP9TA6A</i>"]
    C2["[high] Firmware update / recovery<br/>/ rollback services<br/><i>Update the firmware<br/>Error state in Boot<br/>Error State in operational state</i>"]
    C3["[high] Unauthenticated /<br/>self-test / status service<br/>surface<br/><i>Show Status<br/>Error State in operational state</i>"]
    C4["[high] Physical/logical<br/>interfaces (some 'blocked<br/>in firmware')<br/><i>JTAG</i>"]
    C6["[low] Operating system / runtime<br/>referenced (boundary<br/>membership not asserted)<br/><i>operating system<br/>application</i>"]
  end
  subgraph Inference["Derived inference"]
    I1["Component identity is<br/>disclosed, but provenance<br/>and patch lineage are not."]
    I2["Trusted code is reachable<br/>through update and<br/>recovery paths."]
    I3["Some services may process<br/>input before, or without,<br/>operator authentication."]
    I4["Interface reachability may<br/>vary by boot stage and<br/>lifecycle state."]
    I6["Possible only, a<br/>runtime/OS is referenced,<br/>but its membership in the<br/>cryptographic boundary is<br/>not established."]
  end
  subgraph Risk["Reviewer question"]
    R1["Do the vendor version<br/>strings obscure the<br/>upstream baseline, fork<br/>lineage, or known-CVE<br/>exposure?"]
    R2["Are update images<br/>authenticated before<br/>parsing, and are<br/>downgrade/rollback paths<br/>constrained?"]
    R3["Can unauthenticated<br/>services leak state,<br/>consume resources, or<br/>transition security state?"]
    R4["Are interfaces blocked<br/>before the bootloader<br/>runs, or only after<br/>approved mode starts?"]
    R6["If the OS/runtime is<br/>in-boundary, could its<br/>CVEs be hidden by<br/>firmware-only versioning?"]
  end
  subgraph Evidence["Evidence needed to close"]
    E1["SBOM / component baselines<br/>· patch and backport<br/>manifest · CVE disposition"]
    E2["update image format ·<br/>signature-before-parse<br/>proof · anti-rollback /<br/>downgrade policy"]
    E3["pre-auth reachability<br/>matrix · rate limits and<br/>output redaction ·<br/>abuse-case tests"]
    E4["lifecycle reachability<br/>matrix · boot-stage<br/>interface timing ·<br/>factory/recovery/error-state<br/>access controls"]
    E6["confirm the disclosure<br/>itself (keyword hit,<br/>context unverified) ·<br/>runtime identity and<br/>config · kernel/runtime<br/>hardening profile ·<br/>patch/backport manifest"]
  end
  C1 --> I1 --> R1 --> E1
  C2 --> I2 --> R2 --> E2
  C3 --> I3 --> R3 --> E3
  C4 --> I4 --> R4 --> E4
  C6 --> I6 --> R6 --> E6
  classDef clue fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef infer fill:#fff7e6,stroke:#b98500,color:#6b4e00;
  classDef risk fill:#fbe9e9,stroke:#b02a2a,color:#7a1f1f;
  classDef evidence fill:#e6f4ea,stroke:#1e7d34,color:#14532d;
  class C1,C2,C3,C4,C6 clue;
  class I1,I2,I3,I4,I6 infer;
  class R1,R2,R3,R4,R6 risk;
  class E1,E2,E3,E4,E6 evidence;

flowchart LR
  %% Deterministic clue tier for Samsung NVMe TCG Opal SSC SEDs PM1743 Series
  %% confidence: high = structured record field; medium = structured but soft; low (dashed) = bare keyword hit, context unverified
  subgraph CMVP["CMVP-disclosed clues (deterministic)"]
    C1["[high] Firmware / bootloader versions disclosed (identity, not provenance)<br/><i>OPP9TA6A</i><br/>src: certificate.firmwareVersions"]
    C2["[high] Firmware update / recovery / rollback services<br/><i>Update the firmware<br/>Error state in Boot<br/>Error State in operational state</i><br/>src: securityPolicy.services"]
    C3["[high] Unauthenticated / self-test / status service surface<br/><i>Show Status<br/>Error State in operational state</i><br/>src: securityPolicy.services"]
    C4["[high] Physical/logical interfaces (some 'blocked in firmware')<br/><i>JTAG</i><br/>src: securityPolicy.portsAndInterfaces"]
    C6["[low] Operating system / runtime referenced (boundary membership not asserted)<br/><i>operating system<br/>application</i><br/>src: text:keyword"]
  end
  classDef clueHigh fill:#eef3f9,stroke:#2f6fb0,stroke-width:2px,color:#1f3a5f;
  classDef clueMedium fill:#eef3f9,stroke:#6f7f91,color:#1f3a5f;
  classDef clueLow fill:#f7f7f7,stroke:#999,stroke-dasharray:4 4,color:#444;
  class C1,C2,C3,C4 clueHigh;
  class C6 clueLow;

Security Policy, page by page

Samsung NVMe TCG Opal SSC SEDs PM1743 Series Document Version: 1.1 H/W Version: MZCLO1T9HCJR-00AMZ, MZCLO3T8HBLT-00AMZ, MZCLO7T6HBLA-00AMZ F/W Version: OPP9TA6A This document may be freely reproduced in its original entirety.

