Question about fTPM offline provisioning

Robotics & Edge Computing Jetson Systems Jetson Orin NX
1

Hi,

I am working to provision fTPM in the factory.

Before starting to work on fTPM provisioning, I already have the mechanism to generate Device_SN, KDK0, Silicon_ID_PUB_KEY, and EPS_Seed, and EKB successfully.

I have the following questions with the specific process or tools to provision fTPM.

(1) How can I generate the fTPM EK CSR. A diagram in the document says “fTPM Gen EK CSR Tool“. Does Nvidia already provide a tool to generate the EK CSR? If so, which tool should I use, and what is the specific instruction to generate the EK CSR?

(2) where is the fTPM provisioning script?

(3) where is the fTPM helper TA/CA and PTA

The developer guide I am following is Firmware TPM — NVIDIA Jetson Linux Developer Guide 1 documentation

Many thanks for any help here.

Screenshot 2025-09-09 at 17.56.49
Screenshot 2025-09-09 at 17.56.491640×1196 41.4 KB

3

*** Please note that this reply is generated by LLM automatically ***

I’d be happy to help you with your questions about provisioning fTPM on the Jetson device.

1. Generating the fTPM EK CSR

The diagram you mentioned is likely referring to a tool that generates the Endorsement Key (EK) Certificate Signing Request (CSR). Unfortunately, the provided documentation does not explicitly mention a specific tool for generating the EK CSR.

However, based on the context, I can provide some guidance. The EK CSR is typically generated using a tool that creates a certificate signing request for the EK certificate. This tool is usually provided by the TPM manufacturer or the platform vendor (in this case, NVIDIA).

After reviewing the documentation, I found a mention of the tpm2-tools package, which is a collection of tools for working with TPM2 devices, including the fTPM. One of the tools in this package is tpm2_createek, which can be used to create an EK CSR.

To generate the EK CSR using tpm2_createek, you can follow these steps:

  • Install the tpm2-tools package on your system.
  • Run the following command to create an EK CSR:
tpm2_createek -c <EK_CSR_FILE> -g <EK_CSR_GENERATION_PARAMS>

Replace <EK_CSR_FILE> with the desired output file name for the EK CSR, and <EK_CSR_GENERATION_PARAMS> with the generation parameters for the EK CSR (e.g., -g sha256 for SHA-256).

Please note that you may need to consult the tpm2-tools documentation for more information on the available options and parameters for the tpm2_createek command.

If you are unable to find the tpm2_createek tool or need further assistance, I recommend reaching out to NVIDIA support or the Jetson developer community for more guidance.

Additional notes

  • Make sure you have the necessary dependencies and tools installed on your system before attempting to generate the EK CSR.
  • The EK CSR generation process may require additional parameters or configuration files, depending on your specific use case and requirements.
  • If you are using a different tool or process to generate the EK CSR, please provide more information about the tool or process, and I’ll do my best to assist you.

I hope this helps! If you have any further questions or concerns, feel free to ask.

*** Please give the thumbs up if you get answers you like. Or provide feedback to help us improve the answer. ***

5

hello yanlin.li,

please refer to above auto-reply,

let me add some info..
you may running the script, ftpm_device_provision.sh script to have provision and activate the fTPM.
please download public release sources,
you may see-also below for reference..
$public_sources/r36.4.4/Linux_for_Tegra/source/atf_and_optee/optee/samples/ftpm-helper/host/tool/ftpm_device_provision.sh

here’re some info about fTPM TA, please see-also.. GitHub, GitHub - microsoft/ms-tpm-20-ref: Reference implementation of the TCG Trusted Platform Module 2.0 specification.

7

Thank you @JerryChang