Security

This topic describes security features of NVIDIA^® Jetson™ Linux. Below are the subtopics:

• Secure Boot describes Secure Boot, a feature which ensures that the Jetson Linux boot process cannot be redirected or compromised.

• Factory Secure Key Provisioning describes FSKP, a technique to securely burn fuses on the factory floor.

• OP-TEE describes the Open Portable Trusted Execution Environment, a TEE provided with Jetson Linux.

• Disk Encryption describes the Jetson Linux implementation of Linux Unified Key Setup (LUKS), the Linux standard for disk encryption.

• Secure Storage describes Secure Storage, a feature that provides a solution to ensure the general-purpose data and key material can be stored securely.

• Rollback Protection describes Rollback Protection, a feature that prevents a computing system from being downgraded (rolled back) from a later version to an earlier one.

• PVA Authentication describes the Authentication feature for software that executes on the PVA.

• Secure Boot
  • Overall Fusing and Signing Binaries Flow
  • Prerequisites Secure Boot
  • Fuses and Security
  • Fuse Configuration File
    • Jetson Orin Fuse Configuration File
    • Generate A PKC Key Pair
    • Generate PublicKeyHash value from a PKC key pair
  • Prepare an SBK key
  • Prepare K1/K2 keys
  • Prepare EKB
  • Prepare the Fuse Configuration file
  • Burn Fuses with the Fuse Configuration file
  • Read Fuses through the Linux kernel
  • Sign and Flash Secured Images
    • Sign and Flash Secured Images in One Step
    • Sign and Flash Secured Images in Separate Steps
    • Sign and Flash with initrd Using the l4t_initrd_flash.sh Script
  • Revocation of the PKC Keys
    • An Example: Fusing the Three PKC keys
    • An Example: Revoking the First PKC key (rsa3k-0.pem)
    • An Example: Revoking the Second PKC key (rsa3k-1.pem)
  • UEFI Secure Boot
    • Prerequisites
    • References
    • Prepare the PK, KEK, db Keys
    • Generate the UEFI Secure Boot DTBO
    • Method One: Enable UEFI Secure Boot at Flashing Time
    • Method Two: Enable UEFI Secure Boot Using UEFI Utilities from an Ubuntu Prompt
    • Update the db/dbx Keys with a Capsule Update
  • UEFI Payload Encryption
    • Prepare the User Encryption Key
    • Generate the EKB
    • Enable UEFI Payload Encryption During the Flashing Process
  • UEFI Variable Protection
    • Prepare the UEFI Variable Authentication Key
    • Generate the EKB
    • Enable UEFI Variable Protection During the Flashing Process
  • UEFI Platform Vendor Key Feature
    • Platform Vendor Key Signed/Authenticate UEFI
    • PV Key Encrypt/Decrypt UEFI
    • Fuse Solution
  • Kernel Module Signing
• Factory Secure Key and Expansion Key Provisioning
  • Requesting FSKP Expansion Keys
  • Generating and Verifying the Self-Signed X.509 Certificate
    • Generating an RSA Key Pair and Creating a Certificate with the Public Key (Option 1 with keytool)
    • Generating an RSA Key Pair and Creating a Certificate with the Public Key (Option 2 with openssl)
  • Content of the Results.zip File
  • An Example: Preparing the Encrypted and Signed Blob at HSM
    • Preparing the Encrypted and Signed Blob
  • An Example: Using the Encrypted and Signed Blob at the Factory
    • Burn Status
  • Using the fskp_fuseburn.py File to Burn Fuses
    • FSKP Fuse Burn Script
    • Fuse Configuration File
  • Preparing an Encrypted and Signed Blob
    • Preparing the Encrypted and Signed Blob
  • Burning Fuses in the Factory
    • Preparing a System to Burn Fuses
    • Burning the Fuses
• OP-TEE: Open Portable Trusted Execution Environment
  • OP-TEE in Jetson Linux
  • Architecture
    • Execution Steps
  • Trusted Application and Client Application Development
    • How to Cross Compiling a Trusted Application and Run it on Jetson Devices
    • How to Implement a New Trusted Application or Port an Existing One
    • Types of Trusted Applications
    • Subkeys
  • EKB: Encrypted Key Blob
    • Prerequisites
    • EKB Format
    • EKB Binary Size Restrictions
    • EKB Generation
    • EKB Extraction
    • SE Keyslot Clearing
  • Sample Applications
    • Jetson User Key PTA
    • HWKEY AGENT CA and TA
    • LUKS CA and TA
    • CPUBL Payload Decryption CA and TA
  • PKCS #11 Support in OPTEE
    • Cryptoki Introduction
    • Cryptoki Implementation in OPTEE
    • PKCS #11 TA
    • PKCS #11 SAMPLE CA
• Disk Encryption
  • Quick Guide
  • Setup Preparation
  • Details of Operation
  • The Threat Model
  • Disk Encryption Implementation in Jetson Linux
    • Layout of an Encrypted Disk
    • How to Create File System Images
    • Creating an Encrypted Rootfs on the Host
    • How to Flash an Encrypted Rootfs to an External Storage Device
    • To Enhance initrd to Unlock an Encrypted Rootfs
    • To modify initrd to unlock additional encrypted file systems
    • Enabling Disk Encryption Only for UDA
    • Enabling Disk Encryption for Dynamically Created Partitions
    • Modifying /opt/nvidia/cryptluks to Unlock Previously Created and Encrypted File Systems
    • Summary
  • Manufacturing process
    • Creating Encrypted Images with a Generic Key
    • Replacing the Generic Key with the Per-device Unique Key at First Boot
    • (Optional) Encrypting the Disks Again
    • Building cryptsetup
• Secure Storage
  • Secure Storage in Jetson Linux
    • SSK and HUK
    • RPMB Key Management
• Rollback Protection
  • Overview
  • Rollback Protection for MB1-BCT, MB2, and Later Components
    • MB1-BCT
    • MB2 and Later Components
    • Incrementing the Version Number of MB2 and Later Components
• Memory Encryption
• PVA Authentication
  • Overview
  • Troubleshooting