hello stefankmfr0,
we’ve also check disk encryption with a custom key worked normally.
please refer to below for the steps.
In op-tee source package folder
(1) $ vim example.sh to edit sym2_t234.key as following.
(2) $ echo "f0e0d0c0b0a0010203040506070809aa" > sym2_t234.key
(3) $ ./example.sh
(4) $ cp eks_t234.img $OUT/JetPack-5.1.2_AGX-Orin/Linux_for_Tegra/bootloader/.
(5) $ cp sym2_t234.key $OUT/JetPack-5.1.2_AGX-Orin/Linux_for_Tegra/.
In JetPack-5.1.2 image folder
(1) $ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --no-flash --showlogs -p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" jetson-orin-nano-devkit internal
(2) $ sudo ./flash.sh --no-flash -k A_eks jetson-orin-nano-devkit internal
(3) $ sudo cp bootloader/eks_t234_sigheader.img.encrypt ./tools/kernel_flash/images/internal/.
(4) $ sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash --external-device nvme0n1p1 -i ./sym2_t234.key -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml --external-only --append --network usb0 jetson-orin-nano-devkit external
(5) $ sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --network usb0 --flash-only