I am attempting to burn the PKC, SBK, and KEK2 fuses with the following command: sudo ./odmfuse.sh -i 0x21 -k <PKC_file> -S <SBK_file> --KEK2 <KEK2_file> jetson-xavier-nx-devkit-emmc I was able to generate the PKC_file with the following command: openssl genrsa -out rsa_priv.pem 2048 But how do…

hello dcapers44, note, Jetson security only support with eMMC version, you cannot enable Secureboot on Jetson Xavier NX devkits (i.e. SD card version), since fuse programming is non-reversible, you may broken your Xavier NX devkit if you enable that. please also refer to Topic 158361 as see-also…

hello dcapers44, [image] dcapers44: sudo ./odmfuse.sh -i 0x21 - you’re assign incorrect chip-id for Jetson Xavier NX, please refer to the readme file of the secureboot, the <chip_id> is 0x19 for Jetson Xavier NX. thanks

here’s documentation, Secureboot

0x19 … You are correct. That is what I had as my command for Jetson Xavier NX. But what about the SBK_file and KEK2_file… do I just populate these files with any data as it in Hex format like the following: 0x01234567 0x89abcdef 0xfedcba98 0x76543210 Is this correct for SBK, KEK0, KEK1, and KEK2…

hello dcapers44, please also check the tables describe user-programmable fuses related to Secureboot. for example, Software and configuration fuses related to Secureboot for Jetson Xavier NX and Jetson AGX Xavier series (T194) and Jetson TX2 series (T186) it’s correct you should ensure you’re do…

I don’t think you are answering my main question. What should the contents of the following files: SBK, KEK0, KEK1, and KEK2? It would be very helpful if you can provide an example.

hello dcapers44, you must prepare SBK fuse bits if you wish to encrypt bootloader (and TOS). please create the key by yourself, it’s using HEX format, with four 32-bit words. for example, the contents in sbk.key key file is… 0x123456789abcdef0fedcba9876543210 also, KEKs also doing the same as …

Ok… I think I get it… but to be clear do all the key files (SBK and KEK[0…2]) contents are … 0x123456789abcdef0fedcba9876543210 and not 0x12345678 0x9abcdef0 0xfedcba98 0x76543210 The documentation for Secureboot shows both representations but is not clear which one to use…

Sorry, but I don’t want to keep going back and forth over the same thing. So should the files can the format: A) 0x123456789abcdef0fedcba9876543210 OR B) 0x12345678 0x9abcdef0 0xfedcba98 0x76543210 Does it matter which format I put the files in?

hello dcapers44, I’m used (B) for verification, but both of them are supported key formats.

Attempting to burn fuses on board (Jetson Xavier NX)

Robotics & Edge Computing Jetson Systems Jetson Xavier NX

JerryChang March 3, 2021, 6:07am 10

hello dcapers44,

it’s in the documentation to represent keys in four 32-bit words.

Topic		Replies	Views
Preparing the SBK Key and DK(KEK)/ODM Fuses Jetson TX2 security	4	1458	March 23, 2022
Xavier NX (eMMC) Secureboot Fusing renders devices unbootable Jetson Xavier NX boot , security	27	1693	May 10, 2023
Postmortem: Jetson Xavier AGX will not get past Boot ROM after burning PKC+SBK+KEK256 Jetson AGX Xavier security	9	2099	April 20, 2022
Questions for secureboot and trusty Jetson Xavier NX boot	16	1728	August 28, 2020
Using odmfuseread.sh using SBK Key Jetson Xavier NX security , nvbugs	8	1280	August 22, 2023
Serial Console Silent after fuse burning (Xavier NX 16GB) Jetson Xavier NX uart , security	9	218	January 20, 2025
Odmefuse.sh not burning SBK key Jetson TX2 security , nvbugs	41	1718	April 16, 2024
Error when using 'odmfuse.sh --noburn' Jetson Xavier NX security	5	1167	February 9, 2022
Add SecureBootKey to the module fused PKC Jetson Orin NX board-design , security	8	863	September 27, 2023
Burning fuses on secure board Jetson Orin NX security	8	706	July 2, 2024

Attempting to burn fuses on board (Jetson Xavier NX)

Related topics