Challenge response authentication for self encrypting drives
Various embodiments are directed to a system for accessing a self-encrypting drive (SED) based on a blind challenge authentication response mechanism (BCRAM). An SED may be authenticated within a system, for example, upon resuming from a sleep state, based on a challenge generated within the SED, signed using a private key by a trusted execution environment (TEE) and authenticated using a corresponding public key within the SED.
1. An apparatus, comprising:
logic, a portion of which is implemented in hardware, the logic to comprise a blind challenge authentication element (BCAE) component to:
receive a blind challenge response authentication mechanism (BCRAM) request, the BCRAM request to include an indication to authenticate a self-encrypting drive (SED);
generate an arbitrary element;
determine a first challenge authentication element (CAE) based at least in part on the arbitrary element and a public key, the public key corresponding to a private key from a public/private key pair;
determine a padded challenge authentication element (PCAE) based at least in part on the first CAE and a padding constant, the padding constant determined based at least in part on a length of the public key;
generate a BCAE based at least in part on the PCAE and the first CAE and in response to receipt of the BCRAM request;
receive a signed blind challenge authentication element (SBCAE) from a signing entity;
determine an unblind challenge authentication element (UCAE) based on the SBCAE, a second CAE, and the length of the public key, the second CAE based at least in part on the arbitrary element and the length of the public key;
determine authentication credentials to access the SED based at least in part on the UCAE; and
a communications bus communicatively coupled to the logic, the communications bus to communicate the BCAE and SBCAE.
2. The apparatus of claim 1 , the BCAE component to execute in the SED.
3. The apparatus of claim 1 , comprising a decryption component implemented in logic, a portion of which comprises hardware, the decryption component to decrypt a least a portion of the SED based on the authentication credentials.
4. The apparatus of claim 1 , comprising an authentication component implemented in logic, a portion of which comprises hardware, the authentication component to:
determine whether the authentication credentials are valid; and
communicate a request for valid authentication credentials to a host based on the determination that the authentication credentials are not valid.
5. The apparatus of claim 1 , the authentication credentials to include media access keys.
6. At least one non-transitory machine-readable storage medium comprising instructions that when executed by a self-encrypting drive (SED), cause the SED to:
receive a blind challenge response authentication mechanism (BCRAM) request, the BCRAM request to include an indication to authenticate the SED;
generate an arbitrary element;
determine a first challenge authentication element (CAE) based at least in part on the arbitrary element and a public key, the public key corresponding to a private key from a public/private key pair;
determine a padded challenge authentication element (PCAE) based at least in part on the first CAE and a padding constant, the padding constant determined based at least in part on a length of the public key;
generate a blind challenge authentication element (BCAE) based at least in part on the PCAE and the first CAE and in response to receipt of the BCRAM request;
communicate the BCAE to a signing entity;
receive a signed blind challenge authentication element (SBCAE) from the signing entity;
determine an unblind challenge authentication element (UCAE) based on the SBCAE, a second CAE, and the length of the public key, the second CAE based at least in part on the arbitrary element and the length of the public key; and
determine authentication credentials to access the SED based at least in part on the UCAE.
7. The at least one non-transitory machine-readable storage medium of claim 6 , comprising instructions that further cause the SED to decrypt the SED based on the authentication credentials.
8. The at least one non-transitory machine-readable storage medium of claim 6 , comprising instructions that further cause the SED to:
determine whether the authentication credentials are valid; and
communicate a request for valid authentication credentials to a host based on the determination that the authentication credentials are not valid.