Yeah, I'm vaguely aware of this - jsut because of the "S" in SD standing for "Secure" as a euphemism for DRM stuff. From your link it seems likely that most cards probably don't even support it nowadays, but I'm still kind of curious about how exactly it was intended to be accessed - for example what extended commands might have been available. Presumably there's a spec somewhere for it, and presumably one can at the bare minimum ask a card "do you have a protected area available?"

I'd be interested in the specific commands/spec too, however as with all DRM techs I wouldn't be surprised if it's hidden behind NDAs.

However you can see from the parent comment:

> Success of mutual authentication enables host to access card protected area.

So it's something the memory control must make available after a handshake, and then I presume either some specific memory address or set of retrieval commands would follow.

As you mention, it also states this spec is now optional.