We are working with a customer to enable secure boot (and later disk encryption). For our customer’s Jetson Xavier AGK Dev Kit, using L4T-tegra-32.5.2, we generated the encryption keys with: #!/bin/bash echo "Generating PKC (Public Key Cryptogrpahy = RSA 3k Private key pem)" openssl genrsa -out …

@JerryChang NOTE: neither sudo ./flash.sh –-no-flash --sign -u rsa_pub.pem -v sbk_hex_file jetson-agx-xavier-devkit mmcblk0p1 nor sudo ./flash.sh –-no-flash --sign -u rsa_priv.pem -v sbk_hex_file jetson-agx-xavier-devkit mmcblk0p1 works. Both tell me that the RSA or SBK key has not been provided. Th…

[image] JerryChang: Topic 123506 I have updated to 32.7.1, but I still have a couple of concerns: tegrasign_v3.py has #!/usr/bin/env python but this is not valid in a default Ubuntu 18.04 installation. Was this intended to be #!/usr/bin/env python3? Why is the odmfuse_pkc.xml from the -…

hello ticotimo, Q1> ya, that should be using pyhton3, it should be comment messages did not up to date. Q2> command-line with --noburn. sudo FAB=400 BOARDID=2888 BOARDSKU=0001 BOARDREV=L.0 ./odmfuse.sh -i 0x19 -p --noburn --auth SBKPKC -k ../rsa_priv.pem --KEK2 ../kek2_hex_file --KEK256 ../kek…

hello ticotimo, please revisit comment #5 , I’ve revise my previous comments for making all answers in the same reply. thanks

Aha! So the --auth NS is the current state of the board (unfused target). And as you said, this is only needed in ‘off-line’ mode because no communication is happening with the board. I was also not realizing that the -c option is not needed in ‘on-line’ mode because the actual state of the fuses i…

NOTE: you must run sudo ./fusecmd.sh

hello ticotimo, it’s the --sign to create signed images to your local host instead of flashing the target. --sign --------------- Sign images and store them under "bootloader/signed" directory. The board will not be physically flashed. your workable commands…

Postmortem: Jetson Xavier AGX will not get past Boot ROM after burning PKC+SBK+KEK256

Robotics & Edge Computing Jetson Systems Jetson AGX Xavier

JerryChang March 15, 2022, 3:41am 3

hello ticotimo,

to burning Xavier series, please program all the fuse, and odm production modes at once.
please also refer to Topic 123506 and Topic 176834 as see-also. thanks

Topic		Replies	Views
Xavier doesn't boot after Secure Boot (PKC + SBK + KEK2) flash (JetPack 5.1.5 / L4T R35.6.1) Jetson AGX Xavier security	14	411	April 23, 2025
Xavier NX (eMMC) Secureboot Fusing renders devices unbootable Jetson Xavier NX boot , security	26	1757	April 18, 2023
Secure Boot on Jetson Xavier AGX Jetson AGX Xavier security , nvbugs	43	6026	June 18, 2021
KEK Fuse burn failed on Jetson Xavier R32.3.1 Jetson AGX Xavier security , nvbugs	9	1868	May 20, 2020
Unable to burn fuses (dev kit) / no more output (serial/hdmi) / bricked? Jetson AGX Xavier security , nvbugs	92	7464	May 26, 2020
Jetson Xavier NX DEVKIT secureboot enabled Jetson Xavier NX security , nvbugs	20	6459	May 12, 2021
Concerns about fuse burning on TX2 Jetson TX2 security , nvbugs	31	4003	September 1, 2021
Will not boot after enabling Security Boot (Jetson AGX Xavier) Jetson AGX Xavier reflash , security	67	6209	June 2, 2021
Secure Boot odmfuse programming step fail on 32.2.1 Jetson TX2	19	2930	February 6, 2020
Xavier NX (eMMC) and TX2 NX Secureboot Fusing renders devices unbootable Jetson Xavier NX security	14	2472	February 25, 2022

Postmortem: Jetson Xavier AGX will not get past Boot ROM after burning PKC+SBK+KEK256

Related topics