4

In light of recent events with Ledger, are all other hardware wallets susceptible to being able to export the private key as well, possibly with a firmware update?

If the former answer is true for many of them, then, AFAIK, smartcards and yubikey are write-only for the secret, and can later only sign or decrypt data. Why don't they make hardware wallets in the same way?

Improve this question

2 Answers 2

Reset to default
3

In light of recent events with Ledger, are all other hardware wallets susceptible to being able to export the private key as well, possibly with a firmware update?

Yes, including those that, like Ledger, use Secure Elements. Hardware wallets with SEs use the SE to store the private key, however in a way that can still be read from it by the MCU. Of course those that don't use a SE at all can also export private keys.

AFAIK, smartcards and yubikey are write-only for the secret, and can later only sign or decrypt data. Why don't they make hardware wallets in the same way?

Because that requires the SE to be able to perform the cryptographic operations necessary to produce valid signatures for Bitcoin. This requires supporting ECDSA, the Schnorr signature algorithm, and the secp256k1 curve.

While ECDSA is commonly supported, the secp256k1 curve is not. Additionally, Schnorr is not supported by any SE, particularly the specific variant that Bitcoin uses.

Improve this answer
3
  • Given that there is a market for such a secure element, then surely somebody will develop it? Would very much like to have one, otherwise all the wallets seem like glorified laptops (with maybe some tamper-resistance added).
    – Cigarette Smoking Man
    May 26 at 4:55
  • 2
    The market is probably a lot smaller than you think. Chip design is orders of magnitude harder than PCB design, so the market would have to be really big to make that worthwhile. Additionally, even if such a SE existed, I'm not sure that most hardware wallet vendors would disable key exporting. Most hardware wallets support multiple coins, and there are many altcoins with all different kinds of crypto, and new stuff comes out all the time. I doubt any hardware vendors would want to risk losing customers because they can't support whatever shiny new altcoin that uses new crypto.
    – Andrew Chow ♦
    May 26 at 5:22
  • @AndrewChow: Coldcard is Bitcoin only, BitBox has a Bitcoin only version, Trezor has the option of Bitcoin only firmware. Jade is Bitcoin and Liquid only, I guess Jade will want to keep open prospect of new cryptography on Liquid. Don't know the unit sales but there seems to be a Bitcoin only offering across companies now. Just Ledger of the main companies that doesn't support Bitcoin only.
    – Michael Folkson
    May 26 at 10:10
-1

Christopher Allen answers this here.

The problem is that no existing SE (Secure Enclave) chips can do secp256k1 (the curve used by Bitcoin & Ethereum) natively and safely in semiconductor logic. This isn't an issue with Ledger; it's an issue with all current chips used by wallets today. This means that in order to do secp256k1, a SE has to hand a key off to a code execution process in the SE or to an MPU. That's what opens the doors for doing unexpected things with that key — things that most didn't expect from a personal hardware wallet. In other words, the public might have had the expectation that keys weren't going to ever leave the Ledger, but that expectation is actually impossible to support today, because keys already have to leave the most trusted part of the Secure Enclave to be used!

Improve this answer
7
  • This seems to be a slippery slope argument, I can agree that a SE cannot do BTC-secp256k1. That does not mean the private key must leave the device to some server, that is a ludicrous jump in assumptions.
    – Poseidon
    May 30 at 23:13
  • @Poseidon May I plug my other question here: do you know what is the difference between an inaccessible (= non-updatable) chip + software where secp256k1 is done in software, and a SE that really supports secp256k1? (Is there any difference?) bitcoin.stackexchange.com/questions/118505/…
    – Cigarette Smoking Man
    May 31 at 5:21
  • 1
    @CigaretteSmokingMan I will respond in that thread, it is pretty relevant to what I am talking about.
    – Poseidon
    May 31 at 6:19
  • @Poseidon: The quote says "hand a key off to a code execution process in the SE or to an MPU". It doesn't say the private key must leave the device to some server. Please read answers before commenting.
    – Michael Folkson
    May 31 at 10:29
  • @MichaelFolkson " the public might have had the expectation that keys weren't going to ever leave the Ledger, but that expectation is actually impossible to support today, because keys already have to leave the most trusted part of the Secure Enclave to be used!" This is a slippery slope argument used to defend ledger exporting private keys from users to a centralized weakly secured server. It is not true that because the keys must leave an SE that it then implies they must go to a more vulnerable system like a centralized server.
    – Poseidon
    Jun 1 at 3:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.