Bitcoin hardware wallets: What is a secure element?

A secure element is a specific type of microprocessor chip that can store and process highly sensitive information. These chips are integrated into a variety of devices that contain important data, such as credit cards and SIM cards.

In the context of bitcoin, a secure element stores the seed phrase and private keys within a hardware wallet, giving the device significantly more protection against local, physical attacks compared to those with a traditional chip.

Although the secure element chip comes with some disadvantages, it’s generally seen as a good way of adding an extra layer of security that helps to protect your device against an array of attack vectors.

How does a secure element protect my data?

For most people, a good hardware wallet is a much safer way to hold your bitcoin than a software wallet on a desktop or mobile device, which are typically more vulnerable to remote attacks over the internet and malware.

However, there are still a number of physical attacks that hackers can perform if they get possession of your hardware wallet. It is these physical attacks that a secure element chip helps to prevent.

Fault attack protection

An example of an attack strategy that the secure element protects against is the fault attack. With access to your device, a hacker can manipulate the integrated circuit in an effort to promote an error that sends the device into an unintended state and disables the internal protection mechanisms. This can grant access to the attacker who can then seize any previously protected information.

A secure element is designed to detect any abnormalities in circuit features, such as voltage supply, and responds by conducting a series of fake operations alongside its normal ones, effectively hiding any sensitive information that could have been released. Furthermore, if any nefarious activity is flagged by the chip, then the seed phrase and private key that it contains can immediately be wiped.

Side-channel protection

Another way in which hackers attempt to extract secret data from hardware wallets is through a side-channel attack. This method of attack uses indicators external to the device to gain insight about the mechanisms within, for example, reading power consumption or electromagnetic emissions.

A secure element is built to make these specific forms of attack far more difficult, by performing fake operations alongside real operations that make it almost impossible to read and decrypt the valuable private key data.

Even more protections than we can list here!

A secure element also helps to protect against a number of other, slightly less common attacks, such as cold-boot attacks and software attacks. The variety of attacks prevented will vary across models and manufacturers.

What are the disadvantages of a secure element?

Whilst the inclusion of a secure element in your hardware wallet might seem like a no-brainer after reading about the attacks it helps to prevent, there are some disadvantages to be aware of too.

Closed source

The majority of secure elements built today are proprietary, making it difficult for anyone but the manufacturer to analyze and verify a chip’s security. This means that consumers must trust the vendor that there’s no possibility of the chip being compromised at production or any other point in the supply chain.

It should also be noted that closed source can sometimes offer additional security—without any detailed specifications of the chip, it becomes harder for attackers to identify and probe potential weaknesses in the design compared to an open-source chip.

Certification

Most secure element vendors must rely on their reputation gained through achieving certification and passing security inspections to achieve trust among the community. Although many chip vendors have impeccable records, some consumers may still feel uncomfortable trusting a business with an over-emphasis on becoming certified as opposed to being secure, especially when the incentives of the certifying body may be skewed in favor of the vendors that pay them.

Ultimately, secure elements in hardware wallets have successfully secured billions of dollars worth of bitcoin for many years. There are few publicly known examples of compromises, despite the concerted efforts of many security researchers around the world. Based on their track record, they can be considered very secure.

Are there any open-source secure elements?

Tropic Square is the name of the new open-source secure element in development by SatoshiLabs (creator of the Trezor hardware wallets). Their initiative to “provide access to design specifications, verification and testing without obscurity” represents an interesting alternative to the current generation of bitcoin wallet secure elements with a chip whose security can be verified by anyone in the community.

Should you choose a hardware wallet with a secure element?

As can be seen above, there are a range of trade-offs when choosing whether to select a hardware wallet with or without a secure element. Going with a secure element ensures that having your hardware wallet stolen is less dangerous, but you expose yourself to an increased risk of potential compromises by the manufacturer or supply chain.

At Unchained, we support the following wallets in our vault platform:

Model	Secure element	Open-source
Trezor Model One	❌	✅
Trezor Model T	❌	✅
COLDCARD Mk 3	ATECC608	❌
Ledger Nano S	ST33	❌
Ledger Nano X	ST33	❌

We take the position that these hardware wallets all offer extremely high security compared to desktop and mobile alternatives, and are sufficient for the vast majority of bitcoin users.

The best of both worlds: multi-vendor multisig

If you’re still unsure about the trade-offs involved with secure elements, you can mitigate the disadvantages of a secure element while taking advantage of their additional security features by storing your bitcoin in multisig and using a different hardware wallet to secure each multisig key.

Our Unchained vaults make it easy to create a multi-vendor multisig to secure your bitcoin. And if you’d like additional assistance, our Concierge Onboarding team can guide you through the setup process on a video call. Get in touch, we’d be glad to help!