I'd be interested in the specific commands/spec too, however as with all DRM techs I wouldn't be surprised if it's hidden behind NDAs. However you can see from

I'd be interested in the specific commands/spec too, however as with all DRM techs I wouldn't be surprised if it's hidden behind NDAs. However you can see from the parent comment: > Success of mutual authentication enables host to access card protected area. So it's something the memory control must make available after a handshake, and then I presume either some specific memory address or set of retrieval commands would follow. As you mention, it also states this spec is now optional.