A secure element, also called a security chip, is a tamper-resistant microprocessor used in hardware wallets to protect sensitive data and carry out cryptographic operations. It plays a critical role in secure data storage and encryption. Beyond hardware wallets, secure elements are also widely used in products such as IC cards, SD cards, SIM cards, eSEs, USB security keys, and wearable devices.
Security of the Secure Element
In 1999, the International Organization for Standardization (ISO) introduced ISO/IEC 15408, more commonly known as the Common Criteria (CC), as a standard for evaluating IT security. This framework establishes strict requirements for assessing the security functions of IT products and systems, helping improve user trust, strengthen system security, and reduce the need for repeated security evaluations.
Under the CC framework, security chips are subject to rigorous testing and are assigned assurance levels ranging from EAL 1 to EAL 7. A higher EAL rating indicates that the product has satisfied more demanding security requirements across multiple dimensions. For instance, EAL 4+ and EAL 5+ are commonly used in the financial industry, while EAL 6+ products are typically used in military-grade applications.
Key Features of EAL 6+ Secure Elements
UKey hardware wallets use EAL 6+ secure elements. These EAL 6+ secure elements provide several important features:
Strong Security Functions: These include environmental sensors, TRNG anomaly detection to prevent malfunction, memory encryption, bus masking, random branch insertion, clock jitter techniques for leakage protection, dedicated shielding, data integrity verification, and memory/bus encryption to defend against physical tampering and probing. A test access control mechanism is also included to block unauthorized access.
True Random Number Generator (TRNG): The TRNG includes entropy sources, a self-test circuit, and a post-processing circuit to ensure proper operation and compliance with the AIS20/31 PTG.2 standard.
Support for Cryptographic Algorithms: The secure element supports TDES through hardware co-processors and software cryptographic libraries, including Triple-DES with two or three 56-bit keys in ECB mode. It also supports RSA, offering the RSA CRT algorithm for key sizes from 256 bits up to 4096 bits. In addition, it provides support for SHA-1, SHA-256, ECC, and AES.
These advanced security chips ensure that private keys are stored in a highly protected environment, helping prevent unauthorized access and physical tampering. By integrating EAL 6+ secure elements, hardware wallets can provide users with a very high level of security assurance, protecting cryptocurrency assets from both digital and physical threats. This strong security foundation is essential for maintaining trust and confidence in the storage and management of digital assets.