/
/ 

What a secure element does, and what an EAL rating certifies

2026-08-01 · Hardware Almost every hardware wallet page states an EAL level, and the number describes something narrower than most buyers assume. It grades how hard a laboratory was required to look at one specific chip against a written scope document, and on the Trezor Safe…

01 / 01 Sections Sections

2026-08-01 · Hardware

Almost every hardware wallet page states an EAL level, and the number describes something narrower than most buyers assume. It grades how hard a laboratory was required to look at one specific chip against a written scope document, and on the Trezor Safe line the private keys sit outside that chip.

Spec file

Field Value
Subject Secure elements in consumer hardware wallets, and Common Criteria EAL ratings
Standard Common Criteria for Information Technology Security Evaluation, CC:2022, Part 5
Levels EAL1 to EAL7. The + marks extra assurance components added on top
Worked example Infineon OPTIGA Trust M (V3), sales code SLS 32AIA010MK, used in Trezor Safe 3, Safe 5 and Safe 7
Certificate BSI-DSZ-CC-0961, hardware identifier IFX_CCI_00000Bh, design step G13, EAL6+, certified 2024-11-11
Evaluated target The security controller silicon and its own firmware. Software written on top sits outside it
Products on the CC list 1,788 current, 4,907 archived. Zero named “OPTIGA Trust M”. Zero from any hardware wallet maker
Where Trezor keys live The main microcontroller, encrypted by the PIN together with a secret held in the secure element
Claims that cannot be checked D’CENT and ELLIPAL each state EAL5+ with no chip vendor, part number or certificate reference
Checked 2026-08-01

What the record shows

What is a secure element?

A general-purpose microcontroller is built to run code quickly and cheaply. It assumes the attacker is on the network. A secure element assumes the attacker is holding the device, has opened the package, and owns a laboratory.

That distinction sounds like marketing until you read what the chip was actually tested against, which is written down per product in a document called a Security Target. The one behind the chip in the Trezor Safe line runs to 157 pages.

It names eight threats the chip has to survive. Physical probing, meaning microscopic needles placed on the die to read signals directly. Physical manipulation, meaning cutting or rewiring it. Malfunction due to environmental stress, which is the formal name for glitching the supply voltage or clock to make the chip skip an instruction. Inherent information leakage and forced information leakage, which are side channels: power draw, electromagnetic emission and timing that vary with the secret being processed. Abuse of functionality, deficiency of random numbers, and masquerade of the chip itself.

The countermeasures are named too. The die carries what Infineon calls an “intelligent implicit active shielding I2-shield”, an upper metal layer described in the Security Target as providing “physical protection against probing and forcing”. The symmetric crypto block is “especially designed to counter attacks like DPA, EMA and DFA”, which is differential power analysis, electromagnetic analysis and differential fault analysis. Two CPUs run in step so that a fault in one is caught by disagreement with the other. Memory contents, bus data and addresses are encrypted or masked, “leaving no plain data on the chip”.

The bar it has to clear is a formal one. The evaluation includes the assurance component AVA_VAN.5, and the Security Target states the chip “must withstand attackers with high attack potential”. Under that component the evaluators get the low-level design and the source code.

None of that is true of an ordinary microcontroller, which is why the two-chip design exists.

What do the letters EAL actually grade?

Common Criteria publishes seven assurance packages. Their names come straight from CC:2022 Part 5.

Level What the package is called
EAL1 Functionally tested
EAL2 Structurally tested
EAL3 Methodically tested and checked
EAL4 Methodically designed, tested and reviewed
EAL5 Semi-formally verified designed and tested
EAL6 Semi-formally verified design and tested
EAL7 Formally verified design and tested

Read the names again. Testing, review, design documentation, formal verification. Every one describes work the laboratory and the developer had to do. The standard’s own wording for EAL6 is that it “permits developers to gain high assurance from application of security engineering techniques to a rigorous development environment”, supported by “a formal model of select TOE security policies”, “a semi-formal presentation of the functional specification and TOE design”, and “an independent vulnerability analysis demonstrating resistance to penetration attackers with a high attack potential”.

The number tells you how deep the inspection went. It carries no information about how much of the thing in your hand got inspected. That question has a separate answer, and it is the one that matters.

So what sets the boundary?

The Security Target does. It defines the Target of Evaluation, the TOE, which is the exact slice of the world that was examined. Everything outside it was not.

