Key Management Block

Overview

The key management block (KMB) is an extension in Caliptra that is OCP lock's sole manager of media encryption keys (MEKs) within a storage device. It defines new key management operations, and access keys in plaintext are visible only within the KMB — meaning only within Caliptra — isolating and protecting them from the larger drive firmware. The KMB cryptographically guards MEKs with three protection-key types:

• Data protection keys (DPKs) — owned by device firmware outside Caliptra, with a one-to-one relationship to MEKs. They provide lock compatibility with legacy Opal CPIN-protected secrets and with host-provided keeper.io MEKs.
• Multi-party protection keys (MPKs) — internal cryptographic secrets owned by the KMB, with a many-to-one relationship to MEKs, corresponding to access condition objects: a locked MPK maps to a disabled access condition and an enabled MPK to an enabled one.
• Epoch protection key — a device-wide root key (see the Epoch Protection Key concept) combined with the above when loading an MEK.

When an MEK is established and sent to the encryption engine, the KMB attaches metadata and auxiliary metadata of a fixed byte size that lock does not interpret, leaving it open for the drive to encode an NSID, an LBA range, or keeper.io indexes. There is roughly a one-to-one correspondence between TCG MEK-MPA operations and the KMB's APIs.