Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add commands for controlling the Makers Authority #32

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

kadler15
Copy link

Summary

This change adds new commands for disabling, enabling, and printing the status of the Admin SP Makers Authority:

--disableMakersAuthority <SIDpassword> <device> 
                                revoke the device manufacturer's admin powers
--enableMakersAuthority <SIDpassword> <device> 
                                grant the device manufacturer admin powers
--printMakersAuthorityStatus <device> 
                                print the Makers Authority status

I tried to follow existing tabbing patterns. Unfortunately, the original sedutil was a bit of a mess in those regards, so it's not easy to be consistent.

Also, I only have access to an Opal 2.0 device, and I'm more familiar with that standard, so my Enterprise 1.0 implementation is untested and may contain bugs. I'd appreciate it if someone with access to an Enterprise 1.0 device can test the new commands.

Additional Context

From the TCG Storage Architecture Core Spec:

The members of the Makers authority class permit the manufacturer of the TPer to open an
authenticated session to the TPer. The MakerPuK (i.e., Manufacturer) authority only has the
Manufacturer Public Key (not the private) and a Certificate attesting to this, which is signed by the
Manufacturer.

Initializing FIPS 140-2 or 140-3 validated devices in a FIPS-compliant manner generally requires disabling the Makers Authority (see example security policies from Seagate and Western Digital).

The relevant portions of the Admin SP Authority table in Opal 2.0:
image

And in Enterprise 1.0:
image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant