Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## Seagate Technology LLC. Seagate SSG5 TCG Enterprise SSC SED FIPS 140 Module ## FIPS 140-3 Non-Proprietary Security Policy This document may be reproduced and distributed in its original entirety without revision. Page 1 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ### Table of Contents | 1 General .................................................................................................................................................. | 1 General .................................................................................................................................................. | 1 General .................................................................................................................................................. | 1 General .................................................................................................................................................. | |----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------| | 1.1 | 1.1 | Overview ....................................................................................................................................... | 5 5 | | 1.2 | 1.2 | Security Levels .............................................................................................................................. | 5 | | 2 Cryptographic Module Specification ..................................................................................................... | 2 Cryptographic Module Specification ..................................................................................................... | 2 Cryptographic Module Specification ..................................................................................................... | 6 | | 2.1 | 2.1 | Description .................................................................................................................................... | 6 | | 2.2 | 2.2 | Tested and Vendor Affirmed Module Version and Identification ................................................... | 7 | | 2.2.1 | 2.2.1 | Tested Module Identification - Hardware: ............................................................................ | 7 | | 2.2.2 | 2.2.2 | Tested Module Identification - Software, Firmware, Hybrid (Executable Code Sets): ......... | 8 | | 2.2.3 | 2.2.3 | Tested Module Identification - Hybrid Disjoint Hardware: .................................................... | 8 | | 2.2.4 | 2.2.4 | Tested Operational Environments - Software, Firmware, Hybrid: ........................................ | 8 | | 2.2.5 | 2.2.5 | Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: ......................... | 8 | | 2.3 Excluded Components .................................................................................................................. | 2.3 Excluded Components .................................................................................................................. | 2.3 Excluded Components .................................................................................................................. | 8 | | 2.4 | Modes of Operation ....................................................................................................................... | Modes of Operation ....................................................................................................................... | 8 | | 2.5 Algorithms ..................................................................................................................................... | 2.5 Algorithms ..................................................................................................................................... | 2.5 Algorithms ..................................................................................................................................... | 9 | | 2.5.1 Approved Algorithms: ............................................................................................................ | 2.5.1 Approved Algorithms: ............................................................................................................ | 2.5.1 Approved Algorithms: ............................................................................................................ | 9 | | 2.5.2 Vendor-Affirmed Algorithms: ............................................................................................... | 2.5.2 Vendor-Affirmed Algorithms: ............................................................................................... | 2.5.2 Vendor-Affirmed Algorithms: ............................................................................................... | 11 | | 2.5.3 Non-Approved, Allowed Algorithms | 2.5.3 Non-Approved, Allowed Algorithms | 2.5.3 Non-Approved, Allowed Algorithms | .................................................................................... 11 | | 2.5.4 Non-Approved, Allowed Algorithms with No Security Claimed ........................................... | 2.5.4 Non-Approved, Allowed Algorithms with No Security Claimed ........................................... | 2.5.4 Non-Approved, Allowed Algorithms with No Security Claimed ........................................... | 11 | | 2.5.5 Non-Approved, Not | 2.5.5 Non-Approved, Not | Allowed Algorithms: | ............................................................................. 11 | | 2.6 Security Function Implementations ............................................................................................. | 2.6 Security Function Implementations ............................................................................................. | 2.6 Security Function Implementations ............................................................................................. | 11 | | 2.7 Algorithm Specific Information .................................................................................................... | 2.7 Algorithm Specific Information .................................................................................................... | 2.7 Algorithm Specific Information .................................................................................................... | 13 | | 2.7.1 AES-GCM ............................................................................................................................ | 2.7.1 AES-GCM ............................................................................................................................ | 2.7.1 AES-GCM ............................................................................................................................ | 13 | | 2.7.2 AES-XTS ............................................................................................................................. | 2.7.2 AES-XTS ............................................................................................................................. | 2.7.2 AES-XTS ............................................................................................................................. | 13 | | 2.7.3 PBKDF ................................................................................................................................ | 2.7.3 PBKDF ................................................................................................................................ | 2.7.3 PBKDF ................................................................................................................................ | 13 | | 2.8 RBG and Entropy ........................................................................................................................ | 2.8 RBG and Entropy ........................................................................................................................ | 2.8 RBG and Entropy ........................................................................................................................ | 14 | | 2.8.1 | | Entropy Information | ............................................................................................................. 14 | | 2.8.2 RNG Information ................................................................................................................. | 2.8.2 RNG Information ................................................................................................................. | 2.8.2 RNG Information ................................................................................................................. | 15 | | 2.9 Key Generation ........................................................................................................................... | 2.9 Key Generation ........................................................................................................................... | 2.9 Key Generation ........................................................................................................................... | 15 | | 2.10 Key Establishment ...................................................................................................................... | 2.10 Key Establishment ...................................................................................................................... | 2.10 Key Establishment ...................................................................................................................... | 15 | | 2.11 Industry Protocols ....................................................................................................................... 3 Cryptographic | 2.11 Industry Protocols ....................................................................................................................... 3 Cryptographic | Module Interfaces | 15 ........................................................................................................ 17 | | 3.1 | Ports and Interfaces .................................................................................................................... | Ports and Interfaces .................................................................................................................... | 17 | | | Roles, Services, and Authentication ................................................................................................... | Roles, Services, and Authentication ................................................................................................... | 18 | | 4 | | | | | | | | 18 18 | | 4.1 Authentication Methods ............................................................................................................... | 4.1 Authentication Methods ............................................................................................................... | 4.1 Authentication Methods ............................................................................................................... | | | 4.2 Roles ........................................................................................................................................... 4.3 Approved Services ...................................................................................................................... | 4.2 Roles ........................................................................................................................................... 4.3 Approved Services ...................................................................................................................... | 4.2 Roles ........................................................................................................................................... 4.3 Approved Services ...................................................................................................................... | 19 | | 4.4 Non-Approved Services .............................................................................................................. | 4.4 Non-Approved Services .............................................................................................................. | 4.4 Non-Approved Services .............................................................................................................. | 29 | This document may be reproduced and distributed in its original entirety without revision. Page 2 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | 4.5 | 4.5 | External Software/Firmware Loaded ........................................................................................... 31 | |---------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------| | 5 Software/Firmware Security ................................................................................................................ 32 | 5 Software/Firmware Security ................................................................................................................ 32 | 5 Software/Firmware Security ................................................................................................................ 32 | | 5.1 | 5.1 | Integrity Techniques .................................................................................................................... 