Here is the boundary for the chip in question, in the document’s own words: “The TOE is the platform for the Smartcard Embedded Software. The Smartcard Embedded Software itself is not part of the TOE.”

So the certificate covers the silicon and the firmware Infineon puts on it. The application code that a customer writes and loads onto that silicon was never evaluated. A certified chip inside a finished product does not make the finished product certified, and the standard is explicit about this rather than silent. CC:2022 Part 5 defines a whole separate assurance package for the case, the composite product package, COMP. Its stated purpose is to give assurance “that a composite product has been assembled and evaluated according to the relevant criteria”, covering the base component, the dependent component, and the “contradictions, inconsistencies or security gaps resulting from the composition” of the two.

Which is why a narrowly scoped EAL6+ can be worth less in practice than a broadly scoped EAL5+. The number is one axis. The Security Target is the other, and only one of them appears in marketing copy.

Which of these products is actually on the certified list?

Common Criteria maintains a public list of certified products. I downloaded both halves of it on 1 August 2026: 1,788 current entries and 4,907 archived ones.

Searching all 6,695 for “Trust M” returns nothing. There are nine OPTIGA products on the list and every one of them is an OPTIGA Trusted Platform Module, the SLB9672 and SLB9673 parts, which is a different product line. All nine are EAL4+. Searching for Trezor, SatoshiLabs, ELLIPAL, D’CENT or IoTrust returns nothing at all.

The EAL6+ certificates in Infineon’s name are for security controllers identified by hardware number. The relevant one is titled “Infineon Security Controller IFX_CCI_000007h, 000009h, 00000Ah, 00000Bh, 000016h, 000017h, 000018h, 000023h, 000024h, design step G13”, certified on 11 November 2024, filed under the category “ICs, Smart Cards and Smart Card-Related Devices and Systems”.

Infineon’s own datasheet closes the loop, and its wording is careful. Revision 3.70, dated 2024-10-09, describes the OPTIGA Trust M as “based on Common Criteria (CC) EAL6+ (high) certified hardware”, then tells you exactly where to look: “The CC certificate can be found at www.bsi.bund.de by searching for BSI-DSZ-CC-0961 (Hardware Identifier IFX_CCI_00000Bh) and referring to the latest CC certificate.”

IFX_CCI_00000Bh is in the title of the certificate above. The chip vendor is telling you, in its own specification, that the certificate belongs to the hardware the part is built on.

Where does the private key actually live?

This is the part buyers get wrong, and Trezor documents it plainly on its own knowledge base.

Component What it holds What it does
Main microcontroller The encrypted seed and private keys Runs the firmware and performs the signing
OPTIGA Trust M (V3) A secret, plus a Trezor-issued device certificate Releases the secret on the correct PIN, erases it after 16 wrong attempts, adds entropy at seed creation, signs the authenticity challenge
TROPIC01, Safe 7 only PIN-related secrets A second element working alongside OPTIGA, designed to be independently auditable

Trezor’s own text: “During PIN setup, your Trezor generates a secret that is stored inside the Secure Element. This secret is used, along with your PIN, to encrypt the private keys stored on the main chip.” The secure element “protects physical access to your private keys by securely enforcing PIN verification, without storing the PIN itself”. It “contributes an independent source of entropy during wallet seed creation” and “stores a certificate from Trezor that helps prove your device is genuine”.

The keys are on the microcontroller. The certified chip is a lock on the door. It also throws the dice at setup and signs the certificate proving the device is genuine.

Trezor confirms the same architecture for its newest device from the other direction. After Ledger’s research team demonstrated a laser fault injection attack against the TROPIC01 element, Trezor’s June 2026 response said: “The keys to your coins / funds are not stored on the TROPIC01 Secure Element chip, and neither is your wallet backup.”

Two pieces of research from Ledger’s Donjon team sit behind this. Trezor’s own security portal records that Donjon “evaluated our Trezor Safe Family and successfully reused a previously known attack to demonstrate how some countermeasures against supply chain attacks in Trezor Safe 3 can be bypassed”, reported on 12 November 2024, and notes that the Safe 5 is unaffected because it uses a newer microcontroller. Ledger’s published account of that work states that cryptographic operations are still performed on the microcontroller, which is the architectural point Trezor’s documentation independently confirms. Ledger’s second piece, published 3 June 2026, used laser fault injection to bypass Ed25519 signature verification on TROPIC01 and achieve arbitrary firmware execution, while reporting that one hardware mechanism held: “even an attacker with full control over the CPU cannot read, modify, or bypass the MACANDD mechanism”. [Q]

How do you check a claim yourself?

