2

Only things I could find about this subject always tell that Ledger has a secure element like SIM cards and credit cards have. Also something about another OS running near the main application. But simply when you cut the power isn't it just a storage device? SIM cards and credit cards are encrypted with a pin. I also think the secure element in Ledger is. So can an advanced adversary pull the secure element off and brute force a 6 digit PIN?

Improve this question

1 Answer 1

Reset to default
2

No. Secure elements are designed to be resistant to physical attacks. So you shouldn't be able to do anything physical to the chip that allows you to get data off of it. They are designed to prevent unauthorized access to their data so they also are more than just storage devices.

While you can desolder the chip and attach wires to its pins in order to interact with it physically, the chip specifications are not public and require signing an NDA. The manufacturers make it difficult for the general public to be able to know the functionality and ways to interact with the secure element. They are doing security through obscurity.

Furthermore, secure elements are generally complete systems with their own CPU, RAM, storage, etc. So it isn't just a storage device where you can get the contents. Rather they are tiny computers where you can only interact with them in a very specific way.

Improve this answer
2
  • So by structure of it, it's a compound machine that only gives certain outputs on certain conditions? For example let's say it has a data partition, but even though you try to read from it, it doesn't give any output, and maybe even it can record it as an attempt. I can just imagine how impossible hard would it be to reverse engineer something like this. Maybe checking out everything with a microscope and trying to figure out patterns and etc. I am happy to learn that i am pretty much safe with a random 8 digit pin even though some guy just steals the device.
    – Anonymous
    Commented Dec 27, 2019 at 4:03
  • Yes, they are complex machines that only respond to certain inputs, with specific outputs. You could use a scanning electron microscope in order to actually try to read the data from the chip itself, but even then, they have protections in place to make this difficult. In general, secure elements are supposed to ensure that their data is safe even when the device is physically stolen.
    – Ava Chow ♦
    Commented Dec 27, 2019 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.