32 | | 5.2 Initiate on Demand ...................................................................................................................... | 5.2 Initiate on Demand ...................................................................................................................... | 32 | | 6 Operational Environment .................................................................................................................... 32 | 6 Operational Environment .................................................................................................................... 32 | 6 Operational Environment .................................................................................................................... 32 | | 6.1 Operational Environment Type and Requirements ..................................................................... | 6.1 Operational Environment Type and Requirements ..................................................................... | 32 | | 7 Physical Security ................................................................................................................................. | 7 Physical Security ................................................................................................................................. | 33 | | 7.1 Mechanisms and Actions Required............................................................................................. | 7.1 Mechanisms and Actions Required............................................................................................. | 33 | | 8 Non-Invasive Security ......................................................................................................................... | 8 Non-Invasive Security ......................................................................................................................... | 34 | | 9 Sensitive Security Parameters Management ...................................................................................... | 9 Sensitive Security Parameters Management ...................................................................................... | 35 | | 9.1 Storage Areas | 9.1 Storage Areas | ............................................................................................................................. 35 | | 9.2 SSP | 9.2 SSP | Input-Output Methods ......................................................................................................... 35 | | 9.3 SSP | 9.3 SSP | Zeroization Methods ........................................................................................................... 35 | | 9.4 SSPs | 9.4 SSPs | ........................................................................................................................................... 37 | | 10 Self-Tests ............................................................................................................................................ 42 | 10 Self-Tests ............................................................................................................................................ 42 | 10 Self-Tests ............................................................................................................................................ 42 | | 10.1 | 10.1 | Pre-Operational Self-Tests .......................................................................................................... 42 | | 10.2 | 10.2 | Conditional Self-Tests ................................................................................................................. 42 | | 10.3 | 10.3 | Periodic Self-Test Information ..................................................................................................... 44 | | 10.4 Error States | 10.4 Error States | ................................................................................................................................. 46 | | 11 Life-Cycle Assurance .......................................................................................................................... 48 | 11 Life-Cycle Assurance .......................................................................................................................... 48 | 11 Life-Cycle Assurance .......................................................................................................................... 48 | | 11.1 | 11.1 | Installation, Initialization, and Startup Procedures ...................................................................... 48 | | 11.2 Administrator Guidance | 11.2 Administrator Guidance | ............................................................................................................... 48 | | 11.2.1 Secure | 11.2.1 Secure | Initialization ............................................................................................................. 48 | | 11.2.2 | 11.2.2 | Policy Restrictions ............................................................................................................... 48 | | 11.3 | 11.3 | Non-Administrator Guidance ....................................................................................................... 49 | | 11.4 | 11.4 | Maintenance Requirements ........................................................................................................ 49 | | 11.5 End of | 11.5 End of | Life ................................................................................................................................... 49 | | 12 Mitigation | of Other Attacks .................................................................................................................. 50 | of Other Attacks .................................................................................................................. 50 | | References ............................................................................................................................. Terms and Acronyms | 51 | ............................................................................................................. 54 | This document may be reproduced and distributed in its original entirety without revision. Page 3 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ##### List of Tables | Table 1: Security Levels ................................................................................................................................ | 5 | |-------------------------------------------------------------------------------------------------------------------------------------------------------------|-----| | Table 2: Tested Module Identification - Hardware ....................................................................................... | 7 | | Table 3: HW Substitute Configurations ......................................................................................................... | 8 | | Table 4: Modes List and Description ............................................................................................................. | 9 | | Table 5: Approved Algorithms ..................................................................................................................... | 11 | | Table 6: Vendor-Affirmed Algorithms .......................................................................................................... | 11 | | Table 7: Non-Approved, Allowed Algorithms with No Security Claimed ..................................................... | 11 | | Table 8: Non-Approved, Not Allowed Algorithms........................................................................................ | 11 | | Table 9: Security Function Implementations ............................................................................................... | 13 | | Table 10: Entropy Certificates ..................................................................................................................... | 15 | | Table 11: Entropy Sources .......................................................................................................................... | 15 | | Table 12: Ports and Interfaces .................................................................................................................... | 17 | | Table 13: Authentication Methods .............................................................................................................. | 18 | | Table 14: Roles ........................................................................................................................................... | 18 | | Table 15: Approved Services ...................................................................................................................... | 28 | | Table 16: Non-Approved Services .............................................................................................................. | 29 | | Table 17: Mechanisms and Actions Required ............................................................................................ | 33 | | Table 18: Storage Areas ............................................................................................................................. | 35 | | Table 19: SSP Input-Output Methods ......................................................................................................... | 35 | | Table 20: SSP Zeroization Methods ........................................................................................................... | 36 | | Table 21: SSP Table 1 ................................................................................................................................ | 39 | | Table 22: SSP Table 2 ................................................................................................................................ | 41 | | Table 23: Pre-Operational Self-Tests ......................................................................................................... | 42 | | Table 24: Conditional Self-Tests ................................................................................................................. | 44 | | Table 25: Pre-Operational Periodic Information.......................................................................................... | 45 | | Table 26: Conditional Periodic Information ................................................................................................. | 46 | | Table 27: Error States ................................................................................................................................. | 46 | | List of Figures | | | Figure 1: CM Photo ....................................................................................................................................... | 6 | | Figure 2: HW Block Diagram......................................................................................................................... | 7 | | Figure 3: Entropy Source Overview Diagram ............................................................................................. | 14 | | Figure 4: Tamper Evident Label .................................................................................................................. | 33 | This document may be reproduced and distributed in its original entirety without revision. Page 4 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 1 General ### 1.1 Overview This document is the security policy as defined by [ISO/IEC 19790:2012(E)] Annex B and [SP 800-140B Rev. 1] for the Seagate SSG5 TCG Enterprise SSC SED FIPS 140 Module, hereafter denoted as the 'CM'. ### 1.2 Security Levels The overall FIPS Security Level of the CM is level 2. The Security Levels of the CM for each individual FIPS 140-3 area are described in the following table. Table 1: Security Levels | Section | Title | Security Level | |-----------|-----------------------------------------|------------------| | 1 | General | 2 | | 2 | Cryptographic module specification | 2 | | 3 | Cryptographic module interfaces | 2 | | 4 | Roles, services, and authentication | 2 | | 5 | Software/Firmware security | 2 | | 6 | Operational environment | N/A | | 7 | Physical security | 2 | | 8 | Non-invasive security | N/A | | 9 | Sensitive security parameter management | 2 | | 10 | Self-tests | 2 | | 11 | Life-cycle assurance | 2 | | 12 | Mitigation of other attacks | N/A | | | Overall Level | 2 | This document may be reproduced and distributed in its original entirety without revision. Page 5 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 2 Cryptographic Module Specification ### 2.1 Description Purpose and Use: The primary function of the CM is to provide encryption, access control, and cryptographic erase of the User Data stored on the CM. The CM provides a wide range of cryptographic services using approved algorithms. The CM services include: - Hardware based User Data encryption - Instantaneous User Data sanitization with cryptographic erase - Independently controlled and protected User Data band/ranges - Authenticated FW download - FW download protection - Rollback FW download protection Seagate SSG5 TCG Enterprise SSC SED FIPS 140 Module 0F 1 Module Name: : Hardware Module Type Multi-Chip Embedded Module Embodiment: Cryptographic Boundary: The cryptographic boundary