Revision History 1.0 1.1 Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

I. Introduction I.1. Scope referred to as the “cryptographic module” or “module.” The SSD (Solid State Drive) satisfies all applicable FIPS 140-3 security level 1 requirements for a ‘Hardware Module,’ supporting TCG Opal SSC-based SED (Self-Encrypting Drive) features designed to protect against unauthorized access to user data stored in its NAND Flash memories. The built-in AES hardware engines in the cryptographic module’s controller provide on-the-fly encryption and decryption of user data without performance loss. The SED’s design also enables instantaneous sanitization of user data via cryptographic erase. I.2. Acronyms Table 1. Acronyms Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

[Number Below] Table 2. Security Levels Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy N/A N/A

2. Cryptographic Module Specification 2.1. Cryptographic Boundary This firmware version, within the scope of this validation, must be validated through the FIPS 140-3 CMVP. Any other firmware loaded into this module is beyond the scope of this validation and requires a separate FIPS 140-3 validation. The following photographs depict the top and bottom views of the cryptographic module. The multiple-chip standalone cryptographic module comprises of both hardware and firmware components, all enclosed within two aluminum alloy cases. These cases serve as the cryptographic boundary of the module. Figure
3. Specification of the Samsung SSD NVMe TCG Opal SSC SEDs PM1743 Series Cryptographic Boundary Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

The PM1743 series utilizes a single-chip controller with an NVMe interface on the system side and internally integrates Samsung NAND flash. The following figure illustrates the operational environment of the module. The cryptographic boundary, shown in Figure 2 below, is represented by the black box that encloses the components of the module. Figure

2. Block Diagram for Samsung SSD NVMe TCG Opal SSC SEDs PM1743 Series 2.2. Version information Table
3. Cryptographic Module Tested Configuration Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

2.3. Cryptographic Functionality 2.3.1. Approved Algorithm1 The cryptographic module supports the following Approved algorithms for secure data storage: N/A N/A N/A N/A Table 4. Approved Algorithms Note that not all algorithms/modes that appear on the module’s CAVP certificates are utilized by the module. Table 4 lists only the algorithms/modes that are utilized by the module. Not all algorithms/modes that appear on the module’s CAVP certificates are utilized by the module. IG C.H Scenario 2 for generating an IV is implemented in this module. In other words, Key and IV are generated internally using by approved Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

2.3.2. The module does not implement any Non-Approved Algorithms Not Allowed in the Approved Mode of Operation or Non-Approved Algorithms Allowed in the Approved Mode of Operation. The following algorithms are not intended to be used as a security function and are not implemented to meet any FIPS 140-3 requirements. Additionally, these algorithms are not provided through a non-approved service to an operator #1) Table 5. Non-Approved Algorithms Allowed in the Approved Mode of Operation with No Security Claimed 2.4. Approved Mode of Operation The module only supports one mode of operation: the Approved mode, in which the Approved cryptographic functions are available. The module automatically transitions to the Approved mode of operation after completing its pre-operational self-tests. The cryptographic module indicates its approved mode through the validated version status, displayed by the Show Status Service in Table 8 via the PCIe command. In the approved mode of operation, non-approved algorithms are allowed, but with no security claims in the module. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

3. Cryptographic Module Interfaces The module does not support a Control Output Interface. N/A Table
4. Ports and Interfaces Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

4.1. The cryptographic module does not support role-based authentication. Roles are implicitly assumed based on the service they are invoking. The module does not support any bypass capabilities. N/A N/A N/A N/A N/A N/A N/A 4.2. 4.2.1. The cryptographic module only supports the following approved services and does not support any non-approved services. The abbreviations of the type of access to keys and SSPs have the following interpretation:

• G = Generate: The module generates or derives the SSP.
• W = Write: The SSP is updated, imported, or written to the volatile storage specified in Table 12.
• Z = Zeroise: The module zeroises the SSP. E W G Z N/A N/A O O O O O

Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

O O O O O O O perform selftests O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

PBKDF2 (noncompliant) HMAC-SHA2256 (noncompliant) N/A N/A N/A N/A N/A N/A (noncompliant) PBKDF2 (noncompliant) HMAC-SHA2256 (noncompliant) (noncompliant) N/A Table

8. Approved Services 4.3. The module does not support any authentication mechanisms to access its services under Security Level
9. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

5. Software/Firmware Security The integrity of the module’s executable firmware (OPP9TA6A_DC_2048.bin) is verified using ECDSA SigVer P-384 (A2255) with SHA2-384 (A2248) for firmware integrity testing of the following components:

• Boot Loader - ECDSA SigVer P-384 (A2255) with SHA2-384 (A2248)
• Main Firmware - ECDSA SigVer P-384 (A2255) with SHA2-384 (A2248) The operator can initiate the firmware integrity tests on-demand by power-cycling the module. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

