An apparatus includes a storage medium with an opaque key storage and a controller. The controller may be coupled to the storage medium. The controller may be configured to (i) receive from a host device an authentication key, a plurality of I/O requests, and respective virtual media encryption keys associated with a number of the I/O requests, (ii) allow the host device to access the opaque key storage in response to the authentication key received from the host device being authenticated, (iii) generate a first media encryption key for a real band based upon the authentication key from the host device and key material stored on the apparatus, and (iv) generate a number of second media encryption keys for the number of I/O requests based on the first media encryption key and each of the respective virtual media encryption keys associated with each of the number of I/O requests.