How does the security of a mobile wallet work?

Question

Let's assume we have a non custodial hd mobile wallet.

Where is the master key stored?

What are the components of the telephone that allow the derivation of keys?

Answer 1

Let's assume we have a non custodial hd mobile wallet.

Non-custodial means no third party acts as custodian, the wallet stores the private key(s)

Where is the master key stored?

Wherever chosen by the software developer who wrote that part of the wallet app.

Normally you'd hope this is in a file in local storage. You'd hope that file is encrypted using a wallet password as a key and using a well-implemented well-known algorithm. In some cases you'd be wrong.

In some cases the wallet's backup feature might copy this rather vital data into cloud storage. You'd hope the data is competently encrypted before being sent and that the cloud storage provider are also competent at protecting their client's data. Sometimes our hopes are not fulfilled.

What are the components of the telephone that allow the derivation of keys?

No special hardware is necessary.

Derivation of keys will involve use of the the processor (CPU) and memory in conjunction with the software algorithms embedded in libraries provided by the operating system and/or in the software application that is acting as the wallet. The results are likely to be stored in normal non-volatile storage (e.g. onboard flash-memory). You'd hope the developer was competent and careful to ensure this data was not vulnerable to undesired access while in memory or in non-volatile storage.