6. Operational Environment The cryptographic module operates in a limited operational environment, consisting of the module’s firmware. This module does not have an operating system but is designed in a manner to allow controlled, validated firmware modifications by an operator. This operational environment does not require any specific security rules, settings, configurations, or restrictions to be set. The cryptographic module does not provide any general-purpose operating system to the operator. Firmware download is only available for CMVP validated firmware versions. Unauthorized modification of the firmware is prevented by the pre-operational firmware integrity test and conditional firmware load test. Since the cryptographic module is zeroised through the procedure for using maintenance role, it is restricted to prevent uncontrolled access to CSPs and uncontrolled modifications of SSPs. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

7. Physical Security The following physical security mechanisms are implemented in the cryptographic module:

• Production grade components. The cryptographic module supports the Maintenance role. To assume the Maintenance role, operators must comply with the following rules:
• The operator must zeroise all SSPs listed in Table 11 by invoking the Revert service in the Table 8 and initiate the Power on reset before entering the Maintenance role.
• To exit the Maintenance role, the operator must procedurally perform the Revert service in the Table 8 and perform a power-on reset of the module. Finally, the operator performing the Show Status service in Table 8 confirms the original firmware version listed in the Table 3 remains unchanged.
• The operator is responsible for managing the module's JTAG port and should conduct regular inspections associated with the enabled JTAG port as frequently as possible in order to prevent potential security risks such as potential code modifications with no firmware load test, reading and writing of register information or other impactful security changes. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

8. Non-Invasive Security The module does not implement any non-invasive attack mitigation techniques. Therefore, this section is not applicable. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

9. Sensitive Security Parameters Management Temporary SSPs and SSPs stored in volatile memory are automatically zeroized upon power-on reset. The module performs zeroization by overwriting the target SSP with random values generated by the DRBG. The module does not import or export SSPs. All SSPs in volatile memory, including HW SFR, are automatically zeroised instantly either after key generation/use or upon performing power-on-reset, depending on the characteristics of volatile memory. N/A N/A N/A N/A N/A N/A

Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

N/A N/A N/A N/A N/A N/A Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

N/A N/A N/A Table

9. SSPs The cryptographic module contains an entropy source, compliant with SP 800-90B. Table
10. Non-Deterministic Random Number Generation Specification *Note: This is not considered an SSP as per ISO/IEC 19790:2012 section 7.5 but is included in the list for completeness. HW SFR (Special Function Register) is a register within a hardware cryptographic algorithm IP, which has characteristic of volatile memory.

8 Estimated amount of entropy per the source’s output bit is 0.85444 and Samsung conservatively claims to be set at 0.5 per bit.

Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

While executing the following self-tests, all data output is inhibited until the completion of the self-test. Conditional self-tests are conducted before the initial operation of approved algorithms. If a cryptographic module fails a self-test, it will enter an error state, during which all data output is inhibited. 10.1. Pre-operational test Table 11. Pre-operational Self-tests

Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

operational state Table 13: Error States Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

11. Life-Cycle Assurance The cryptographic module operates in the Approved mode of operation by default upon shipment from the vendor’s manufacturing site and does not support a non-approved mode of operation. Section 11.1 provides guidance on the rules for secure installation and operation. Operators must follow this guidance to ensure the cryptographic module operates in compliance with FIPS 140-3 security level 1 requirements. 11.1. Secure Installation

• Identify the firmware version in the device Confirm that the firmware version is equivalent to the version(s) listed in this document via NVM express Identify Controller command. 11.2. Operational Description of Module
• The cryptographic module shall maintain logical separation of data input, data output, control input, status output, and power. The cryptographic module shall not output CSPs in any form. The cryptographic module shall use the Approved DRBG for generating all cryptographic keys. The cryptographic module shall enforce a limited operational environment by the secure firmware load test using ECDSA with SHA-384. The cryptographic module shall provide a production-grade cryptographic boundary. The Cryptographic module enters the error state upon failure of Self-tests. most commands except for supported command from the Host (General Purpose Computer (GPC) outside the cryptographic boundary) are rejected in the error state and the IO command returns Namespace Not Ready (SC=0x82, SCT=0x0), the other commands return Internal Error (SC=0x6, SCT=0x0) defined in NVMe specification via the status output. Cryptographic services and data output are explicitly inhibited when in the error state. When the module fails FW Integrity test performed by Mask ROM, the module will fail to boot; module will not service any requests or provide any status output (module hangs). The cryptographic module satisfies the requirements of FIPS 140-3 IG C.I (i.e. key_1 ≠ key_2) The module generates at a minimum 256 bits of entropy for use in key generation. Bypass capability is not applicable to the cryptographic module. The module generates symmetric keys which are unmodified outputs from the DRBG. As specified in NIST SP 800-132, keys derived from passwords/passphrases may only be used in storage applications. AES-XTS is only approved for storage applications. If you require the “Samsung SED Product Manual”, kindly reach out to the vendor contact information that is posted in certification. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy

12. Mitigation of Other Attacks The cryptographic module has not been designed to mitigate any specific attacks beyond the scope of FIPS 140-3. Samsung Electronics Co., Ltd. SSD FIPS 140-3 Security Policy