PKC Key List with 16 public keys and one private key support

Robotics & Edge Computing Jetson Systems Jetson Thor
,
1

Hello,

JP info: JP7.1/L4T38.4.0

The PKC Key List is used to generate PublicKeyHash fuse value and to sign images.
In my opinion, only public keys are needed in the first case (no any private keys are needed). And only one private key is needed in the second case (other keys should be public).
However, the PKC Key List format always requires all private keys. It is not secure because all keys can be compromised at the same time. We also need to use different private keys for sign images during flashing and OTA processes. So all 16 public keys must be present on the device, due to any of these keys might be used for signature verification.

Is it possible to use the PKC Key List with:

  • only one private key and 15 public keys?
  • all 16 public keys?

If not, will you support this in further JP releases?

3

hello nazaraa,

as mentioned by developer guide, the security of your device depends on how securely you keep the key file.
it’s also a caution section to mention below..

Avoid generating and storing the key pair under bootloader/ directory but a secure location instead.

no, it’s not supported.

4

Are you going to support this in further JP releases?

5

let me check with internal team for confirmation.

7

no, there’s no such plans to support that.

8

Could you consider to add it to your plans?

9

Hello JerryChang,

Checked that boot after Capsule Update failed with “E> LOADER: Failed to verify PCP hash" error due to only one PKC key in the key list used for building Capsule.
Building Capsule by using all 16 keys solves the issue.
So despite of Thor supports 16 PKC keys, all keys bundled together and behave as one key due to software limitation.