My goal is to have full disk encryption. I wand the data on the external nvme to be safe vs the threat model from the docs. As far as I understand (and I think you even confirmed somewhere back in the day ;)) I dont need SecureBoot for that as well.
I previously used Xavier NX, and now Im using Orin Nano. On the Xavier it was only about the KEK2 fuse (from the top of my head), while the Orin Nano may or may not need more fuses burned to achieve the same goal.
In the first link you mention it says
$ python3 gen_ekb.py -chip t234 -oem_k1_key <oem_k1.key> [..]
and keeps using oem_k1 throughout the instructions. Even though on my Orin Nano it seems only k2 is used.
From my experiments (with the goal to have full disk encryption), where “0key” means the key was all zeros and “VALUE” means it was set to some password hex. The input k1 key into gen_ekb.py was always updated accordingly
- K1 and K2 both 0key => works
- K1 and K2 burned to VALUE => works
- K1 burned to VALUE and K2 0key => works
- K2 burned to VALUE and K1 0key => works (although in the optee example.sh there are only references to K1 and the input to gen_ekb.py for k1 was the value of k2 => ie I would not expect this to work)
So my question is: Is it good practice to have K1 == K2?
And on top: why does scenario 4 work?
Or more general: Which of the scenarios given is the most secure way?
Regarding your pointer to the docs for EKB value extraction, are you saying that your previous statement that K1 and K2 cannot be read back is not correct (anymore)? ( Reading OemK1 and OemK2 fuses from board )