of the CM is the enclosure that surrounds the CM as described in section 7. A photo of the CM is provided in Figure 1 and a HW block diagram is provided in Figure 2. Figure 1: CM Photo 1 This is the value returned in the COMPLIANCE DESCRIPTOR MODULE NAME field of the FIPS 140 compliance descriptor (see [SFSC]). This document may be reproduced and distributed in its original entirety without revision. Page 6 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Figure 2: HW Block Diagram ### 2.2 Tested and Vendor Affirmed Module Version and Identification #### 2.2.1 Tested Module Identification - Hardware: This security policy applies to the cryptographic modules (CMs) described in the following tables. Table 2: Tested Module Identification - Hardware | Model and/or Part Number | Hardware Version | Firmware Version | Processors | Features | |----------------------------|--------------------|------------------------------------|--------------------------------------------------------------------------------|-----------------------------------------| | ST12000NM009H | GobyLite ASIC v1.0 | FF06, HPD1, SW75, FUD1 | GobyLite ASIC, ARM Cortex R8 on GobyLite ASIC, ARM Cortex M0+ on GobyLite ASIC | 12TB Exos NL TCG Enterprise SSC SED SAS | | ST16000NM006H | GobyLite ASIC v1.0 | FF06, HPD1, SY75, FUD1 | GobyLite ASIC, ARM Cortex R8 on GobyLite ASIC, ARM Cortex M0+ on GobyLite ASIC | 16TB Exos NL TCG Enterprise SSC SED SAS | | ST20000NM006H | GobyLite ASIC v1.0 | FF06, HPD1, SY75 | GobyLite ASIC, ARM Cortex R8 on GobyLite ASIC, ARM Cortex M0+ on GobyLite ASIC | 20TB Exos NL TCG Enterprise SSC SED SAS | | ST24000NM006H | GobyLite ASIC v1.0 | EF06, NA01, NE01, HPD1, SU75, LE01 | GobyLite ASIC, ARM Cortex R8 on GobyLite ASIC, ARM Cortex M0+ on GobyLite ASIC | 24TB Exos NL TCG Enterprise SSC SED SAS | This document may be reproduced and distributed in its original entirety without revision. Page 7 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Depending on the firmware version and configuration, the module can output a different show version. The table below shows the possible additional 'show version' outputs based on part number and firmware combinations. Combinations not shown below will display the default part number. | Model and/or Part Number | Firmware Version | Show Version Output | |----------------------------|--------------------|-------------------------------------------------------------------------------------------------------------------------| | ST24000NM006H | EF06 | ST22000NM006H; EF06 ST20000NM006H; EF06 ST18000NM007H; EF06 ST16000NM006H; EF06 ST14000NM004H; EF06 ST12000NM009H; EF06 | | ST20000NM006H | FF06 | ST18000NM007H; FF06 ST16000NM006H; FF06 ST14000NM004H; FF06 ST12000NM009H; FF06 ST10000NM025H; FF06 | | ST24000NM006H | NA01 | X401_SSUME24TA07 | | ST24000NM006H | NA01 | X403_SSUME24TA07 | | ST24000NM006H | NE01 | ST24000NM006H | | ST24000NM006H | HPD1 | MB024000JZAAV | | ST20000NM006H | HPD1 | MB020000JZAAU | | ST16000NM006H | HPD1 | MB016000JZAAT | | ST12000NM009H | HPD1 | MB012000JYZZK | Table 3: HW Substitute Configurations #### 2.2.2 Tested Module Identification - Software, Firmware, Hybrid (Executable Code Sets): N/A for this module. #### 2.2.3 Tested Module Identification - Hybrid Disjoint Hardware: N/A for this module. #### 2.2.4 Tested Operational Environments - Software, Firmware, Hybrid: N/A for this module. #### 2.2.5 Vendor-Affirmed Operational Environments - Software, Firmware, Hybrid: N/A for this module. ### 2.3 Excluded Components The CM does not have any excluded physical components. ### 2.4 Modes of Operation The CM supports both an approved mode of operation (named the TCG Security Mode) and a nonapproved mode of operation. Transitioning between the modes occurs based on how the CM is configured. To put the device in the approved mode of operation the user must set ReadLockEnabled and This document may be reproduced and distributed in its original entirety without revision. Page 8 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy WriteLockEnabled to 'True' and the LockOnReset column to include 'Power Cycle', on at least one (1) User Data range. If these configurations are not set to these values then the module is in the NonApproved mode of operation for a given range. ####### Modes List and Description: Table 4: Modes List and Description | Mode Name | Description | Type | Status Indicator | |--------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|---------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | TCG Security Mode | The CM is utilizing TCG Security as the method for managing access control and the secure initialization steps have been performed (see section 11.2.1). | Approved | FIPS Operating Mode Indicator has a value of one (1) and the User Data Range columns are configured as follows: ReadLockEnabled is "True", WriteLockEnabled is "True", and LockOnReset contains "Power Cycle" | | Non- Approved Mode | The CM/User Data Range is operating in a Non-approved mode | Non- Approved | FIPS Operating Mode Indicator has a value of one (1) and at least one of the User Data Range columns is configured as follows: ReadLockEnabled is "False", WriteLockEnabled is "False", and LockOnReset does not contain "Power Cycle" | Note: The FIPS Operating Mode Indicator is at bit 0 of byte 20 in the Vendor Unique fields in Level 0 Device Discovery. ### 2.5 Algorithms The algorithms used by the CM are described in this section. #### 2.5.1 Approved Algorithms: | Algorithm | CAVP Cert | Properties | Reference | |-------------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------| | AES-CBC | A6784 | Direction - Decrypt, Encrypt Key Length - 128, 256 | SP 800-38A | | AES-CMAC | A6785 | Direction - Generation Key Length - 256 MAC Length - MAC Length: 8-128 Increment 8 Message Length - Message Length: 128-512 Increment 128 | SP 800-38B | | AES-GCM | A6784 | Direction - Decrypt, Encrypt IV Generation - Internal IV Generation Mode - 8.2.2 Key Length - 128, 256 Tag Length - 128 IV Length - IV Length: 96 Payload Length - Payload Length: 128, 256 AAD Length - AAD Length: 0, 256 | SP 800-38D | | AES-KW | A6784 | Direction - Decrypt, Encrypt Cipher - Cipher Key Length - 256 | SP 800-38F | This document may be reproduced and distributed in its original entirety without revision. Page 9 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Algorithm | CAVP Cert | Properties | Reference | |------------------------------|-------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------| | | | Payload Length - Payload Length: 128, 192, 256, 320, 4096 | | | AES-XTS Testing Revision 2.0 | A6787 | Direction - Decrypt, Encrypt Key Length - 256 Payload Length - Payload Length: 4096, 4160, 4192, 4224, 33792 Tweak Mode - Number Data Unit Length Matches Payload Length - Yes | SP 800-38E | | Counter DRBG | A6785 | Prediction Resistance - No Supports Reseed - Yes Mode - AES-256 Derivation Function Enabled - Yes Additional Input - Additional Input: 0, 256 Entropy Input - Entropy Input: 256 Nonce - Nonce: 128 Personalization String Length - Personalization String Length: 0, 256 Returned Bits - 256 | SP 800-90A Rev. 1 | | HMAC-SHA2-256 | A6784 | MAC - MAC: 256 Key Length - Key Length: 8-512 Increment 8 | FIPS 198-1 | | HMAC-SHA2-256 | A6788 | MAC - MAC: 256 Key Length - Key Length: 8-512 Increment 8 | FIPS 198-1 | | HMAC-SHA2-384 | A6784 | MAC - MAC: 384 Key Length - Key Length: 8-1024 Increment 8 | FIPS 198-1 | | KAS-FFC-SSC Sp800-56Ar3 | A6784 | Domain Parameter Generation Methods - ffdhe2048 Hash Function Z - SHA2-512 Scheme - dhEphem - KAS Role - responder | SP 800-56A Rev. 3 | | PBKDF | A6784 | Iteration Count - Iteration Count: 1000 HMAC Algorithm - SHA2-256 Password Length - Password Length: 8-64 Increment 1 Salt Length - Salt Length: 128-512 Increment 8 | SP 800-132 | | RSA SigVer (FIPS186-5) | A6785 | Key Data Length - Key Data Length: 256 Hash Pair - Hash Algorithm - SHA2-256 Modulo - 2048, 3072 Signature Type - pkcs1v1.5 Public Exponent Mode - random | FIPS 186-5 | | Safe Primes Key Generation | A6784 | Safe Prime Groups - ffdhe2048 | SP 800-56A Rev. 3 | | SHA2-256 | A6784 | Message Length - Message Length: 0-65528 Increment 8 | FIPS 180-4 | | SHA2-256 | A6788 | Message Length - Message Length: 0-65528 Increment 8 | FIPS 180-4 | | SHA2-384 | A6784 | Message Length - Message Length: 0-65528 Increment 8 | FIPS 180-4 | | SHA2-384 | A6788 | Message Length - Message Length: 0-65528 Increment 8 | FIPS 180-4 | This document may be reproduced and distributed in its original entirety without revision. Page 10 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Table 5: Approved Algorithms | Algorithm | CAVP Cert | Properties | Reference | |----------------------------|-------------|-------------------------------------------------------------------------------|-------------------| | TLS v1.2 KDF RFC7627 (CVL) | A6784 | Hash Algorithm - SHA2-256, SHA2-384 Key Block Length - Key Block Length: 1024 | SP 800-135 Rev. 1 | Note: Only the algorithms specified in the table above are approved algorithms supported by the module in approved mode of operation. #### 2.5.2 Vendor-Affirmed Algorithms: Table 6: Vendor-Affirmed Algorithms | Name | Properties | Implementation | Reference | |-------------|-----------------------------------|------------------|-----------------------| | FW-R8 CKG 1 | Key Type:Symmetric and Asymmetric | FW-R8 | Section 4, example 1 | | FW-R8 CKG 2 | Key Type:Symmetric | FW-R8 | Section 6.3, method 1 | #### 2.5.3 Non-Approved, Allowed Algorithms N/A for this module. #### 2.5.4 Non-Approved, Allowed Algorithms with No Security Claimed Table 7: Non-Approved, Allowed Algorithms with No Security Claimed | Name | Caveat | Use and Function | |-------------------------------|---------------------|-----------------------------------------------| | AES-GCM (no security claimed) | IG 2.4.A Scenario 1 | Obfuscation | | SHA-512 (no security claimed) | IG 2.4.A Scenario 2 | Memory integrity check, no claim of security. | #### 2.5.5 Non-Approved, Not Allowed Algorithms: Table 8: Non-Approved, Not Allowed Algorithms | Name | Use and Function | |------------------------------------------|--------------------------------------------------| | AES-GCM (non-compliant) | Key wrapping (encryption / decryption) | | AES-XTS (non-compliant) | Encryption / decryption | | PBKDF (non-compliant) | Key Derivation | | RSA Signature Generation (non-compliant) | Signature generation | | SHA-256 (non-compliant) | Used in PBKDF (non-compliant) | | SHA-512 (non-compliant) | Used in RSA Signature Generation (non-compliant) | ### 2.6 Security Function Implementations The Security Functions Implementations supported on the CM are described in the following table. | Name | Type | Description | Properties | Algorithms | |-------------------------------|---------|-----------------|----------------------------|-----------------------------------| | AES-GCM (No Security Claimed) | BC-Auth | Obfuscates data | Caveat:No Security Claimed | AES-GCM (no security claimed): () | This document may be reproduced and distributed in its original entirety without revision. Page 11 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |-----------------------------|------------|----------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------| | Encrypt/Decrypt TLS Message | BC-Auth | Send/Receive encrypted TLS message | | AES-CBC: (A6784) AES-GCM: (A6784) SHA2-256: (A6788) SHA2-384: (A6784) HMAC-SHA2-256: (A6784) HMAC-SHA2-384: (A6784) | | Encrypt/Decrypt User Data | BC-UnAuth | Encrypt or decrypt User data | | AES-XTS Testing Revision 2.0: (A6787) | | Generate Key | DRBG | Generate Key | | Counter DRBG: (A6785) FW-R8 CKG 1: () FW-R8 CKG 2: () Safe Primes Key Generation: (A6784) AES-CMAC: (A6785) | | Generate random number | DRBG | Generate random number | | Counter DRBG: (A6785) AES-CMAC: (A6785) | | Key Derivation | PBKDF | Key Derivation using host provided PIN/Password | | PBKDF: (A6784) HMAC-SHA2-256: (A6788) SHA2-256: (A6788) | | Key Wrap 1 | BC-Auth | Key wrap using AES-GCM, for storage only | | AES-GCM: (A6784) | | Key Wrap 2 | BC-Auth | Key wrap using AES-KW, for storage only | | AES-KW: (A6784) | | KTS CBC/HMAC | KTS-Unwrap | Receive encrypted SSP's over TLS using CBC-based ciphers | Caveat:Key establishment methodology provides 128 or 256 bits of security strength Standard:SP 800- 38F IG D.G:Approved | AES-CBC: (A6784) HMAC-SHA2-256: (A6784) HMAC-SHA2-384: (A6784) SHA2-256: (A6788) SHA2-384: (A6784) | | KTS GCM | KTS-Unwrap | Receive encrypted SSP's over TLS using GCM-based ciphers | Caveat:Key establishment methodology provides 128 or 256 bits of | AES-GCM: (A6784) | This document may be reproduced and distributed in its original entirety without revision. Page 12 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Type | Description | Properties | Algorithms | |--------------------------------|------------------------------------------------------|----------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------| | | | | security strength Standard:SP 800- 38F IG D.G:Approved | | | SHA2-512 (No Security Claimed) | SHA | Obfuscates data | Caveat:No Security Claimed | SHA-512 (no security claimed): () | | Start