About Ledger signers
This page explains what a Ledger signer is for: isolating cryptographic secrets from a computer that may not be trusted, and using those secrets without copying them onto that computer. It is the starting point for the rest of this section, which then covers the master seed, key derivation, and applications.
Ledger signers isolate cryptographic secrets, such as PGP or Bitcoin private keys, from a potentially insecure computer. Storing those secrets on a physical medium that a virus cannot infect, such as paper or an encrypted drive, is secure until you need to use your funds.
To transfer funds, you need to sign the transaction. Loading your private keys onto your computer for this purpose exposes them to potential malware. The alternative is to perform the required cryptographic operations by hand, which is impractical.
Signers address this problem. They store your cryptographic secrets and let you use them securely for operations such as signing transactions. Ledger signers also use an AIS-31-compliant true random number generator (TRNG) to generate secrets with a large amount of entropy. Using these internally generated secrets is more secure than importing a secret that may have been compromised before it reached the signer.
Ledger uses Secure Element technology to build signers that connect people with cryptocurrencies and blockchains. The Secure Element protects your private keys from tampering and eavesdropping. The screen on the signer is a trusted source of information about your assets, because the signer controls the screen rather than potentially vulnerable computer software. That model applies across the Ledger signers documented in this portal: Ledger Nano S Plus, Ledger Nano X, Ledger Stax, Ledger Flex and Ledger Nano Gen5.
Signers are not intended to store data. Instead, they provide a root of trust. Signer apps tend to be lightweight and work with a host computer. Because the Secure Element limits storage capacity, it is preferable to store encrypted data on the host computer rather than directly on the signer. The signer holds private keys that you can use to unlock your data and assets. If your computer becomes infected with a virus, those keys remain protected.
Applications that process large amounts of data may not be able to store all the data on the signer at once. One approach is to stream data through the signer while the application processes it, for example by encrypting or decrypting the data. Alternatively, an application can derive a secret on the signer, preferably from the master seed, and use it on the computer to process the data. This is how the PGP app works.
The key concept is that a signer provides a secure portal to your assets; it is not a bank. If you lose or destroy your signer, your assets remain safe. Your master seed is the key to this portal.
Main takeaways
A Ledger signer keeps keys off the host computer and signs on the Secure Element. The signer owns the screen, so what you confirm is what will be signed. Apps stay small and recover from the master seed instead of storing their own secrets on the signer.
