Hi, Is it possible to use secure boot with an encrypted hard-drive where the hard-drive decryption key is contained in the bootloader (or somewhere secure). After reading the docs it seems possible but I am not familiar with kernel/bootloader code. How would I go about doing this? I am currently u…

hello simoncharvey, please refer to developer guide for the Disk Encryption session, this only applies to: Jetson Xavier NX, Jetson AGX Xavier series, and Jetson TX2 series. thanks

Thanks for the link - so the Jetson Nano has no place for storing the encryption keys? So I’ve seen secure boot does work on the Jetson Nano - Would it be possible for the bootloader to decrypt the harddrive on boot? Would this make the keys readable after boot?

Yes, there is no trusted execution environment (TEE) on the Nano, so solutions that require that won’t work. But Simon would like to know what can be done on a Nano. First, because there is no TEE, the disk encryption/decryption key would likely have to be stored in RAM at some point. A sophisti…

hello bmm, please refer to below for more details about ODM_Reserved, thanks [image] Xavier store custom key in odm_reserved Fuses Jetson AGX Xavier hello Ashja, to clarify, for ALL fuse bits, you can’t change its value back to 0 once it gets programmed to 1. there m…

Hi Bruce, Have you tested those steps? If you can tell me how I should approach step 4 I’ll give it a shot. Will this be a driver/module or what? Can the signed os signature be faked? Since that signature should be readable won’t a modified OS be capable of spoofing the signature or does the bootl…

Hi Simon, I haven’t tested these steps, but I am working on them. It should not be possible to fake the OS signature. There is a bootstrapping process here. First, the bootloader itself is authenticated during the Nano’s secureboot process which checks the signature of the bootloader (a hash of …

Excellent, it sounds like you’re on the right track. I don’t understand how so few people require/ask about this. Surely the jetson nano is intended as an edge computing device and would then require some form of encryption. Perhaps @mdegans has some knowledge on reading the fuses. Simon

I think the issue is that since the Nano doesn’t have the Trusted Execution Environment like the Xavier and TX2, any solution for the Nano would have to be different and wouldn’t be as secure. So, even though the need for full-disk encryption is there, the effort to create a solution hasn’t materia…

Jetson nano secure boot with encrypted filesystem

Robotics & Edge Computing Jetson Systems Jetson Nano

JerryChang May 12, 2021, 5:55am 5

hello simoncharvey,

this disk encryption support is based-on Trusty; but it does not support on Jetson Nano.
please refer to developer guide, Trusty, a Trusted Execution Environment;
you should also check similar discussion thread, Topic 175826 for reference.
thanks

Topic		Replies	Views
Data encryption using secure boot and odm_reserved fuse in Jetson Nano Jetson Nano security	11	3237	August 18, 2021
Encrypted boot loader support on Jetson Nano? Jetson Nano security	5	1072	October 18, 2021
Root file system encryption on jetson nano board Jetson Nano security	4	807	May 4, 2022
Jetson Nano ENCRYPTION Jetson Nano boot , security	7	2497	October 15, 2021
RSA or ECC private key stored in FUSEs Jetson Nano security	8	877	October 15, 2021
Full disk encryption on Jetson nano Jetson Nano security	4	2149	October 15, 2021
Disk Encryption on Jetson Orin Nano Without Secure Boot or UEFI Secure Boot Jetson Orin Nano security	6	486	July 31, 2024
Jetson nano secure boot enabling Jetson Nano security	15	176	December 8, 2025
Encrypted File-system support on Jeston Orin-Nano JP 6.0 Jetson Orin Nano tpm	8	327	December 12, 2024
Enable Secure boot for Jetson Nano devkits 2GB & 4GB Jetson Nano security , nano2gb	5	1509	February 5, 2024

Jetson nano secure boot with encrypted filesystem

Related topics