TLS Session | AsymKeyPair- KeyGen DRBG KAS-135KDF KAS-Full MAC SHA | Key agreement for TLS session keys | Caveat:Key establishment methodology provides 112 bits of security strength IG:IG DF Scenario 2 Path 2 Key Confirmation:No Key Derivation:IG 2.4.B SP 800- 135rev1 CVL | TLS v1.2 KDF RFC7627: (A6784) KAS-FFC-SSC Sp800-56Ar3: (A6784) HMAC-SHA2-256: (A6784) HMAC-SHA2-384: (A6784) SHA2-256: (A6784) SHA2-384: (A6784) | | Verify FW Digital Signature | DigSig-SigVer SHA | Verifies integrity and authenticity of signed data | | RSA SigVer (FIPS186-5): (A6785) SHA2-384: (A6788) | Table 9: Security Function Implementations ### 2.7 Algorithm Specific Information #### 2.7.1 AES-GCM The method the CM uses to generate IV values for the AES-GCM algorithm is different depending on which Security Function Implementation (see section 2.6) is using the algorithm. The AES-GCM IV values for the Key Wrap 1 Security Function Implementation are 96 bits in length and are generated internally using the CM RNG (see section 2.8). This complies with scenario 2 in section C.H. of [FIPS 140-3 IG]. The AES-GCM IV values for the Send/Receive TLS Message Security Function Implementation are generated as described in [RFC 5116] and [RFC 5487]. The IV values are 160 bits in length. For each TLS session the first 96 bits are generated internally using the CM RNG (see section 2.8) and the last 64 bits are a counter value that increments with each message. If the counter value exceeds the maximum value of 2 64 , the CM will return a TLS Alert indicating that the TLS session needs to be renegotiated. This complies with scenario 1 in section C.H. of [FIPS 140-3 IG]. #### 2.7.2 AES-XTS The CM checks to ensure Key 1 does not equal Key 2 before using the keys in the XTS-AES algorithm. This check occurs within the module boundary. #### 2.7.3 PBKDF This document may be reproduced and distributed in its original entirety without revision. Page 13 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy The CM supports symmetric key derivation from a password by using the PBKDF2 algorithm with option 2a as described in section D.N of [FIPS 140-3 IG] and [SP 800-132] with a 1000 iteration count, a 128-bit Salt, and HMAC-SHA2-256 as the Pseudo Random Function (PRF) while in the approved mode of operation. The password includes any value from a minimum of 64 bits to a maximum of 256 bits. This leads to the chance of correctly guessing the minimum length PIN being 1 / (2 64 ). Keys derived from passwords, as shown in SP800-132, may only be used in storage applications. ### 2.8 RBG and Entropy The RBG and entropy used by the CM is described in this section. The RBG and entropy used by the CM follows the recommendations as described in [SP 800-90A Rev. 1] and [SP 800-90B]. #### 2.8.1 Entropy Information An entropy source (see Figure 3) is composed of a few major sections, which map to the conceptual components contained within an [SP 800-90B] entropy source. An entropy source contains the following: - A noise source - Health tests - A conditioning algorithm Figure 3: Entropy Source Overview Diagram A noise source generates samples when required by the CM. The raw samples from the noise source are stored in an entropy pool. When there are enough samples in the pool to meet the desired min-entropy of 256 bits, the entropy in the pool is conditioned. The noise source always generates new samples during each CM reset and the samples are never stored for use after a CM reset. Additionally, each sample from the noise source is subject to health tests as described in section 10. The output of an entropy source is not available until all the health tests have passed. The noise source used by the CM is the Ring Oscillator noise source, which uses the thermal noise induced jitter of CMOS inverters as the source of randomness. The ESV certificate for the noise source is provided in the following table. This document may be reproduced and distributed in its original entirety without revision. Page 14 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Table 10: Entropy Certificates | Cert Number | Vendor Name | |---------------|-------------------------| | E261 | Seagate Technology LLC. | The noise source parameters are provided in the following table. | Name | Type | Operational Environment | Sample Size | Entropy per Sample | Conditioning Component | |---------------------------------|----------|---------------------------|---------------|----------------------|--------------------------| | Seagate SSG5 SED Entropy Source | Physical | GobyLite ASIC Rev 1.0 | 128 bits | 128 bits | CMAC-AES-256 (#A6785) | Table 11: Entropy Sources #### 2.8.2 RNG Information The DRBG used in the CM is the Counter DRBG (A6785). The DRBG seed used for instantiation is constructed by concatenating the following values: - Entropy Input (256 bits of conditioned entropy) - Nonce (128 bits of conditioned entropy) - Personalization String (160 bits of device unique data padded to 256 bits) The output of the RNG is not available until the DRBG has been seeded. The DRBG is fully seeded to its 256-bit security strength. ### 2.9 Key Generation All key generation performed by the CM is in accordance with [SP 800-133 Rev. 2] and uses the CM RNG as described in 2.8 as the source of random bits. When the CM generates FFC key pairs (i.e., dhEphem), the CM uses the Extra Random Bits method as defined in [SP 800-56A Rev. 3]. When the CM generates the TLS session keys (i.e., the TLS Client Write Encryption Key and the TLS Server Write Encryption Key) for one of the AES-GCM cipher suites, the CM will compare the two keys and if they are equal, the CM will abort the TLS session. This complies with TLS/DTLS 1.2 protocol IV generation in section C.H. of [FIPS 140-3 IG]. ### 2.10 Key Establishment All key establishment using FFC key pairs (i.e., dhEphem) performed by the CM is in accordance with [SP 800-56A Rev. 3] and utilizes the KAS-FFC-SSC and TLS v1.2 KDF [RFC 7627] approved algorithms. When the CM establishes keys using dhEphem, the CM performs the FFC Full Public-Key Validation Routine as described in [SP 800-56A Rev. 3] on the key received from the host. This complies with scenario 2 path 1 of section D.F. of [FIPS 140-3 IG]. ### 2.11 Industry Protocols The host communicates with the CM via the following protocols: - The SAS protocol as described in [SBC] and [SPC] This document may be reproduced and distributed in its original entirety without revision. Page 15 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy - The TCG protocol as described in [TCG Core Spec v1], [TCG Ent SSC], and [TCG PSK Ent] The CM supports TLS v1.2 via TCG commands as described in [TCG PSK Ent]. The following TLS cipher suites are supported: - 0x00AB TLS_DHE_PSK_WITH_AES_256_GCM_SHA384 - 0x00AA TLS_DHE_PSK_WITH_AES_128_GCM_SHA256 - 0x00B3 TLS_DHE_PSK_WITH_AES_256_CBC_SHA384 - 0x00B2 TLS_DHE_PSK_WITH_AES_128_CBC_SHA256 - 0x00A9 TLS_PSK_WITH_AES_256_GCM_SHA384 - 0x00A8 TLS_PSK_WITH_AES_128_GCM_SHA256 - 0x00AF TLS_PSK_WITH_AES_256_CBC_SHA384 - 0x00AE TLS_PSK_WITH_AES_128_CBC_SHA256 For all random values needed for key establishment, the CM generates those values using the RNG as described in 2.8. No parts of the TLS protocol, other than the approved cryptographic algorithms and the KDF, have been tested by the CAVP and CMVP. This document may be reproduced and distributed in its original entirety without revision. Page 16 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 3 Cryptographic Module Interfaces ### 3.1 Ports and Interfaces The CM physical port to FIPS 140 logical interface mapping is described in the following table. | Physical Port | Logical Interface(s) | Data That Passes | |---------------------------------------|----------------------------------------------------|---------------------------| | SAS Connector | Data Input Data Output Control Input Status Output | TCG Packets, SCSI Packets | | Power Connector | Power | N/A | | Serial Interface Connector (Disabled) | None | N/A | Table 12: Ports and Interfaces This document may be reproduced and distributed in its original entirety without revision. Page 17 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 4 Roles, Services, and Authentication ### 4.1 Authentication Methods The authentication methods used by the CM are described in the following table. Table 13: Authentication Methods | Method Name | Description | Security Mechanism | Strength Each Attempt | Strength per Minute | |------------------------|----------------------------------------------------------------------|----------------------|-------------------------|-----------------------| | TCG PIN Authentication | Authentication for CM roles. Minimum PIN length is 8 bytes (64 bits) | Key Derivation | Strength: 1/(2^64) | 1024/(2^64) | ### 4.2 Roles The following roles/credentials are supported by the CM: - Drive Owner (FIPS Crypto Officer) - The Drive Owner role (also known as SID) provides access control for the ability to lock/unlock the FW Download port and the Rollback FW Download port. - EraseMaster (FIPS Crypto Officer) - The EraseMaster role provides access control for the ability to cryptographically erase LBA bands/ranges and enable/disable BandMasters. - BandMaster (FIPS Crypto Officer) - The Band Master roles (0 - 31) provide access control for the ability to carry out read and write operations. Each BandMaster can lock/unlock one LBA band/range. Note: All roles can also establish the TLS PSKs and start TLS sessions. The mapping of the roles to the FIPS 140-3 operator type and authentication methods is provided in following table. Table 14: Roles | Name | Type | Operator Type | Authentication Methods | |-------------------|--------|-----------------|--------------------------| | Drive Owner (SID) | Role | Crypto Officer | TCG PIN Authentication | | EraseMaster | Role | Crypto Officer | TCG PIN Authentication | | BandMasters | Role | Crypto Officer | TCG PIN Authentication | This document may be reproduced and distributed in its original entirety without revision. Page 18 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ### 4.3 Approved Services The Approved services are provided by the CM are described in the following table. | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |------------------------------------------|--------------------------------------------------------------------------------------------------------------------|-------------|---------------------------------------------------|-----------|-------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Authenticate | Authenticate the operator | TCG Status | TCG Authenticate Method, TCG Start Session Method | None | Key Derivation Key Wrap 1 | BandMasters - BandMaster PINs: W,E - KW AES-GCM IV: E - Master Keys: G,E,Z Drive Owner (SID) - Drive Owner (SID) PIN: W,E - KW AES-GCM IV: E - Master Keys: G,E,Z EraseMaster - EraseMaster PIN: W,E - KW AES-GCM IV: E - Master Keys: G,E,Z | | Cryptographic Erase | Erase User Data in LBA range cryptographically by changing the MEK and place the range in the uninitialized state. | TCG Status | TCG Erase Method | None | None | EraseMaster - BandMaster PINs: Z - MEKEKs: Z - MEKs: Z | | Exit FIPS Mode / Return to Factory State | Exit the approved mode of operation and return the CM to the factory state | TCG Status | TCG RevertSP Method | None | Generate random number Generate Key | Unauthenticated - BandMaster PINs: Z - BandMaster PSKs: Z - DRBG Entropy Input String: G,E,Z | This document may be reproduced and distributed in its original entirety without revision. Page 19 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |------------------------|----------------------------------------------------------------------------------------------|------------------|-------------------------------|--------------|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - Drive Owner (SID) PIN: Z - Drive Owner PSK: Z - EraseMaster PIN: Z - EraseMaster PSK: Z - MEKEKs: Z - MEKs: Z | | FW Download | New FW is downloaded to device and replaces existing FW | Interface Status | Interface FW Download Command | None | Verify FW Digital Signature | Drive Owner (SID) - FW Update Key: E | | FW Download (Rollback) | New FW is downloaded to device and replaces existing FW. New FW violates FW rollback policy. | Interface Status | Interface FW Download Command | None | Verify FW Digital Signature | Drive Owner (SID) - FW Update Key: E | | Generate Random Bytes | Generate random data for host use | TCG Status | TCG Random Method | Random Bytes | Generate random number | Unauthenticated - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z | | Reset Module | Restart the module. This will run the pre-operational and power-on conditional self- tests. | N/A | Power-On Reset | None | Verify FW Digital Signature | Unauthenticated - DRBG Entropy Input String: Z - DRBG Key: Z - DRBG Seed: Z - DRBG V: Z - Drive Owner | This document may be reproduced and distributed in its original entirety without revision. Page 20 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |----------------------------------|------------------------------------------------------------------------------------------------|-------------|----------------|-----------|--------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | (SID) PIN: