Tales from the Crypt: Implementing Secure Boot and Disk Encryption on Tegra Platforms
summary
Detailed recipe for Tegra secure boot and LUKS disk encryption: secure boot uses a public key hash burned into fuses and a separate secure-boot key, with KEK2 used by LUKS/dm-crypt; a mistaken fuse burn can permanently brick a board (one real incident). Workflows that succeed use the secure-boot-tegra scripts, test the vendor Ubuntu image first, then move to Yocto/meta-tegra, and perform on-device encryption with Tegra Test Distro so rootfs encryption happens in minutes (~1 minute) and OTAs (rauc or mender) continue to work.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:35Secure Boot: NVidia Implementation Primer
- 9:01Secure Boot: Fuses on Tegra Platforms (cont'd)
- 10:23Secure Boot: A Lovely Paperweight
- 11:47Secure Boot: secureboot-tegra
- 13:42Secure Boot: meta-tegra
- 15:32Disk Encryption: NVidia's Implementation
- 19:24Disk Encryption: Another "Good" Idea
- 21:43Disk Encryption: Yocto Project/OpenEmbedded Friendlier Approach
- 24:53Disk Encryption: tegra-test-distro (cont'd)
- 27:01Disk Encryption: eks.img
- 28:46Disk Encryption: A/B OTA Updates
- 29:56Future Work: Jetpack 5.0.2+ (OP-TEE, UEFI and 5.10.y Kernel)
related talks
42mBecoming a tyrant: Implementing secure boot in embedded devices
53mSecure Embedded Linux Product - A Success Story
49mSecure Boot from A to Z
42mPractical Application of Verified Boot
45mNavigating Security Tradeoffs in Embedded Linux Systems
34mAuthenticated and Encrypted Storage on Embedded Linux- 42mPractical Application of Verified Boot
40mWhat should I know about secure boot and TEEs?