Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a..., Manual

Page: 10 / 19

Samsung SAS 12G TCG Enterprise SSC SEDs PM1633a Series Security Policy
This non-proprietary Security Policy may only be copied in its entirety without alterations including this statement. Samsung copyright 2016.
Page 10 of 19
Security rules
The following specifies the security rules under which the cryptographic module
shall operate in accordance with FIPS 140-2:

The cryptographic module operates always in FIPS Mode once shipped from
the vendor's manufacturing site.

The steps necessary for the secure installation, initialization and start-up of
the cryptographic module as per FIPS 140-2 VE10.03.01 are as follows:
o
Step1. User should examine the tamper evidence

Inspect the entire perimeter for cracks, gouges, lack of screw(s)
and other signs of tampering including the tamper evident
sealing label.

If there is any sign of tampering, do not use the product and
contact Samsung.
o
Step2. Identify the firmware version in the device

Confirm that the firmware version is equivalent to the version(s)
listed in this document via SCSI Inquiry command
o
Step3. Take the drive’s ownership
 Change SID’s PIN by setting a new PIN

Change EraseMaster’s PIN by setting a new PIN

Erase Method on each LBA Range to rekey the encryption key

Change BandMaster0~7’s PIN by setting new PINs

Configure the LBA Range(s) by setting ReadLockEnabled and
WriteLockEnabled columns to True
 Don’t change LockOnReset column in Locking Table so that
the drive always gets locked after a power cycle
o
Step4. Configure FW download and Diagnostic features

Disable Makers Class using SID Authority to disable FW
download and Diagnostic features

Enable Makers Class only when FW download and Diagnostic
features are needed
o
Step5. Periodically examine the tamper evidence

If there is any sign of tampering, stop using the product to avoid
a potential security hazard or information leakage.

The cryptographic module shall maintain logical separation of data input,
data output, control input, status output, and power.

The cryptographic module shall not output CSPs in any form.

The cryptographic module shall use the Approved DRBG for generating all
cryptographic keys.