# Purpose of OEM\_K2 for Orin AGX

**URL:** <https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032>\
**Category:** Jetson AGX Orin\
**Tags:** security\
**Created:** [October 7, 2024, 4:36pm UTC](https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032 "2024-10-07T16:36:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeanphilippe.arnaud](https://developer.download.nvidia.com/images/forums/profile-default-devtalk-84.png) [@jeanphilippe.arnaud](https://forums.developer.nvidia.com/u/jeanphilippe.arnaud)\
**Post date:** [October 7, 2024, 4:36pm UTC](https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032/1 "2024-10-07T16:36:14Z")

</div>

In Jetpack 36.3, the example.sh in nvidia-jetson-optee-source/optee/samples/hwkey-agent/host/tool/gen\_ekb used OEM\_K2 as the source key used to derive the EKB AK key.

In Jetpack 36.4 this has changed to use OEM\_K1 and the [doc](https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide/SD/Security/OpTee.html?highlight=oem_k2#ekb-fuse-key) explicitly states " We recommend that you use the `OEM_K1` fuse as the EKB fuse key.".

I cannot see in the doc that OEM\_K2 is used for anything related to Secureboot or encryption.

Looking at jetson\_user\_key\_pta.c in JP36.4, it seems both K1 and K2 are now used to derive the root key that is then used to calculate the derived keys that are used to decrypt and authenticate the EKB. This is different from JP36.3:

```auto
se_aes_keyslot_t fuse_key_for_ekb[] = { SE_AES_KEYSLOT_OEM_K1, SE_AES_KEYSLOT_OEM_K2 };
se_aes_keyslot_t fuse_key_for_ssk = SE_AES_KEYSLOT_OEM_K2;

ekb_extraction_process()
...
	for (i = 0; i < ekb_rks_num; i++) {
        ....

```

This seems to conflict with the recommendation in the doc of only using OEM\_K1, so what, if anything should we program in OEM\_K2? Is it safe to leave it unprogrammed? Are we better off programming it in case it is used in the future?

In the Jetson Orin Fuse Specification, I came across fuses “FUSE\_KEYS\_PSC\_STATIC\_OEM\_0\_0\_0” and “FUSE\_KEYS\_PSC\_STATIC\_OEM\_0\_1\_0” which contain bits OEM\_K1\_PURPOSE and OEM\_K2\_PURPOSE:  
[3:0]: OEM\_K1\_PURPOSE, defines the exact usage for key OEM\_K1  
[7:4]: OEM\_K2\_PURPOSE, defines the exact usage for key OEM\_K2

How is this fuse used exactly? The list of values for OEM\_K1\_PURPOSE and OEM\_K2\_PURPOSE just contains acronyms. Does it need to be burnt to enable full Secureboot?

---

<div class="post-metadata">

**Author:** ![JerryChang](https://sea2.discourse-cdn.com/nvidia/user_avatar/forums.developer.nvidia.com/jerrychang/32/14043_2.png) [@JerryChang](https://forums.developer.nvidia.com/u/JerryChang)\
**Post date:** [October 8, 2024, 2:18am UTC](https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032/4 "2024-10-08T02:18:40Z")

</div>

hello jeanphilippe.arnaud,

they’re all ODM fuse bits, for Jetson Orin SoC, there’re `OemK1` and `OemK2`, both of the keys length is 32 bytes.  
they’re used to generate the EKB image, as you can see per [Tool for EKB Generation](https://docs.nvidia.com/jetson/archives/r36.4/DeveloperGuide/SD/Security/OpTee.html#tool-for-ekb-generation) section.  
re-cap as below.

> the EKS image is encrypted and signed by the OEM\_K1 (or OEM\_K2 in earlier releases).

---

<div class="post-metadata">

**Author:** ![jeanphilippe.arnaud](https://developer.download.nvidia.com/images/forums/profile-default-devtalk-84.png) [@jeanphilippe.arnaud](https://forums.developer.nvidia.com/u/jeanphilippe.arnaud)\
**Post date:** [October 8, 2024, 8:16am UTC](https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032/5 "2024-10-08T08:16:37Z")

</div>

Hi Jerry,

I know the OEM\_Kx is used to derive a root key which is itself used to sign and encrypt the EKB.

But in JP36.3 it was OEM\_K2 that was used, now in JP36.4 they are both used to try and ‘open’ the EKB. I don’t know what future JP releases will do. So what is NVidia’s recommendation? Is it safe to program them both and say use OEM\_K1 as per the current recommendation?

Could you address my other questions (copied below for convenience)?

In the Jetson Orin Fuse Specification, I came across fuses “FUSE\_KEYS\_PSC\_STATIC\_OEM\_0\_0\_0” and “FUSE\_KEYS\_PSC\_STATIC\_OEM\_0\_1\_0” which contain bits OEM\_K1\_PURPOSE and OEM\_K2\_PURPOSE:  
[3:0]: OEM\_K1\_PURPOSE, defines the exact usage for key OEM\_K1  
[7:4]: OEM\_K2\_PURPOSE, defines the exact usage for key OEM\_K2

How is this fuse used exactly? The list of values for OEM\_K1\_PURPOSE and OEM\_K2\_PURPOSE just contains acronyms. Does it need to be burnt to enable full Secureboot?

For context, I am need to understand exactly what fuses to burn so we can manufacture/ship our product.

---

<div class="post-metadata">

**Author:** ![JerryChang](https://sea2.discourse-cdn.com/nvidia/user_avatar/forums.developer.nvidia.com/jerrychang/32/14043_2.png) [@JerryChang](https://forums.developer.nvidia.com/u/JerryChang)\
**Post date:** [October 9, 2024, 8:07am UTC](https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032/6 "2024-10-09T08:07:15Z")

</div>

hello jeanphilippe.arnaud,

FYI.  
**OEM\_K1** , it is the root of trust of EKB, and it is used to derive the RPMB key too.  
**OEM\_K2** , it is to derive the PV encryption key. If you don’t need to encrypt CPUBL with a PV key, you don’t need to care about OEM\_K2.

---

<div class="post-metadata">

**Author:** ![system](https://sea2.discourse-cdn.com/nvidia/user_avatar/forums.developer.nvidia.com/system/32/68080_2.png) [@system](https://forums.developer.nvidia.com/u/system)\
**Post date:** [November 6, 2024, 5:38am UTC](https://forums.developer.nvidia.com/t/purpose-of-oem-k2-for-orin-agx/309032/8 "2024-11-06T05:38:54Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.