Challenge response authentication for self encrypting drives
Various embodiments are directed to a system for accessing a self-encrypting drive (SED) based on a blind challenge authentication response mechanism (BCRAM). An SED may be authenticated within a system, for example, upon resuming from a sleep state, based on a challenge generated within the SED, signed using a private key by a trusted execution environment (TEE) and authenticated using a corresponding public key within the SED.
1. An apparatus, comprising:
circuitry at a host computing device coupled to a self-encrypting drive (SED); and
memory comprising instructions that when executed by the circuitry cause the circuitry to:
generate, at the host computing device, a blind computation keypair, the blind computation keypair to include a first public key, a first private key, and a first key length;
generate, at the host computing device, a blind computation challenge signing keypair, the blind computation challenge signing keypair to include a second public key, a second private key, and a second key length;
sign, at the host computing device, the first public key with the second private key to generate a signed first public key;
sign, at the host computing device, the second public key with the second private key to generate a signed second public key; and
generate, at the host computing device, a challenge response authentication mechanism (CRAM) initialization information element comprising an indication of the signed first public key and the signed second public key.
2. The apparatus of claim 1 , the instructions when executed further cause the circuitry to utilize the CRAM initialization information element to unlock the SED.
3. The apparatus of claim 2 , the instructions when executed further cause the circuitry to utilize the CRAM initialization information element to unlock the SED in response to a resume from a sleep state.
4. The apparatus of claim 1 , the CRAM initialization information element comprising an indication of the second public key.
5. The apparatus of claim 1 , the CRAM initialization information element comprising an indication of the first key length.
6. The apparatus of claim 1 , the CRAM initialization information element comprising an indication of the second key length.
7. The apparatus of claim 1 , the CRAM initialization information element comprising indications of the signed first public key, the signed second public key, the first key length, and the second key length.
8. The apparatus of claim 1 , the instructions when executed further cause the circuitry to provide the CRAM initialization information element to the SED, the SED to utilize the CRAM initialization information element to generate blind computation factor (BCF) credentials.
9. The apparatus of claim 1 , wherein the first key length is 2048 bits, the second key length is 2048 bits, or both the first key length and the second key length are 2048 bits.
10. A method, comprising:
generating, at a host computing device coupled to a self-encrypting drive (SED), a blind computation keypair, the blind computation keypair including a first public key, a first private key, and a first key length;
generating, at the host computing device, a blind computation challenge signing keypair, the blind computation challenge signing keypair including a second public key, a second private key, and a second key length;
signing, at the host computing device, the first public key using the second private key to generate a signed first public key;
signing, at the host computing device, the second public key with the second private key to generate a signed second public key; and
generating, at the host computing device, a challenge response authentication mechanism (CRAM) initialization information element comprising an indication of the signed first public key and the signed second public key.
11. The method of claim 10 , comprising utilizing the CRAM initialization information element to unlock the SED.
12. The method of claim 11 , comprising utilizing the CRAM initialization information element to unlock the SED in response to a resume from a sleep state.
13. The method of claim 10 , the CRAM initialization information element comprising an indication of the second public key.
14. The method of claim 10 , the CRAM initialization information element comprising an indication of the first key length.
15. The method of claim 10 , the CRAM initialization information element comprising an indication of the second key length.
16. The method of claim 10 , the CRAM initialization information element comprising indications of the signed first public key, the second public key, the first key length, and the second key length.
17. The method of claim 10 , comprising providing the CRAM initialization information element to the SED, the SED to utilize the CRAM initialization information element to generate blind computation factor (BCF) credentials.
18. An article of manufacture comprising a non-transitory storage medium comprising instructions that when executed by circuitry at a host computing device coupled to a self-encrypting drive (SED), enable a system to:
generate, at the host computing device, a blind computation keypair, the blind computation keypair to include a first public key, a first private key, and a first key length;
generate, at the host computing device, a blind computation challenge signing keypair, the blind computation challenge signing keypair to include a second public key, a second private key, and a second key length;
sign, at the host computing device, the first public key with the second private key to generate a signed first public key;
sign, at the host computing device, the second public key with the second private key to generate a signed second public key; and
generate, at the host computing device, a challenge response authentication mechanism (CRAM) initialization information element comprising an indication of the signed first public key and the signed second public key.
19. The article of claim 18 , the non-transitory storage medium comprising instructions that when executed enable the system to utilize the CRAM initialization information element to unlock the SED.
20. The article of claim 19 , the non-transitory storage medium comprising instructions that when executed enable the system to utilize the CRAM initialization information element to unlock the SED in response to a resume from a sleep state.
21. The article of claim 19 , the non-transitory storage medium comprising instructions that when executed enable the system to provide the CRAM initialization information element to the SED, the SED to utilize the CRAM initialization information element to generate blind computation factor (BCF) credentials.
22. The article claim 19 , wherein the first key length is 2048 bits, the second key length is 2048 bits, or both the first key length and the second key length are 2048 bits.
23. The article of claim 18 , the CRAM initialization information element comprising an indication of the second public key.
24. The article of claim 18 , the CRAM initialization information element comprising an indication of the first key length.
25. The article of claim 18 , the CRAM initialization information element comprising an indication of the second key length.