HSM image signing

Robotics & Edge Computing Jetson & Embedded Systems Jetson AGX Orin
1

Hello

Looking through the flashing procedure, it seems like flash.sh requires direct access to private keys PEM files, which presents a security risk. What concerns me also is that internally the script also seems to be calling proprietary binaries such as tegraopenssl, and tegrasign_v3. This makes porting the script to standard openssl and HSM-style signing incredibly difficult.

Does Nvidia have a solution for signing images without exposing private keys?

3

hello tanlu,

the security of your device depends on how securely you keep these key files.
according to developer guide, it recommends that you use the HSM to generate a truly random number for the keys.