Differences between tegraopenssl vs generic openssl

[danielwangksu]

Hi there,

This probably should be a question for Nvidia, but I'm having trouble to find a straight answer from them. The recent release has a binary with name tegraopenssl. It seems the utility for conducting code signing (used by flash.sh, tegraflash.py, tegrasign_v3.py). Does any one know what's the customization goes in tegraopenssl comparing to a generic openssl?

My main concern is that if I want to store my private signing key in HSM, what kind of HSM is supported by Nvidia's software? some HSM implements through openssl engine, some seems use network API, etc. I would prefer not have to export/import keys with HSM all the time for security concern. Thank you!

[madisongh]

If I'm reading the scripts correctly, tegraopenssl is only used with tegrasign_v3.py... which doesn't appear to be used at all in any of the other scripts, so I'm not sure what that's for.

The program that is used for signing for t186/t194 platforms is called tegrasign_v2, and for t210 platforms is just tegrasign. Those are both binaries. As far as I can tell, they only take files as input for keys.

[danielwangksu]

Sorry my bad, you are right. tegraflash_internal.py does not use tegrasign_v3 only tegrasign and tegrasign_v2. Thank you!