Security architecture — secure element, key storage & signing

Try Tangem secure wallet →

Table of contents


Introduction

Hardware wallet security architecture is not just marketing language; it's the set of design decisions that keep private keys isolated and transaction signing honest. I have tested multiple hardware wallet designs since the 2017–2018 cycle, and what I've found is consistent: the architecture (secure element vs general-purpose microcontroller, air-gapped vs USB-connected, firmware signing, etc.) determines the actual risk profile more than the device color or box.

This guide explains secure element (secure chip) basics, how keys are generated and used, what signing looks like in practice, and which trade-offs matter for long-term, self-custody storage. Links to deeper how-to pages are included for hands-on steps (for example: firmware updates, air-gapped signing, and the seed phrase primer).

What is a secure element (secure chip)?

A secure element (also called a secure chip) is a tamper-resistant microcontroller designed to store cryptographic keys and perform sensitive operations (like signing) inside a protected boundary. The goals are simple: prevent key extraction, run authenticated code, and resist side-channel and physical attacks.

For a deeper primer on the chip itself see [/secure-element].

Secure element vs. MCU-based designs (comparison)

Which approach is safer in practice? The short answer: secure elements provide hardware-enforced isolation; MCU-based designs can be fully open-source and auditable, but they rely on software controls. Both have trade-offs.

Feature / Property Secure element (secure chip) MCU-based (no secure element)
Hardware isolation Strong — keys stored in tamper-resistant boundary Weaker — relies on software and OS separation
Auditability Binary blobs inside chip often closed-source Often easier to audit end-to-end (open firmware)
Resistance to physical attacks Higher (side-channel, fault injection protections) Lower unless additional countermeasures implemented
Update model Often enforces signed firmware; hardware root-of-trust Varies widely by implementation
Typical use-case Long-term self-custody where isolation matters Users who prioritize open-source audibility

And yes, that sometimes means extra friction during recovery or advanced setups. But you can reduce risk by combining approaches (see multisig section).

Key storage & private key lifecycle (how keys are created and used)

Hardware wallets typically follow the Hierarchical Deterministic (HD) model defined in standards such as BIP-32 and use human-readable seed phrases per BIP-39. In practice:

  1. Entropy generation: the device gathers entropy and generates a root private key inside the secure element (or MCU) — the private key is never exported in plaintext. (See BIP-39: [https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki].)
  2. Seed phrase: the corresponding seed phrase (12 or 24 words) encodes the entropy and a checksum; 12 words represent 128 bits of entropy, 24 words 256 bits (BIP-39 explains the math).
  3. Derivation: child private keys are derived by a deterministic algorithm (BIP-32/BIP-44). The device either derives addresses internally or exposes public keys to a host that constructs transactions (see BIP-32: [https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki]).

Passphrase (the so-called 25th word) is an optional layer that adds a separate secret to the seed; use it only if you understand the recovery risks (see [/passphrase-25th-word]).

Transaction signing — Step by step (how signing actually works)

How does a transfer actually get signed? Here is a typical step-by-step for Bitcoin-like flows (PSBT is the common exchange format):

  1. Build transaction on host: a wallet app constructs a PSBT or unsigned transaction.
  2. Transfer to device: the PSBT is sent to the hardware wallet (USB, Bluetooth, QR code, or microSD).
  3. On-device verification: the device displays human-readable details (amount, fee, recipient address). Verify them on the device screen — not on the computer. (Always check the on-device output.)
  4. User confirms physically: you press the device's buttons or tap the screen to confirm.
  5. Internal signing: the secure element computes the signature using elliptic curve cryptography and returns the signature to the host. The private key never leaves the chip.
  6. Broadcasting: the host assembles the final transaction and broadcasts it to the network.

Elliptic curve cryptography is the underlying math for signing (Bitcoin and Ethereum use the secp256k1 curve; other chains use Ed25519 or similar — see RFC 8032 for Ed25519: [https://tools.ietf.org/html/rfc8032], and BIP-340 for Schnorr signatures in Bitcoin [https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki]).

Air-gapped signing: options and trade-offs

Air-gapped signing isolates the signing device from a networked host. Common transports: QR codes, microSD cards, or offline Bluetooth bridges.

If you want a step-by-step air-gapped guide, see [/air-gapped-signing] and [/air-gapped].

Firmware authenticity and secure boot

Firmware authenticity matters: a compromised firmware can misrepresent addresses or leak secrets. Devices mitigate this with cryptographic firmware signing and a hardware root-of-trust that checks update signatures at boot time.

Practical checks:

Supply chain risks exist (tampered packaging or intercepted units). Supply-chain verification practices are explained at [/supply-chain-verification].

Multi-signature (multisig) compatibility and benefits

Multi-signature (multisig) setups require multiple independent keys to authorize a spend (for example, 2-of-3). Multisig raises the bar because an attacker must compromise multiple signing keys or devices.

How it helps: distribute keys geographically, use different device types or custody arrangements, or combine hardware wallets with an HSM or a third-party custody service.

PSBT is again the enabling format for multisig coordination. For setup examples and compatibility notes see [/multisig] and [/multisig-compatibility].

Common attack vectors and practical mitigations

But remember: security is layered. Multisig plus geographically distributed backups reduces single-point-of-failure risk.

Who this architecture is best for — and who should look elsewhere

Best fit:

Who might look elsewhere:

FAQ

Q: Can I recover my crypto if the device breaks? A: Yes — if you have a proper seed phrase backup or multisig recovery plan. See [/backup-and-recovery] and [/device-broken].

Q: What happens if the company that makes the device goes bankrupt? A: Your keys are derived from your seed phrase; company failure does not destroy your funds if you control the seed. See [/company-failure-recovery].

Q: Is Bluetooth safe for a hardware wallet? A: Bluetooth increases the attack surface compared with a wired-only connection. Mitigations include authenticated pairing, firmware-signed updates, and on-device verification of transactions. See [/connectivity-usb-bluetooth-nfc].

Conclusion & next steps (CTA)

Secure elements and thoughtful signing workflows materially reduce the risk of key theft. In my testing, the two most effective practices are 1) verifying every transaction on the device screen, and 2) maintaining a secure, tested backup strategy (and yes, that includes practicing a recovery once). For hands-on steps, read the device setup guide, review firmware update checks, and consider a multisig design if you hold large amounts (/multisig).

If you want a practical next step, start with the getting started page for a setup checklist, then move to [/seed-phrase] and [/firmware-updates] to lock down recovery and update hygiene.

References & standards cited:

Try Tangem secure wallet →