Z - Platform Keys: E - Signing Authority Keys: E - TLS Client DHE Public Key: Z - TLS Client Write Encryption Key: Z - TLS Client Write MAC Key: Z - TLS Master Secret: Z - TLS Other Secret: Z - TLS Premaster Secret: Z - TLS Server DHE Private Key: Z - TLS Server DHE Public Key: Z - TLS Server Write Encryption Key: Z - TLS Server Write MAC Key: Z | | Set Enable/Disable BandMasters | Enable/disable BandMaster authority | TCG Status | TCG Set Method | None | None | EraseMaster | | Set FW Ports | Set PortLocked and LockOnReset attributes on the FW Download port or Rollback FW Download port | TCG Status | TCG Set Method | None | None | Drive Owner (SID) | | Set PIN / Password (Drive Owner) | Change operator authentication data | TCG Status | TCG Set Method | None | Generate random number Key Derivation Key Wrap 2 | BandMasters - BandMaster PINs: G,W,E,Z - DRBG Entropy Input String: G,E,Z - DRBG Key: | This document may be reproduced and distributed in its original entirety without revision. Page 21 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |----------------------|------------------------------------------------------------|-------------|----------------|-----------|------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - KW AES-GCM IV: G,E Drive Owner (SID) - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - Drive Owner (SID) PIN: G,W,E,Z - KW AES-GCM IV: G,E EraseMaster - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - EraseMaster PIN: G,W,E,Z - KW AES-GCM IV: G,E | | Set Range Attributes | Set location, size, and locking attributes of an LBA range | TCG Status | TCG Set Method | None | None | BandMasters | | Set TLS PSK | Set pre-shared key used for TLS | TCG Status | TCG Set Method | None | Generate random number AES-GCM (No Security Claimed) | BandMasters - BandMaster PSKs: W,Z - DRBG Entropy | This document may be reproduced and distributed in its original entirety without revision. Page 22 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |-------------------|---------------------------------------------------------------------------------------|-------------|---------------------------------------|--------------------------|----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z Drive Owner (SID) - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - Drive Owner PSK: W,Z EraseMaster - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - EraseMaster PSK: W,Z | | Show Status | Show status of module state, including the value of the FIPS Operating Mode Indicator | TCG Status | TCG Level 0 Discovery, TCG Get Method | Current CM Status Value | None | Unauthenticated | | Show Version | Show version of module state | TCG Status | Interface INQUIRY command | Current CM Version Value | None | Unauthenticated | | TCG Close Session | Close open TCG session | TCG Status | TCG Close Session | None | None | Unauthenticated | | TLS Close Session | Close open TLS session | TCG Status | TCG Close Session | None | None | Unauthenticated - TLS AES-GCM IV: Z | This document may be reproduced and distributed in its original entirety without revision. Page 23 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |---------------------|-----------------------------------|-------------|---------------------------|-----------|-------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - TLS Client DHE Public Key: Z - TLS Client Write Encryption Key: Z - TLS Client Write MAC Key: Z - TLS Master Secret: Z - TLS Other Secret: Z - TLS Premaster Secret: Z - TLS Server DHE Private Key: Z - TLS Server DHE Public Key: Z - TLS Server Write Encryption Key: Z - TLS Server Write MAC Key: Z | | TLS Receive Message | CM receives TLS message from host | TCG Status | Interface IF-Send Command | None | Encrypt/Decrypt TLS Message Generate random number KTS GCM KTS CBC/HMAC | BandMasters - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - TLS AES-GCM IV: G,E - TLS Client Write Encryption Key: E - TLS Client Write MAC Key: E Drive Owner (SID) - DRBG Entropy Input String: | This document may be reproduced and distributed in its original entirety without revision. Page 24 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |------------------|------------------------------|-------------|-------------------------------|-----------------------|-----------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - TLS AES-GCM IV: G,E - TLS Client Write Encryption Key: E - TLS Client Write MAC Key: E EraseMaster - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - TLS AES-GCM IV: G,E - TLS Client Write Encryption Key: E - TLS Client Write MAC Key: E | | TLS Send Message | CM sends TLS message to host | TCG Status | Interface IF- Receive Command | Encrypted TLS message | Encrypt/Decrypt TLS Message | BandMasters - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - TLS AES-GCM IV: G,E - TLS Client Write Encryption Key: E | This document may be reproduced and distributed in its original entirety without revision. Page 25 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |-------------------|----------------------------------|-------------|---------------------|-----------|-------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - TLS Server Write MAC Key: E Drive Owner (SID) - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - TLS AES-GCM IV: G,E - TLS Server Write Encryption Key: E - TLS Server Write MAC Key: E EraseMaster - DRBG Entropy Input String: G,E,Z - DRBG Key: G,E,Z - DRBG Seed: G,E,Z - DRBG V: G,E,Z - TLS AES-GCM IV: G,E - TLS Server Write Encryption Key: E - TLS Server Write MAC Key: E | | TLS Start Session | Start host-initiated TLS session | TCG Status | TCG StartTLS Method | None | Start TLS Session AES-GCM (No Security Claimed) | BandMasters - BandMaster PSKs: E - TLS Client DHE Public Key: W,E - TLS Client Write Encryption Key: G | This document may be reproduced and distributed in its original entirety without revision. Page 26 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |--------|---------------|-------------|----------|-----------|----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - TLS Client Write MAC Key: G - TLS Master Secret: G,E - TLS Other Secret: G,E - TLS Premaster Secret: G,E - TLS Server DHE Private Key: G,E - TLS Server DHE Public Key: G,R - TLS Server Write Encryption Key: G - TLS Server Write MAC Key: G Drive Owner (SID) - Drive Owner PSK: E - TLS Client DHE Public Key: W,E - TLS Client Write Encryption Key: G - TLS Client Write MAC Key: G - TLS Master Secret: G,E - TLS Other Secret: G,E - TLS Premaster Secret: G,E - TLS Server DHE Private Key: G,E - TLS Server DHE Public Key: G,R - TLS Server Write Encryption Key: G | This document may be reproduced and distributed in its original entirety without revision. Page 27 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Indicator | Inputs | Outputs | Security Functions | SSP Access | |-----------------------------|------------------------------------------------------------------------|------------------|------------------------------|---------------------|----------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | | - TLS Server Write MAC Key: G EraseMaster - EraseMaster PSK: E - TLS Client DHE Public Key: W,E - TLS Client Write Encryption Key: G - TLS Client Write MAC Key: G - TLS Master Secret: G,E - TLS Other Secret: G,E - TLS Premaster Secret: G,E - TLS Server DHE Private Key: G,E - TLS Server DHE Public Key: G,R - TLS Server Write Encryption Key: G - TLS Server Write MAC Key: G | | User Data Lock/Unlock Range | Lock/Unlock read/decrypt or write/decrypt of User Data in an LBA range | TCG Status | TCG Set Method | None | Key Wrap 2 | BandMasters - MEKEKs: E - MEKs: E | | User Data Read / Write | Encrypt/write or decrypt/read User data from an LBA range | Interface Status | Interface Read/Write Command | Plaintext User Data | Encrypt/Decrypt User Data SHA2-512 (No Security Claimed) | BandMasters - MEKs: E | Table 15: Approved Services Definitions for Roles SSP Access column values in the table above: - G = Generate: The module generates or derives the SSP This document may be reproduced and distributed in its original entirety without revision. Page 28 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy - R = Read: The SSP is read from the module (e.g., the SSP is an output) - W = Write: The SSP is updated, imported, or written to the module - E = Execute: The module uses the SSP in performing a cryptographic operation - Z = Zeroize: The module zeroizes the SSP Note: The following services are identified as aligning with the 'lock-based authentication model': - User Data Read/Write - FW Download - FW Download (Rollback) The 'lock-based authentication model' is described in IG 4.1.A of [FIPS 140-3 IG]. The primary purpose of the CM is data-at-rest protection for User Data and the 'lock-based authentication model' is sufficient to meet this use case. Assuming the CM has been correctly initialized (see section 11), when the CM is powered cycled, the CM will be in a locked state and will require authentication and unlocking prior to the Approved service being available. ### 4.4 Non-Approved Services The Non-Approved services are provided by the CM are described in the following table. SSPs generated or derived in the approved mode cannot be used in the non-approved mode and vice versa. | Name | Description | Algorithms | Role | |-------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------|-------------| | Cryptographic Erase | Generates new range key following sanitization of the non-volatile media. | AES-GCM (non- compliant) PBKDF (non-compliant) SHA-256 (non-compliant) | EraseMaster | | Cryptographic Erase (Certified) | Generates new range key and provides certificate of media disposition for each piece of the non-volatile media following sanitization. | RSA Signature Generation (non- compliant) AES-GCM (non- compliant) PBKDF (non-compliant) SHA-256 (non-compliant) SHA-512 (non-compliant) | EraseMaster | | User Data Read / Write (Locking Disabled) | Encrypt / decrypt user data from an LBA range where Locking is disabled | AES-XTS (non-compliant) | None | Table 16: Non-Approved Services This document may be reproduced and distributed in its original entirety without revision. Page 29 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Note: Locking is disabled for an LBA range if the ReadLockEnabled or WriteLockEnabled values are set to 'False', or the LockOnReset value does not include 'Power Cycle'. The current values of these attributes can be determined using the Show Status Approved service (i.e., the TCG Get Method on the associated LBA range locking object). This document may be reproduced and distributed in its original entirety without revision. Page 30 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ### 4.5 External Software/Firmware Loaded The CM firmware may be updated by an external source via the FW download operation. Prior to accepting new firmware provided by the FW download operation, the CM will verify the authenticity and integrity of the CM incoming firmware using RSA SigVer (A6785) with the following parameters: - The key is the FW Update Key - The modulus size is 3072 bits - The hash function is SHA2-384 (A6788) Note: The FW Download port and possibly the Rollback FW Download port need to be unlocked for the CM to accept new FW. The ports will re-lock on a power-cycle. This document may be reproduced and distributed in its original entirety without revision. Page 31 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 5 Software/Firmware Security ### 5.1 Integrity Techniques During the power-on boot process or FW download process, the CM will verify the authenticity and integrity of the CM firmware using RSA SigVer (A6785) with the following parameters: - The key is a Signing Authority Key. 1F 2 - The modulus size is 3072 bits - The hash function is SHA-384 (A6788) The integrity of the following executable binary files is verified using the above method: - Boot FW ITCM - Boot FW IDBA - Controller/Servo FW Any firmware/software loaded into this module that is not shown on the module certificate, is out of the scope of this validation and requires a separate FIPS 140-3 validation. ### 5.2 Initiate on Demand The operator can invoke the boot firmware integrity test on demand by performing a power-on reset operation on the CM. ## 6 Operational Environment ### 6.1 Operational Environment Type and Requirements Type of Operational Environment: Limited How Requirements are Satisfied: The CM operates in a limited operational environment where the CM firmware may be updated by an external source as described in section 5. Only firmware signed by the manufacturer private key will be accepted by the CM. 2 Per section 7.5 of ISO 19790, the public verification key used for firmware integrity is not considered an SSP. This document may be reproduced and distributed in its original entirety without revision. Page 32 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 7 Physical Security ### 7.1 Mechanisms and Actions Required The CM is made up of product