Verification of Disk Encryption and UEFI Load Encryption

[Youke]

hi all，
I use L4T 35.4.1, use AGX xavier for hardware, and have successfully burned the fuse (pkc, sbk, kek0, kek1, kek2)

I am testing disk encryption and uefi load encryption, and my burn in command is sudo ROOTFS_ENC=1 ./flash.sh -v uefi_keys/sbk.txt -u uefi_keys/rsa_3k.pem -i uefi_keys/sym2_t194.key --uefi-keys uefi_keys/uefi_keys.conf --uefi-enc uefi_keys/sym_t194.key jetson-agx-xavier-devkit mmcblk0p1. How can I confirm that disk encryption and uefi load encryption are running correctly? How can I prove it to my colleagues?

Looking forward to your reply

[JerryChang]

hello Youke,

the quickest way for verification is running $ df -h after system booting up.
you shall see the added partition as following.
for instance,

$ df -h
 /dev/mapper/crypt_root 54G 5.6G 46G 12% /
 /dev/mapper/crypt_UDA 374M 14K 350M 1% /mnt/crypt_UDA
 /dev/nvme0n1p1 371M 97M 247M 29% /boot

[Youke]

hi jerry，
After I tested and added Disk Encryption and UEFI Load Encryption, these two partitions appeared in the system, but I only added UEFI Load Encryption. After entering the system, df - h did not add any partitions. How can I confirm that UEFI Load Encryption is effective?
Thank you for your reply

[JerryChang]

hello Youke,

please refer to developer guide, UEFI Secureboot.
you may checking with $ efivar -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot to check the return values, a value of 0 means that Secureboot is not enabled.

for disk encryption, you’ll need to put ROOTFS_ENC into the command-line,
this means you’re having partition layout with… flash_l4t_t234_nvme_rootfs_enc.xml during image flash to enable disk encryption. if you look into this configuration file, you’ll see there’s partition named APP_ENC for encrypted root partition.

[Youke]

hi jerry，
Thank you for your reply

@JerryChang

you may checking with $ efivar -n 8be4df61-93ca-11d2-aa0d-00e098032b8c-SecureBoot to check the return values, a value of 0 means that Secureboot is not enabled.

I understand this and can check if I have enabled UEFI Secureboot.
How can I confirm if UEFI Load Encryption is enabled?

[JerryChang]

hello Youke,

since it’s UEFI to load/verifies image signature, you may try invalid key to to sign UEFI payload for testing.

[Youke]

hi jerry，
thanks，