Open the certified products list at commoncriteriaportal.org and search the product name. If nothing comes back, search the chip instead, which means you need the chip. Get the part number from the datasheet, find the hardware identifier or certificate number the datasheet points at, then read the Security Target attached to that certificate and check what the Target of Evaluation covers.

Then check the date. Certificates carry a certification date and an archive date, and the one above moves to the archived list on 24 March 2027.

Now apply that to the two devices I earn a commission on. The D’CENT Biometric page states “Secured Firmware with EAL5+ certification” and describes a “Certified Security Chip (CC EAL5+)”. The ELLIPAL Titan page states “CC EAL5+”. Neither names a chip vendor, a part number or a certificate reference, and neither appears on the certified list under any name.

That makes both statements claims rather than verified facts. It does not make them false. It makes them uncheckable, which is a different problem with the same practical effect.

What I think is going on

The EAL number became a trust badge somewhere on the way from a German evaluation laboratory to a product page, and badges get copied by people who never read the underlying document.

I do not think most wallet vendors are lying. I think the marketing team was handed “EAL5+” by an engineer, put it on the spec sheet, and nobody asked which chip or which certificate, because no buyer has ever asked. The number is doing work that the number cannot do.

Notice the asymmetry, because it is the most useful thing on this page. I can write a critical section about Trezor’s architecture only because Trezor published it: the chip model, the key storage design, the PIN retry count, a standing vulnerability page, and a rival’s research against their own newest product with the disclosure co-published. Openness is what makes a vendor criticisable. The companies that name nothing cannot be criticised on specifics at all, and a reader is likely to read that silence as an absence of problems.

Something else worth holding onto. A certificate is a photograph, taken on a date, of a defined object. In September 2024 NIST published CVE-2024-45678, the EUCLEAK finding: an electromagnetic side channel allowing ECDSA secret-key extraction, “because of a non-constant-time modular inversion for the Extended Euclidean Algorithm”, with the note that “other uses of an Infineon cryptographic library may also be affected”. Certification did not stop that being found, and it was never designed to. It says a laboratory looked hard on a particular day at a particular thing.

What reduces your exposure

Treat an EAL number on a product page as the beginning of a question. Four things make the difference between a claim and a fact, and none of them require you to buy anything.

Does the vendor name the chip? A part number is the difference between a checkable statement and a decoration. If a company will not name the part, you have learned something about the company.

Does the certificate exist, and does it cover what you assumed? Search the Common Criteria portal by product first, then by chip, then read the Target of Evaluation section in the Security Target. If the certificate is for a security controller and the wallet firmware sits on top of it, the wallet firmware was not part of that evaluation.

Where do the keys sit? Ask whether the private keys live inside the certified chip or on the main microcontroller encrypted by something the chip holds. Both designs are defensible and they fail differently. A secure element gating a PIN raises the cost of a physical attack on a stolen device, and it does nothing about a firmware fault on the chip that performs the signing.

And take the number for what it grades. A higher EAL means the evaluators demanded more evidence and dug deeper. It carries no promise about the parts of the product they were never asked to look at.

Now the limits, which are the whole reason not to over-weight any of this. A secure element resists an attacker holding your device. It has no view of what you approve on the screen. Phishing, blind signing a payload you cannot read, a compromised host rewriting a destination address before it ever reaches the device, or your own decision to authorise a transfer to somebody who lied to you: the certified chip signs all of those as readily as a legitimate transaction, because from its position they are legitimate transactions. That gap has its own explainer in blind signing, and the industry around exploiting it is in the drainer piece. Between them they describe how wallets actually get emptied.

Supply chain sits outside the boundary too. Ledger’s Safe 3 work needed the device before you received it. Buy direct from the manufacturer, run the authenticity check, and update the firmware before moving anything meaningful onto it.

Device-by-device comparison, prices, chain support and audit history are in the cold wallet shortlist. This page is the layer underneath it.

Sources

Corrections

None yet.

Last updated: 2026-08-01

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.