Question of Enabling Disk Encryption for Dynamically Created Partitions

Robotics & Edge Computing Jetson & Embedded Systems Jetson AGX Orin
1

Hello, we are encountering some issues with disk encryption and are seeking assistance. Below are our requirements:

  1. Our bootloader, including rootfs kernel, etc., is stored on a separate hard drive, which is not encrypted.which is a flash hardware
  2. We have added a separate NVMe protocol SSD to store customer data, and we intend to encrypt this disk. This drive is a single partition, nvme0n1p1.

We are developing on SDK 35.4.1 using hardware and SDK provided by Advantek.

Here are my questions:

  1. For the above requirements, I am unsure if we can implement this using the “Disk Encryption” section from the linkhttps://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/DiskEncryption.html#sd-security-diskencryption .
  2. What we have done so far: Following the encryption section, we executed <gen_luks.sh /dev/nvme0n1p1 CRYPTDATA>, after Linux booted up and restarted as prompted. However, after rebooting, the startup log printed:
[   24.922500] /dev/nvme0n1p1 can't be formatted
[   35.166915] ERROR: device /dev/nvme0n1p1 can't be formatted

After boot, the expected directory did not appear under /dev/mapper/CRYPTDATA. Is this because the eks.img supporting disk encryption was not generated? The documentation for SDK 35.4.1 indicates that disk encryption is not supported—is this the reason?
3. There is a question about the process described in the encryption section: Is the encrypted partition created during the power-on process?

5

image
a little mistake, we wonder if we can implement our requirement using section

Enabling Disk Encryption for Dynamically Created Partitions

6

hello zhiyuan.shi,

what did you meant dynamically created partitions?

according to developer guide, you must re-flash a target to enable disk encryption. it has partition layout update to add APP_ENC partition.
FYI, the boot partition (i.e. APP) remains in an unencrypted format, so the bootloader can still load kernel and device tree blob; the root partition (i.e. APP_ENC) would be encrypted.

7

hi ,jerry

your question “what did you meant dynamically created partitions?” is the section below
https://docs.nvidia.com/jetson/archives/r35.4.1/DeveloperGuide/text/SD/Security/DiskEncryption.html#enabling-disk-encryption-for-dynamically-created-partitions

Do you mean, the section content above would work only after re-flash a target with the layout specified to enable disk encryption?

8

hello zhiyuan.shi,

it’s the approach to encrypt a specific partition at run time.
please check… $ ls -la /dev/disk/by-partlabel/, nvme0n1p1 it’s APP partition. so, you may try with UDA partition instead.

note, gen_luks.sh is a tool to mark the partition as encrypted and inird will handle the real disk encryption process.
the record is in /opt/nvidia/cryptluks file.

10

ok finally we use the dynamically created partitions after enable disk encryptation and use new eks.img with specified diskencrypt key. 3q for your reply

11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.