Media Encryption Key

Overview

A media encryption key (MEK) is the key used by a storage device's AES engine to encrypt and decrypt data for a given address range. In OCP lock, the MEK is solely managed by the key management block, which guards it with a data protection key, zero or more multi-party protection keys, and a device-wide epoch protection key whenever it is loaded into the AES engine.

Lock can create an MEK in two ways: by generating a random key and encrypting it at rest — the TCG Opal model — or by deriving it from given secrets such as a host-provided data protection key (DPK). The derive-from-secrets path is what enables keeper.io-style key delivery, where the host provides the secret material from which the MEK is derived.