On 10 October 2018, Eric Larcheveque, the CEO of Ledger, the French company that makes the very popular “Nano S” cryptocurrency hardware wallet, explained via two posts on the company’s blog why every crypto investor, “no matter how large or small their assets”, should be using a hardware wallet.
Ledger, which was founded in 2014, describes itself as “a fast paced, growing company developing security and infrastructure solutions for cryptocurrencies as well as blockchain applications for individuals and companies, by leveraging a distinctive, proprietary technology.” They have “a distinctive operating system (OS) called BOLOS, which we integrate either to a secure chip for the Ledger wallet line, or to a Hardware Security Module (HSM) for various enterprise solutions.”
For retail investors, Ledger offers two hardware wallets: “the light Ledger Nano S and the touchscreen Ledger Blue, which can both support directly 23 cryptocurrencies, and dozens more via third party applications.” For enterprises, it offers the “Ledger Vault”, which is “a multi-authorization cryptocurrency wallet management solution enabling financial institutions to safekeep their funds.”; this solution is “ideal for Asset Managers and Custodians looking for convenience and streamlined operations with zero compromise on security.”
In a blog post titled “Ledger 101 — Part 1: Do You Really Need a Hardware Wallet?”, the Ledger CEO started by saying the question that he gets asked the most often (by “people who are brand new to the crypto world, early adopters, advanced traders with a great deal of wealth in crypto, institutions, and everyone in between”) is “Do I really need a hardware wallet to secure my crypto assets?” He said the answer is very simple: “Yes, you do!”
The Ledger CEO says that most people first get into crypto by buying coins/token on a (custodial) crypto exchange, and then leaving them there. He explains that the problem with this approach is that by “keeping your crypto assets on an exchange,” you are “entrusting a third party with these private keys and mandating them to serve as a safeguard.” He says that what you get in return from the exchange is an IOU (“I owe you”), i.e. a promise that the exchange will give your cryptoassets back to you.
Here is how he explains the concept of “private keys” and why they are so important:
“When you own cryptocurrencies, what you really own is a 'private key', a critical piece of information used to authorize outgoing transactions on the blockchain network. Whoever has the knowledge of this key can spend the associated funds. Hence the famous expression 'not your (private) keys, not your bitcoins'.”
He then points out that while “owing your private keys gives you much more power and control,” it also comes with the responsibility of looking after their security, and that just like you would only trust a physical safe after buying physical gold, for crypto, you should only the trust the equivalent of a physical safe, i.e. a hardware wallet since software wallets are “the equivalent of displaying gold on a chimney.”
Next, he explains that the main idea behind hardware wallets is “to provide full isolation between the private keys and your easy-to-hack computer or smartphone.” He points out that although paper wallets might be secure, that security disappears when you want to use your funds since this requires importing of private keys on a computer. He warns that even though you might think “a password encrypting your keys is enough”, malware could be waiting for the “inevitable decryption” before stealing your crypto funds.
Finally, the Ledger CEO notes that although even hardware wallets can get hacked in theory (with attacks such as “physical attacks to abstract keys, fault attacks to disrupt a wallet’s chip causing faulty behavior or hacker access, and side channel attacks, which involves a hacker “listening” to the chip’s electric or electromagnetic signature to gain access to the device”), their “pioneering hardware wallet technology” provides highly advanced security for cryptoassets through the use of a “secure element” (a chip “ designed specifically to resist highly skilled attackers”) and a “custom OS designed specifically to protect crypto assets.”
Then, in a second blog post titled “Ledger 101 — Part 2: Why Hardware Wallets are Secure?”, the Ledger CEO points out that a “secure element” (SE) goes through a “strict certification process” (e.g. Common Criteria EAL5+) during which its security is audited by a third party:
“To be certified, the chip must resist an attacker with a high potential that’s using state-of-the-art techniques. Moreover, the production cycle of the chip must also be tightly controlled. From the development to the manufacturing, the processes and premises must be audited by a third party. In particular, a cryptographic mechanism is implemented to ensure that only the manufacturer can load code onto the chip. This production cycle process should prevent supply chain attacks where malicious software is loaded on the chip or the hardware circuit is altered to create a backdoor.”
Hardware wallets make it impossible to access the private keys they protect since the private keys always stay on the device. This why they are also referred to as “cold storage.” A Ledger hardware wallet’s secure element “stores the private keys and has a limited ability to interact with the rest of the device.” Also, the secure element can “verify the integrity of the device, making sure that it hasn’t been tampered with and can indeed be trusted.”
Featured Image Courtesy of Ledger