grade components with standard passivation. The CM is surrounded by a metal enclosure that is opaque within the visible spectrum. To meet the level 2 physical security requirements, the CM employs a factory installed tamper-evident label (TEL) to prevent physical tampering. A photo of the TEL is provided in Figure 4. The physical inspection guidelines are provided in the following table. Table 17: Mechanisms and Actions Required | Mechanism | Inspection Frequency | Inspection Guidance | |------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Opaque, TEL on exposed (back) side of the PCBA | The frequency of the physical inspection should be determined by the Crypto Officer. It is recommended that the TEL be inspected monthly. | Periodic inspection of TEL to detect evidence of tampering: checkerboard pattern on TEL, security label cutouts do not match original, and security label over PCBA screws is not penetrated Upon discovery of tamper evidence, the CM should be handled per organizational policies. | Figure 4: Tamper Evident Label This document may be reproduced and distributed in its original entirety without revision. Page 33 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 8 Non-Invasive Security The CM does not provide any mitigation against non-invasive attacks. This document may be reproduced and distributed in its original entirety without revision. Page 34 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 9 Sensitive Security Parameters Management ### 9.1 Storage Areas The storage areas on the CM where SSPs may be present are described in the following table. Table 18: Storage Areas | Storage Area Name | Description | Persistence Type | |---------------------|-------------------------------------------------|--------------------| | DRAM | Temporary, volatile memory | Dynamic | | HW Registers | Temporary, volatile memory | Dynamic | | Media | Persistent, non-volatile memory | Static | | ROM | Persistent, non-modifiable, non-volatile memory | Static | | Serial Flash | Persistent, non-volatile memory | Static | ### 9.2 SSP Input-Output Methods The SSP Input-Output methods supported by the CM are described in the following table. Table 19: SSP Input-Output Methods | Name | From | To | Format Type | Distribution Type | Entry Type | SFI or Algorithm | |-------------------------|---------|---------|---------------|---------------------|--------------|--------------------| | Host Input | Entered | DRAM | Plaintext | Manual | Electronic | | | Host Input TLS CBC/HMAC | Entered | DRAM | Encrypted | Manual | Electronic | KTS CBC/HMAC | | Host Input TLS GCM | Entered | DRAM | Encrypted | Manual | Electronic | KTS GCM | | Host Output | DRAM | Entered | Plaintext | Manual | Electronic | | ### 9.3 SSP Zeroization Methods The methods used by the CM to zeroize SSP are described in the following table. | Zeroization Method | Description | Rationale | Operator Initiation | |----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | ZM1 | Write volatile memory: Zeroize SSP by writing the memory where the SSP is stored with a pattern of all bytes set to 0x00. | The method ensures that the previous SSP value is entirely overwritten and is no longer stored in volatile memory. | Authenticate, Cryptographic Erase, Exit FIPS Mode / Return to Factory State, Reset Module, Set PIN / Password, Set TLS PSK, TCG Close Session, TLS Close Session, TLS Start Session | | ZM2 | Write non-volatile memory (unprotected SSPs): Zeroize unprotected (i.e., plaintext or obfuscated) SSPs stored in non-volatile memory by writing the memory where the SSP is stored with a pattern | The method ensures that the previous SSP value is entirely overwritten and is no longer stored in non- volatile memory. Additionally, the two overwrites mitigates the | Exit FIPS Mode / Return to Factory State, Set TLS PSK | This document may be reproduced and distributed in its original entirety without revision. Page 35 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Table 20: SSP Zeroization Methods | Zeroization Method | Description | Rationale | Operator Initiation | |----------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------| | | of all bytes set to 0x00 and then writing the new SSP value. | risk of any residual data in the non-volatile memory | | | ZM3 | Write non-volatile memory (protected SSPs): Zeroize protected (i.e., encrypted using another SSP) SSPs stored in non-volatile memory by writing the memory where the SSP is stored with a pattern of all bytes set to 0x00 and then writing the new SSP value. | The method ensures that the previous SSP value is entirely overwritten and is no longer stored in volatile memory. | Cryptographic Erase, Exit FIPS Mode / Return to Factory State, Set PIN/Password | Note: When the CM begins processing a zeroization method, the processing of the method cannot be interrupted. If the CM loses power while processing a zeroization method on non-volatile memory, the CM will resume processing the method when the CM is powered on again This document may be reproduced and distributed in its original entirety without revision. Page 36 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ### 9.4 SSPs The SSPs supported by the CM are described in the following tables. | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |---------------------------|------------------------|-----------------------------|---------------------------------|-------------------------------------------------------|------------------|-------------------------------------------------------| | BandMaster PINs | PINs | 64-256 bits - 64-256 bits | Authentication credential - CSP | | | Key Derivation | | BandMaster PSKs | Pre-Shared Keys | 128-512 bits - 128-256 bits | Symmetric - CSP | | | Start TLS Session | | DRBG Entropy Input String | Entropy input for DRBG | 256 bits - 256 bits | DRBG Input - CSP | Entropy | | Generate random number Generate Key Start TLS Session | | DRBG Key | Key for DRBG | 256 bits - 256 bits | DRBG Parameter - CSP | Generate random number Generate Key Start TLS Session | | Generate random number Generate Key Start TLS Session | | DRBG Seed | Seed for DRBG | 256 - 256 | DRBG Parameter - CSP | Entropy | | Generate random number Generate Key Start TLS Session | | DRBG V | V Value for DRBG | 128 bits - 128 bits | DRBG Parameter - CSP | Generate random number Generate Key Start TLS Session | | Generate random number Generate Key Start TLS Session | | Drive Owner (SID) PIN | PIN | 64-256 bits - 64-256 bits | Authentication credential - CSP | | | Key Derivation | | Drive Owner PSK | Pre-Shared Key | 128-512 bits - 128-256 bits | Symmetric - CSP | | | Start TLS Session | | EraseMaster PIN | PIN | 64-256 bits - 64-256 bits | Authentication credential - CSP | | | Key Derivation | | EraseMaster PSK | Pre-Shared Key | 128-512 bits - 128-256 bits | Symmetric - CSP | | | Start TLS Session | This document may be reproduced and distributed in its original entirety without revision. Page 37 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Size - Strength | Type - Category | Generated By | Established By | Used By | |---------------------------------|-------------------------------------------------------------------------------------------------|-----------------------------------|-------------------|------------------------|-------------------|--------------------------------------------------| | FW Update Key | Signing Key | 3072 bits - 128 bits | Public - PSP | Preloaded | | Verify FW Digital Signature | | KW AES-GCM IV | AES-GCM IV used for key wrap | 96 bits - 96 bits | Public - PSP | Generate random number | | Key Wrap 1 | | Master Keys | Encrypts the MEKEK | 256-bits - 256-bits | Symmetric - CSP | Key Derivation | | Key Wrap 1 | | MEKEKs | Encrypts the MEK | 256-bits - 256-bits | Symmetric - CSP | Generate Key | | Key Wrap 2 | | MEKs | Media Encryption Key | 256-bits - 256-bits | Symmetric - CSP | Generate Key | | Encrypt/Decrypt User Data | | Platform Keys | Signs the Firmware Integrity Key. Not an SSP. | 3072 bits - 128 bits | Public - Neither | Preloaded | | Verify FW Digital Signature | | Signing Authority Keys | Firmware Integrity Key. Not an SSP. | 3072 bits - 128 bits | Public - Neither | Preloaded | | Verify FW Digital Signature | | TLS AES-GCM IV | AES-GCM IV used in TLS protocol | 160 bits - 96 bits | Public - PSP | Start TLS Session | | Encrypt/Decrypt TLS Message KTS GCM | | TLS Client DHE Public Key | TLS Handshake Keys | 2048 bits - 112 bits | Public - PSP | | | Start TLS Session | | TLS Client Write Encryption Key | TLS Session Keys | 128 or 256 bits - 128 or 256 bits | Symmetric - CSP | Start TLS Session | | Encrypt/Decrypt TLS Message KTS GCM KTS CBC/HMAC | | TLS Client Write MAC Key | TLS Session Keys | 256 bits/384 bits - 256 bits | Symmetric - CSP | Start TLS Session | | Encrypt/Decrypt TLS Message KTS CBC/HMAC | | TLS Master Secret | TLS Handshake Keys | 384 bits - 256 bits | Derivation - CSP | Start TLS Session | | Start TLS Session | | TLS Other Secret | TLS Other Secret. Used as part of the TLS Premaster Secret when TLS PSK cipher supports KAS FFC | 256 bits - 112 bits | Symmetric - CSP | | Start TLS Session | Start TLS Session | | TLS Premaster Secret | TLS Handshake Keys | 128-768 bits - 128-256 bits | Symmetric - CSP | Start TLS Session | | Start TLS Session | | TLS Server DHE Private Key | TLS Handshake Keys | 2048 bits - 112 bits | Private - CSP | Start TLS Session | | Start TLS Session | This document may be reproduced and distributed in its original entirety without revision. Page 38 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Description | Size - Strength | Type - Category | Generated By Established By | Used By | |---------------------------------|--------------------|-----------------------------------|-------------------|-------------------------------|-----------------------------| | TLS Server DHE Public Key | TLS Handshake Keys | 2048 bits - 112 bits | Public - PSP | Start TLS Session | | | TLS Server Write Encryption Key | TLS Session Keys | 128 or 256 bits - 128 or 256 bits | Symmetric - CSP | Start TLS Session | Encrypt/Decrypt TLS Message | | TLS Server Write MAC Key | TLS Session Keys | 256 bits/384 bits - 256 bits | Symmetric - CSP | Start TLS Session | Encrypt/Decrypt TLS Message | Table 21: SSP Table 1 | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |---------------------------|-------------------------------------------------------|---------------------------------|---------------------|---------------|------------------------------------------------------------------------| | BandMaster PINs | Host Input Host Input TLS GCM Host Input TLS CBC/HMAC | DRAM:Plaintext Media:Obfuscated | Duration of Session | ZM1 ZM3 | Master Keys:Derives | | BandMaster PSKs | Host Input Host Input TLS GCM Host Input TLS CBC/HMAC | DRAM:Plaintext Media:Obfuscated | Duration of Session | ZM1 ZM2 | TLS Premaster Secret:Derives | | DRBG Entropy Input String | | DRAM:Plaintext | Duration of Session | ZM1 | DRBG Seed:Derives | | DRBG Key | | HW Registers:Plaintext | Duration of Session | ZM1 | DRBG Seed:Derived From | | DRBG Seed | | DRAM:Plaintext | Duration of Session | ZM1 | DRBG Key:Derives DRBG V:Derives DRBG Entropy Input String:Derived From | | DRBG V | | HW Registers:Plaintext | Duration of Session | ZM1 | DRBG Seed:Derived From | | Drive Owner (SID) PIN | Host Input Host Input TLS GCM Host Input TLS CBC/HMAC | DRAM:Plaintext Media:Obfuscated | Duration of Session | ZM1 ZM3 | Master Keys:Derives | | Drive Owner PSK | Host Input Host Input TLS GCM | DRAM:Plaintext Media:Obfuscated | Duration of Session | ZM1 ZM2 | TLS Premaster Secret:Derives | This document may be reproduced and distributed in its original entirety without revision. Page 39 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |---------------------------------|-------------------------------------------------------|----------------------------------------|---------------------|---------------|----------------------------------------------------------------------------------------------------------| | | Host Input TLS CBC/HMAC | | | | | | EraseMaster PIN | Host Input Host Input TLS GCM Host Input TLS CBC/HMAC | DRAM:Plaintext Media:Obfuscated | Duration of Session | ZM1 ZM3 | Master Keys:Derives | | EraseMaster PSK | Host Input Host Input TLS GCM Host Input TLS CBC/HMAC | DRAM:Plaintext Media:Obfuscated | Duration of Session | ZM1 ZM2 | TLS Premaster Secret:Derives | | FW Update Key | | ROM:Plaintext | | | | | KW AES-GCM IV | | Media:Plaintext DRAM:Plaintext | Duration of Session | | | | Master Keys | | DRAM:Plaintext | Duration of Session | ZM1 | Drive Owner (SID):Derived From BandMaster PINs:Derived From EraseMaster PIN:Derived From MEKEKs:Encrypts | | MEKEKs | | DRAM:Plaintext Media:Encrypted | Duration of Session | ZM1 ZM3 | MEKs:Encrypts Master Keys:Encrypted by | | MEKs | | HW Registers:Plaintext Media:Encrypted | Duration of Session | ZM1 ZM3 | MEKEKs:Encrypted by | | Platform Keys | | ROM:Plaintext | | | Signing Authority Keys:Signs | | Signing Authority Keys | | DRAM:Plaintext Serial Flash:Plaintext | Duration of Session | | Platform Keys:Signed by | | TLS AES-GCM IV | | DRAM:Plaintext | Duration of Session | | | | TLS Client DHE Public Key | Host Input | DRAM:Plaintext | Duration of Session | ZM1 | TLS Other Secret:Derives | | TLS Client Write Encryption Key | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Master Secret:Derived From | | TLS Client Write MAC Key | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Master Secret:Derived From | | TLS Master Secret | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Premaster Secret:Derived From TLS Client Write Encryption Key:Derives | This document may be reproduced and distributed in its original entirety without revision. Page 40 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Name | Input - Output | Storage | Storage Duration | Zeroization | Related SSPs | |---------------------------------|------------------|----------------|---------------------|---------------|------------------------------------------------------------------------------------------------------------------------------------------------| | | | | | | TLS Server Write Encryption Key:Derives TLS Client Write MAC Key:Derives TLS Server Write MAC Key:Derives | | TLS Other Secret | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Client DHE Public Key:Derived From TLS Server DHE Private Key:Derived From TLS Premaster Secret:Derives | | TLS Premaster Secret | | DRAM:Plaintext | Duration of Session | ZM1 | Drive Owner PSK:Derived From BandMaster PSKs:Derived From EraseMaster PSK:Derived From TLS Other Secret:Derived From TLS Master Secret:Derives | | TLS Server DHE Private Key | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Server DHE Public Key:Paired With TLS Other Secret:Derives | | TLS Server DHE Public Key | Host Output | DRAM:Plaintext | Duration of Session | ZM1 | TLS Server DHE Private Key:Paired With | | TLS Server Write Encryption Key | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Master Secret:Derived From | | TLS Server Write MAC Key | | DRAM:Plaintext | Duration of Session | ZM1 | TLS Master Secret:Derived From | Table 22: SSP Table 2 Note: The Storage Duration column in the above table is with respect to the volatile version of the SSP (i.e., DRAM or HW Registers). Additionally, the column value Duration of Session can refer to either a TCG/TLS session or a power-on session. ### 9.5 Transitions In 2030, the minimum key strength will transition from 112 bits to 128 bits. This document may be reproduced and distributed in its original entirety without revision. Page 41 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 10 Self-Tests ### 10.1 Pre-Operational Self-Tests The pre-operation self-tests performed by the CM are described in the following table. Algorithms utilized in the Pre-operational firmware integrity tests must pass their own CASTs prior to the integrity tests. Table 23: Pre-Operational Self-Tests | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | |-----------------------------------------------------------------|------------------------------|---------------|-----------------|-------------------------------------------------------|------------------------------------------------| | Controller/Servo Integrity Test, RSA SigVer (FIPS186-5) (A6785) | Modulus: 3048, Hash: SHA-384 | KAT | SW/FW Integrity | If test fails, the CM enters FW Integrity Error State | Verify signature on stored Controller/Servo FW | | IDBA Integrity Test, RSA SigVer (FIPS186- 5) (A6785) | Modulus: 3048, Hash: SHA-384 | KAT | SW/FW Integrity | If test fails, the CM enters FW Integrity Error State | Verify signature on stored IDBA FW | | ITCM Integrity Test, RSA SigVer (FIPS186- 5) (A6785) | Modulus: 3048, Hash: SHA-384 | KAT | SW/FW Integrity | If test fails, the CM enters FW Integrity Error State | Verify signature on stored ITCM FW | ### 10.2 Conditional Self-Tests The conditional self-tests performed by the CM are described in the following table. | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |-----------------------------------------------|--------------------------|------------------|-------------|------------------------------------------------|----------------------------------------------|-------------------------------------------------------------| | Counter DRBG Reseed (A6785) | AES-256 | KAT | CAST | If test fails, CM enters Self-Test Error State | Reseed Health Test (see [SP 800-90A Rev. 1]) | Bootup | | 90B Continuous Adaptive Proportion Test (APT) | Adaptive Proportion Test | Fault- Detection | CAST | If test fails, CM enters Self-Test Error State | APT | Continuous as entropy is generated from the entropy source. | | 90B Continuous Repetition Count Test (RCT) | Repetition Count Test | Fault- Detection | CAST | If test fails, CM enters Self-Test Error State | RCT | Continuous as entropy is generated from the entropy source | | 90B Start-up Adaptive Proportion Test (APT) | Adaptive Proportion Test | Fault- Detection | CAST | If test fails, CM enters Self-Test Error State | APT | Bootup | | 90B Start-up Repetition | Repetition Count Test | Fault- Detection | CAST | If test fails, CM enters | RCT | Bootup | This document may be reproduced and distributed in its original entirety without revision. Page 42 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |----------------------------------------------|-------------------|-----------------|-------------------|------------------------------------------------------------|-------------------------------------------------------------------------|-----------------------------------| | Count Test (RCT) | | | | Self-Test Error State | | | | AES-CBC Decrypt (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Decrypt | Bootup | | AES-CBC Encrypt (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Encrypt | Bootup | | AES-CMAC (A6785) | AES-256 | KAT | CAST | If test fails, CM enters Self-Test Error State | Generate MAC | Bootup | | AES-GCM Decrypt (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Authenticated Decrypt | Bootup | | AES-GCM Encrypt (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Authenticated Encrypt | Bootup | | AES-KW Decrypt (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Authenticated Decrypt | Bootup | | AES-KW Encrypt (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test | Authenticated Encrypt | Bootup | | AES-XTS Comparison Test (A6784) | 256-bit key | Comparison Test | Critical Function | Error State If test fails, CM enters Self-Test Error State | Generated XTS keys are compared to ensure Key_1 and Key_2 are not equal | Every time XTS keys are generated | | AES-XTS Testing Revision 2.0 Decrypt (A6787) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Decrypt | Bootup | | AES-XTS Testing Revision 2.0 Encrypt (A6787) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Encrypt | Bootup | | Counter DRBG (A6785) | AES-256 | KAT | CAST | If test fails, CM enters Self-Test Error State | DRBG | Bootup | | Counter DRBG | AES-256 | KAT | CAST | If test fails, CM enters | Generate Health Test | Bootup | This document may be reproduced and distributed in its original entirety without revision. Page 43 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Algorithm or Test | Test Properties | Test Method | Test Type | Indicator | Details | Conditions | |------------------------------------|------------------------------------|---------------|-------------|--------------------------------------------------------------------------------------------------------------|----------------------------------------------------|-----------------------------------------------------| | Generate (A6785) | | | | Self-Test Error State | (see [SP 800- 90A Rev. 1]) | | | Counter DRBG Instantiate (A6785) | AES-256 | KAT | CAST | If test fails, CM enters Self-Test Error State | Instantiate Health Test (see [SP 800- 90A Rev. 1]) | Bootup | | Firmware Load Test | Modulus - 3072-bit Hash: SHA- 384 | KAT | SW/FW Load | If the test fails, the CM discards incoming FW image, returns failure status, and continues normal operation | Verify Signature | Test runs every time new FW is loaded to the device | | HMAC- SHA2-256 (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Generate MAC | Bootup | | HMAC- SHA2-384 (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Generate MAC | Bootup | | KAS-FFC- SSC Sp800- 56Ar3 (A6784) | 2048-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Generate Primitive Z | Bootup | | PBKDF (A6784) | 256-bit key | KAT | CAST | If test fails, CM enters Self-Test Error State | Key Derivation | Bootup | | RSA SigVer (FIPS186-5) (A6785) | Modulus - 3072-bit Hash: SHA- 384 | KAT | CAST | If test fails, CM enters Self-Test Error State | Verify Signature | Bootup | | Safe Primes Key Generation (A6784) | Domain Parameters: ffdhe2048 | PCT | PCT | If test fails, CM enters Self-Test Error State | Generate Key Pair | Every time KAS-FFC keys are generated | | TLS v1.2 KDF RFC7627 (A6784) | Hash Algorithm: SHA2-256, SHA2-384 | KAT | CAST | If test fails, CM enters Self-Test Error State | Key Derivation | Bootup | Table 24: Conditional Self-Tests ### 10.3 Periodic Self-Test Information The periodic self-tests information is provided in the following tables. This document may be reproduced and distributed in its original entirety without revision. Page 44 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Table 25: Pre-Operational Periodic Information | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |-----------------------------------------------------------------|---------------|-----------------|----------|-------------------| | Controller/Servo Integrity Test, RSA SigVer (FIPS186-5) (A6785) | KAT | SW/FW Integrity | Manual | Reboot | | IDBA Integrity Test, RSA SigVer (FIPS186-5) (A6785) | KAT | SW/FW Integrity | Manual | Reboot | | ITCM Integrity Test, RSA SigVer (FIPS186-5) (A6785) | KAT | SW/FW Integrity | Manual | Reboot | | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |-----------------------------------------------|-----------------|-------------------|----------|-------------------| | Counter DRBG Reseed (A6785) | KAT | CAST | Manual | Reboot | | 90B Continuous Adaptive Proportion Test (APT) | Fault-Detection | CAST | | | | 90B Continuous Repetition Count Test (RCT) | Fault-Detection | CAST | | | | 90B Start-up Adaptive Proportion Test (APT) | Fault-Detection | CAST | Manual | Reboot | | 90B Start-up Repetition Count Test (RCT) | Fault-Detection | CAST | Manual | Reboot | | AES-CBC Decrypt (A6784) | KAT | CAST | Manual | Reboot | | AES-CBC Encrypt (A6784) | KAT | CAST | Manual | Reboot | | AES-CMAC (A6785) | KAT | CAST | Manual | Reboot | | AES-GCM Decrypt (A6784) | KAT | CAST | Manual | Reboot | | AES-GCM Encrypt (A6784) | KAT | CAST | Manual | Reboot | | AES-KW Decrypt (A6784) | KAT | CAST | Manual | Reboot | | AES-KW Encrypt (A6784) | KAT | CAST | Manual | Reboot | | AES-XTS Comparison Test (A6784) | Comparison Test | Critical Function | | | This document may be reproduced and distributed in its original entirety without revision. Page 45 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy Table 26: Conditional Periodic Information | Algorithm or Test | Test Method | Test Type | Period | Periodic Method | |----------------------------------------------|---------------|-------------|----------|-------------------| | AES-XTS Testing Revision 2.0 Decrypt (A6787) | KAT | CAST | Manual | Reboot | | AES-XTS Testing Revision 2.0 Encrypt (A6787) | KAT | CAST | Manual | Reboot | | Counter DRBG (A6785) | KAT | CAST | Manual | Reboot | | Counter DRBG Generate (A6785) | KAT | CAST | Manual | Reboot | | Counter DRBG Instantiate (A6785) | KAT | CAST | Manual | Reboot | | Firmware Load Test | KAT | SW/FW Load | | | | HMAC-SHA2-256 (A6784) | KAT | CAST | Manual | Reboot | | HMAC-SHA2-384 (A6784) | KAT | CAST | Manual | Reboot | | KAS-FFC-SSC Sp800-56Ar3 (A6784) | KAT | CAST | Manual | Reboot | | PBKDF (A6784) | KAT | CAST | Manual | Reboot | | RSA SigVer (FIPS186-5) (A6785) | KAT | CAST | Manual | Reboot | | Safe Primes Key Generation (A6784) | PCT | PCT | | | | TLS v1.2 KDF RFC7627 (A6784) | KAT | CAST | Manual | Reboot | ### 10.4 Error States The Error State supported by the CM are described in the following table. Table 27: Error States | Name | Description | Conditions | Recovery Method | Indicator | |-----------------------------------|------------------------------|-----------------------------------------------------------|-------------------|-----------------------------------------------------------------| | FW Integrity Error State | FW Integrity Test has failed | Failure of FW Integrity Test during CM power- on sequence | None | Interface error returned on first non- inquiry/identify command | | Self-Test Error State (Permanent) | Self-Test has failed | Failure of CAST after a reboot from a Transient failure. | None | Byte 17 of Level 0 Discovery is 0xFF | | Self-Test Error State (Transient) | Self-Test has failed | Failure of CAST or Entropy CFT test | Reset Module | Byte 17 of Level 0 Discovery is 0xFF | Note: If the CM enters an error state, the CM returns a failure status, disables all cryptographic operations, and restricts the data output interface. If the error is non-recoverable, there may be SSPs on This document may be reproduced and distributed in its original entirety without revision. Page 46 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy the CM that have not been sanitized. If this occurs, the Crypto Officer should handle the CM per organizational policies. This document may be reproduced and distributed in its original entirety without revision. Page 47 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 11 Life-Cycle Assurance ### 11.1 Installation, Initialization, and Startup Procedures When the CM is shipped from the factory, it is not in the compliant state. The FIPS Crypto Officer must perform the Secure Initialization steps (see section 11.2.1) for the CM to transition to the compliant state. Additionally, for the CM to remain in the compliant state, there are some Security Policy Restrictions (see section 11.2.2) that need to be maintained. ### 11.2 Administrator Guidance The Secure Initialization steps are described in section 11.2.1 and the ongoing policy restrictions are described in section 11.2.2. The Product Manual is available at the following link: [https://www.seagate.com/content/dam/seagate/assets/support/internal-hard-drive/enterprisehard-drives/exos-x24/_shared/files/Seagate_Exos_24_SAS_ISE-SED-FIPs(12-16-2024TB)_Rev-A.pdf](https://www.seagate.com/content/dam/seagate/assets/support/internal-hard-drive/enterprise-hard-drives/exos-x24/_shared/files/Seagate_Exos_24_SAS_ISE-SED-FIPs(12-16-20-24TB)_Rev-A.pdf) #### 11.2.1 Secure Initialization The Crypto Officer shall perform the following Secure Initialization steps when the CM is installed to transition the CM into the compliant state: 1. Upon receipt of the product examine the shipping packaging and the product packaging to ensure it has not been accessed during shipping by the trusted courier. 