Self-Encrypting Drive (SED) Standardization Proposal for NVDIMM-N Devices
summary
Proposal defines BAEBI and TCG extensions to make NVDIMM‑N act like a self‑encrypting device: encrypt on Catastrophic Save, decrypt on Restore, store ciphertext in flash while DRAM stays plaintext, and wrap data keys with PBKDF2 so keys persist in NVM. Implementation uses AES‑XTS for payload, key wrapping and an RNG, new I2C registers and a I2C typed block transfer for TCG security in/out. Industry sponsors HPE and NetApp report restores take on the order of tens of seconds per gigabyte, limited by I2C configuration bandwidth.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 0:33History of Storage
- 1:12What is a Medium
- 1:35Device Type
- 2:19Use Cases
- 3:08Technology Overview
- 4:33Block Diagram
- 5:57Standardization Approach
- 7:49Cryptography Scheme
- 9:41Standard Changes
- 17:54Storage Considerations
- 20:20Conclusion
- 21:27Power Cycle
- 22:42EDP
- 23:15Enemy Team
- 24:23AES XTS
- 25:58Metadata
- 26:19Memory
- 27:14Threat Model
- 28:14Attack Model
- 28:58Threats Model
- 29:30Resupply Power
- 30:09Timing Window
- 30:31OntheFly Decrypting
- 30:42Preloading Data
- 31:12Memory Configuration
related talks
59mBypassing Self-Encrypting Drives (SED) in Enterprise Environments
33mKey Per IO Security Subsystem Class for NVM Express Storage Devices
31mSecure IO
44mAMD x86 Memory Encryption Technologies
31mIntel Trust Domain Extensions
33mAMD Encrypted Virtualization Update
44mAdvancements in Confidential Computing
13mMaking PCI devices ready for confidential computing