search

ladar / sedutil

Use sedutil for setting up and using self encrypting drives (SEDs) that comply with the TCG OPAL 2.00 standard. This includes the requisite pre-boot authentication image.
https://trustedcomputinggroup.org/work-groups/storage/
80 stars 24 forks source link

Add commands for controlling the Makers Authority #32

Open kadler15 opened 1 year ago

kadler15 commented 1 year ago

Summary

This change adds new commands for disabling, enabling, and printing the status of the Admin SP Makers Authority:

--disableMakersAuthority <SIDpassword> <device> 
                                revoke the device manufacturer's admin powers
--enableMakersAuthority <SIDpassword> <device> 
                                grant the device manufacturer admin powers
--printMakersAuthorityStatus <device> 
                                print the Makers Authority status

I tried to follow existing tabbing patterns. Unfortunately, the original sedutil was a bit of a mess in those regards, so it's not easy to be consistent.

Also, I only have access to an Opal 2.0 device, and I'm more familiar with that standard, so my Enterprise 1.0 implementation is untested and may contain bugs. I'd appreciate it if someone with access to an Enterprise 1.0 device can test the new commands.

Additional Context

From the TCG Storage Architecture Core Spec:

The members of the Makers authority class permit the manufacturer of the TPer to open an authenticated session to the TPer. The MakerPuK (i.e., Manufacturer) authority only has the Manufacturer Public Key (not the private) and a Certificate attesting to this, which is signed by the Manufacturer.

Initializing FIPS 140-2 or 140-3 validated devices in a FIPS-compliant manner generally requires disabling the Makers Authority (see example security policies from Seagate and Western Digital).

The relevant portions of the Admin SP Authority table in Opal 2.0: image

And in Enterprise 1.0: image