2. At installation and periodically thereafter, examine the physical security mechanisms for tamper evidence. 3. At initialization, set all enabled operator PINs applicable for the approved mode to private values of at least 8 bytes (64 bits) in length: Drive Owner, EraseMaster, and BandMasters 2F 3 . 4. At initialization, set ReadLockEnabled and WriteLockEnabled to 'True' and the LockOnReset column to include 'Power Cycle', on at least one (1) User Data range. 5. At initialization, disable the 'Makers' authority. 6. At initialization, set the value of LockOnReset for FW Download port to include 'Power Cycle'. #### 11.2.2 Policy Restrictions For the CM to remain in the compliant state, the Crypto Officer shall ensure the following Security Policy Restrictions are maintained: - The ReadLockEnabled and WriteLockEnabled values must be set to 'True' and the LockOnReset value must include 'Power Cycle', for at least one (1) User Data range - The 'Makers' authority must be disabled. - The value of LockOnReset for FW Download port must include 'Power Cycle'. 3 A subset of the operator authority/PINs are enabled by default. If use of any other authority/PINs not enabled by default is required in the FIPS Operating mode, the Crypto Officer will need to enable them as part of the initialization steps. This document may be reproduced and distributed in its original entirety without revision. Page 48 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ### 11.3 Non-Administrator Guidance There is no non-administrator guidance for the CM. ### 11.4 Maintenance Requirements The CM has no maintenance requirements. ### 11.5 End of Life When the CM reaches end-of-life, the Crypto Officer must zeroize all SSPs prior to retiring the CM. The Crypto Officer shall perform the following steps when the CM is at end-of-life: 1. The Crypto Officer shall revert the CM to the factory default state by invoking the RevertSP method 3F 4 on the Admin SP. 2. If step 1 fails, all SSPs on the CM may not have been sanitized. If this occurs, the Crypto Officer should handle the CM per organizational policies. 4 The RevertSP method will cause the CM to zeroize all the SSPs and exit the Approved Mode. This document may be reproduced and distributed in its original entirety without revision. Page 49 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy ## 12 Mitigation of Other Attacks The CM does not provide mitigation against any other attacks. This document may be reproduced and distributed in its original entirety without revision. Page 50 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy #### References Appendix A. [FIPS 140-3] National Institute of Standards and Technology, Federal Information Processing Standards Publication Security Requirements for Cryptographic Modules, FIPS 140-3, March 2019. https://doi.org/10.6028/NIST.FIPS.140-3 [FIPS 140-3 IG] National Institute of Standards and Technology, Implementation Guidance for FIPS 140-3 and the Cryptographic Module Validation Program, 20 December 2024. https://csrc.nist.gov/Projects/cryptographic-module-validation-program/fips-140-3-ig-announcements [FIPS 180-4] National Institute of Standards and Technology, Federal Information Processing Standards Publication Secure Hash Standard (SHS), FIPS 180-4, August 2015. https://doi.org/10.6028/NIST.FIPS.180-4 [FIPS 186-5] National Institute of Standards and Technology, Federal Information Processing Standards Publication Digital Signature Standard (DSS), FIPS 186-5, February 2023. https://doi.org/10.6028/NIST.FIPS.186-5 [FIPS 197] National Institute of Standards and Technology, Federal Information Processing Standards Publication Advanced Encryption Standard (AES), FIPS 197, November 2001. https://doi.org/10.6028/NIST.FIPS.197 [FIPS 198-1] National Institute of Standards and Technology, Federal Information Processing Standards Publication The Keyed-Hash Message Authentication Code (HMAC), FIPS 198-1, July 2008. https://doi.org/10.6028/NIST.FIPS.198-1 [ISO/IEC 19790:2012(E)] International Standards Organization / International Electrotechnical Commission, Information technology - Security techniques - Security requirements for cryptographic modules, ISO/IEC 19790:2012(E), December 2015. https://www.iso.org/standard/52906.html [SBC] International Committee for Information Technology Standards (INCITS), Information technology - SCSI Block Commands - X (SBC-X). 4F 5 [SP 800-38A] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation Methods and Techniques, NIST Special Publication 800-38A, December 2001. https://doi.org/10.6028/NIST.SP.800-38A [SP 800-38B] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: The CMAC Mode for Authentication, NIST Special Publication 800-38B, May 2005. https://doi.org/10.6028/NIST.SP.800-38B [SP 800-38D] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC, NIST Special Publication 800-38D, November 2007. https://doi.org/10.6028/NIST.SP.800-38D [SP 800-38E] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: The XTS-AES Mode for Confidentiality on Storage Devices, NIST Special Publication 80038E, January 2010. https://doi.org/10.6028/NIST.SP.800-38E [SP 800-38F] National Institute of Standards and Technology, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping, NIST Special Publication 800-38F, December 2012. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-38F.pdf 5 Refer to product manual for exact version of SBC. This document may be reproduced and distributed in its original entirety without revision. Page 51 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy [SP 800-56A Rev. 3] National Institute of Standards and Technology, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, NIST Special Publication 800-56A Rev. 3, April 2018. https://doi.org/10.6028/NIST.SP.800-56Ar3 [SP 800-90A Rev. 1] National Institute of Standards and Technology, Recommendation for Random Number Generation Using Deterministic Random Bit Generators, NIST Special Publication 800-90A Rev. 1, June 2015. https://doi.org/10.6028/NIST.SP.800-90Ar1 [SP 800-90B] National Institute of Standards and Technology, Recommendation for the Entropy Sources Used for Random Bit Generation, NIST Special Publication 800-90B, January 2018. https://doi.org/10.6028/NIST.SP.800-90B [SP 800-132] National Institute of Standards and Technology, Recommendation for Password-Based Key Derivation: Part 1: Storage Applications, NIST Special Publication 800-132, December 2010. https://doi.org/10.6028/NIST.SP.800-132 [SP 800-133 Rev. 2] National Institute of Standards and Technology, Recommendation for Cryptographic Key Generation, NIST Special Publication 800-133 Rev. 2, June 2020. https://doi.org/10.6028/NIST.SP.800-133r2 [SP 800-135 Rev. 1] National Institute of Standards and Technology, Recommendation for Existing Application-Specific Key Derivation Functions, NIST Special Publication 800-135 Rev. 1, December 2011. https://doi.org/10.6028/NIST.SP.800-135r1 [SP 800-140B Rev. 1] National Institute of Standards and Technology, CMVP Security Policy Requirements CMVP Validation Authority Updates to ISO/IEC 24759 and ISO/IEC 19790 Annex B Second Public Draft, NIST Special Publication 800-140B, October 2022. [SPC] International Committee for Information Technology Standards (INCITS), Information technology - SCSI Block Commands - X (SPC-X). 5F 6 [SFSC] International Committee for Information Technology Standards (INCITS), Information technology - Security Features for SCSI Commands (SFSC) Revision 02, September 2015. [RFC 5116] Internet Engineering Task Force, An Interface and Algorithms for Authenticated Encryption, RFC 5116, March 2009. https://www.rfc-editor.org/rfc/rfc5116 [RFC 5487] Internet Engineering Task Force, Pre-Shared Key Cipher Suites for TLS with SHA-256/384 and AES Galois Counter Mode, RFC 5487, March 2009. https://www.rfc-editor.org/rfc/rfc5487.html [RFC 7627] Internet Engineering Task Force, Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension, RFC 7627, September 2015. https://www.rfceditor.org/rfc/rfc7627.html [TCG Core Spec v1] Trusted Computing Group, TCG Storage Architecture Core Specification, Specification Version 1.00 Revision 0.9 - draft, May 2007. [TCG Ent SSC] Trusted Computing Group, TCG Storage Security Subsystem Class: Enterprise, Specification Version 1.01 Revision 1.00, June 2015. https://trustedcomputinggroup.org/wpcontent/uploads/TCG_Storage-SSC_Enterprise-v1.01_r1.00.pdf [TCG PSK Ent] Trusted Computing Group, TCG Storage Enterprise SSC Feature Set: PSK Secure Messaging, Specification Version 1.00 Revision 1.00, August 2015. 6 Refer to product manual for exact version of SPC. This document may be reproduced and distributed in its original entirety without revision. Page 52 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy [https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage-Enterprise_Feature_Set_PSK_Secure_Messaging_v1.00_r1.00.pdf](https://trustedcomputinggroup.org/wp-content/uploads/TCG_Storage-Enterprise_Feature_Set_PSK_Secure_Messaging_v1.00_r1.00.pdf) This document may be reproduced and distributed in its original entirety without revision. Page 53 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy #### Terms and Acronyms Appendix B. | Term / Acronym | Definition | |------------------|----------------------------------------------------------------------------------------| | AES | Advanced Encryption Standard (see [FIPS 197]) | | CAST | Cryptographic Algorithm Self-Test | | CBC | Cipher Block Chaining Mode (see [SP 800-38A]) | | CFT | Critical Functions Test | | CM | Cryptographic Module | | DRBG | Deterministic Random Bit Generator (see [SP 800-90A Rev. 1]) | | FW | Firmware | | ESV | Entropy Source Validation | | GCM | Galois Counter Mode (see [SP 800-38D]) | | HDD | Hard Disk Drive | | HMAC | Hash-based Message Authentication Code (see [FIPS 198-1]) | | HW | Hardware | | KAT | Known Answer Test | | KAS FFC SSC | Key Agreement Schemes Finite Field Cryptography (see [SP 800- 56A Rev. 3]) | | KDF | Key Derivation Function | | KW | Key Wrap (see [SP 800-38F]) | | LBA | Logical Block Address is the method which is used by the CM when addressing User Data. | | MEK | Media Encryption Key | | MEKEK | Media Encryption Key Encryption Key | | OE | Operating Environment | | PBKDF | Password-Based Key Derivation Function (see [SP 800-132]) | | PCBA | Printed Circuit Board Assembly | | PCT | Pair-wise Consistency Test | | PSK | Pre-Shared Key (for TLS handshake) | | PSID | Physical Security ID | | PSP | Public Security Parameter | | RSA | Rivest-Shamir-Adleman public-key cryptosystem (see [FIPS 186- 5]) | | SAS | Serial Attached SCSI | This document may be reproduced and distributed in its original entirety without revision. Page 54 of 55 Seagate Technology FIPS 140-3 Non-Proprietary Security Policy | Term / Acronym | Definition | |------------------|-----------------------------------------------------------------------------| | SCSI | Small Computer System Interface | | SED | Self-Encrypting Drive | | SHA | Secure Hash Algorithm (see [FIPS 180-4]) | | SID | Security ID (i.e., Drive Owner) | | SSC | Security Subsystem Class | | SSP | Sensitive Security Parameter | | TEL | Tamper Evident Label | | TCG | Trusted Computing Group | | XTS | XEX-based tweaked-codebook mode with ciphertext stealing (see [SP 800-38E]) | This document may be reproduced and distributed in its original entirety without revision. Page 55 of 55