Epoch Protection Key

Overview

The epoch protection key is a root key owned by OCP lock's key management block and shared by all media encryption keys (MEKs) on a storage device. It is derived by applying a key derivation function to two input keys: a soft epoch key, managed by the drive firmware and stored in rewritable firmware, and a hard epoch key, managed by the key management block directly and held in fuses where it is never visible to firmware.

Loading an MEK into the AES engine always combines the epoch protection key with a data protection key and zero or more multi-party protection keys, and this is true at all times regardless of whether the MEK-MPA specification is in use — so the mechanism works transparently across host management models.