SEDs use a password to generate KEK by a KDF algorithm. The KEK is then used to encrypt the MEK (where MEK is internally generated in the drive). But TCG-Opal drives have 9 locking-ranges and each of these ranges use its own MEK (say MEK1 – MEK9). There are also 4 Admins and 8 Users, each has its own password (PIN). Which of these passwords are used to generate the KEK, or are there multiple KEKs ? The TCG core spec and the Opal SSC spec don’t detail the relation of a password to the MEK of any locking-range.