Hi NV_Team,
PKC/SBK keys store in CVM emmc/spi flash or internal of the CVM ?
How and where we can check this keys?
hello Luna2020,
keys were store in the module.
you may refer to Read Fuses through the Linux kernel, or, you may also check… /sys/devices/platform/tegra-fuse to examine fuse variables.
besides,
there’s odmfuseread.sh which shows SBK, KEK in fuse_info.
please also note that, you’ll see the fuse variable return 0xff.. as long as SecurityMode is burned.
for instance,
SecureBootKey: ffffffffffffffffffffffffffffffff
Kek0: ffffffffffffffffffffffffffffffff
Kek1: ffffffffffffffffffffffffffffffff
Kek2: ffffffffffffffffffffffffffffffff
Kek256: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
that is expected for security concern.
if these fuses can be read out after burning, that will be a huge security vulnerability.
you will get 0xff.. when reading these fuses even though they are not burned.
1 Like