MEK-MPA

Overview

MEK-MPA (Media Encryption Key Multi-Party Authorization) is a Trusted Computing Group feature set that lets multiple mutually distrustful entities independently authorize access to encrypted storage. It was built as a cross-compatible extension of TCG Opal rather than a replacement: "rather than replacing anything in the existing Opal, we performed an extension." MEK-MPA introduces "access conditions" — abstract conditions an entity validates before enabling data access — that gate the ability to change a range's read-lock and write-lock states.

MEK-MPA solves a structural limitation of base Opal multi-user, in which every operation in a joint authorization had to occur within the same session, forcing a single external entity to possess all CPIN secrets at once. With MPA, a cloud service provider and a customer can establish their access conditions disjointly in time, with no single point ever holding all secrets. Access-enabling secrets are encapsulated with RFC 9180 hybrid public key encryption.

The feature set maps cleanly onto implementation: there is roughly a one-to-one correspondence between TCG MEK-MPA operations and the OCP lock key management block's APIs, which makes integrating lock to implement MEK multi-party authorization easy. MEK-MPA communications use the TCG protocol, so any enabled interface works — host-facing, NVMe, or any channel that supports binding to TCG.