How to Enable Manual Passphrase Prompt for LUKS Encrypted Rootfs on Jetson Orin Nano

[protonpingouin]

Hi everyone,

I’m working on securing my Jetson Orin Nano by encrypting the root filesystem using LUKS. However, my requirements differ from the standard OP-TEE-based setup, and I would greatly appreciate clarification and official guidance.

🔒 My goal:

I want to encrypt the rootfs with LUKS and require a user to enter a passphrase manually at boot, similar to standard LUKS full-disk encryption on a typical Linux system.
This is important to retain developer flexibility, avoid locking the device with fuses, and allow the Jetson to be reused for other projects or testing purposes.

🚫 I explicitly do not want to use:

• Any key burned into fuses

✅ I want:

• A manual passphrase prompt at boot time

---

What I’ve done so far:

1. I generated the base image using:

   sudo ./tools/kernel_flash/l4t_initrd_flash.sh --network usb0 --no-flash --showlogs \
     -p "-c bootloader/t186ref/cfg/flash_t234_qspi.xml" \
     jetson-orin-nano-devkit internal
   

2. Then, I tried preparing a flash with encrypted rootfs using:

   sudo ROOTFS_ENC=1 ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --no-flash \
     --external-device nvme0n1 \
     -i ./sym2_t234.key \
     -c ./tools/kernel_flash/flash_l4t_t234_nvme_rootfs_enc.xml \
     -S 800GiB \
     --external-only --append \
     jetson-orin-nano-devkit external
   

3. I attempted flashing using:

   sudo ./tools/kernel_flash/l4t_initrd_flash.sh --showlogs --flash-only
   

4. Afterward, I tried adding my own passphrase to the LUKS partition with the idea of modifying the initrd to support manual decryption — but it seems the system does not recognize my sym2_t234.key when I try to reuse or override it.

---

❓My questions:

1. If modifying the initrd is required, are there any detailed NVIDIA-provided guidelines on how to do this properly?

2. Is it officially supported to prepare a rootfs encrypted via cryptsetup luksFormat manually and integrate it with l4t_initrd_flash.sh?

3. The current documentation at Jetson Disk Encryption Guide lacks clarity on the exact procedure for this use case — is there a reference configuration or best practice you can point me to?

Thanks in advance for your help!

[JerryChang]

hello protonpingouin,

unfortunately, we’re not supported with a prompt for passphrase by default.
you may customize it (a prompt for passphrase) by yourself, please see-also Topic 316813 for reference.