Post-Quantum Cryptography, Tamper-Resistance, and Secure Screens with Ledger CTO Charles Guillemet

Ledger recently announced Ledger Atom, a mobile device that combines hardware wallet security with Android usability. In this episode of Techlore Talks, Ledger’s CTO explains what this device actually protects, where it stops, and what it means for privacy.

🔗 SOURCES & LINKS
• Ledger hardware wallets (affiliate): https://www.ledger.com/techlore
• Ledger hardware wallets (non-affiliate): https://www.ledger.com
• Ledger Atom details (affiliate): https://shop.ledger.com/pages/ledger-atom?r=1fb45e5b9178
• Ledger Atom details (non-affiliate): https://shop.ledger.com/pages/ledger-atom

⏱️ TIMESTAMPS

• (00:00) - INTRO
• (00:09) - WHAT'S NEW?
• (00:34) - SECURITY COMPARISON
• (02:33) - SECURE MODE
• (03:40) - SECURITY VS. PRIVACY
• (05:08) - APPS USING THE SECURE ELEMENT
• (07:01) - GOALS FOR THE FUTURE
• (08:10) - THE IMPLANT ATTACK
• (10:31) - APPLYING TO OLDER DEVICES
• (11:45) - POST-QUANTUM
• (14:17) - USABILITY
• (15:39) - FUTURE POSSIBILITIES

🎥 VIDEO
Watch on YouTube

🧡 SUPPORT TECHLORE
Keep Techlore Talks independent & growing: ★ Support this podcast ★

Creators and Guests

Host

Henry Fisher

Runner, artist, musician and digital rights activist. Owner of Techlore

Guest

Charles Guillemet

Ledger

Editor

Tori

Techlore

What is Techlore Talks?

Techlore Talks brings you in-depth conversations with the experts at the forefront of privacy, security, and digital rights. Hosted by Henry Fisher, founder of Techlore and long-time digital rights educator, each episode features meaningful discussions with the people building, researching, and advocating for digital freedom.

From cybersecurity researchers and privacy tool developers to open-source advocates and digital rights activists—if they're shaping how we protect ourselves online, they're on this show.

Topics include: privacy tools and technologies, cybersecurity threats and defenses, open-source software, surveillance and digital rights, encryption, tech policy, and digital sovereignty.

New episodes released regularly. Subscribe and join the community at techlore.tech.

Even if your Android is fully compromised,

your device is still secure because

there is this independent second world

that is in charge of security.

I just wanted to start

by asking what's new,

especially when it comes to consumers.

So yes, today we are at Ledger Op3n

in Paris and we announced

our new product is Ledger Atom.

We wanted to fix the following problem.

We wanted to have the user experience

that you have on the Android-based device

with the security of the Ledger device.

And we merged those two things

in the same device.

So if I, you know, a lot of people

might hear this and they already have

a Pixel or they have a Samsung device.

What is the difference between

the security that's typically found

in a Ledger device and what's

not in their device?

Yeah.

So if you want to have

a very high level of security,

such as a use case, such as crypto,

you need several different properties.

The first one is to have a secure enclave

where you will be able to generate secrets

with a very high entropy and so on.

The second one also is that the secrets

must stay inside the enclave

when you are doing cryptography.

That means that you need to implement the

cryptography within the secure enclave.

And the last one is the display.

You need to have a way

to trust what is displayed on your screen.

When you are using a Google Pixel,

there are secure elements inside,

but there is a first problem.

The first problem is that we

are not allowed to load our own

operating system and cryptography

inside the secure element.

You can use a StrongBox,

for instance, on Android.

What it will do is simply wrapping

your keys, but as soon as you need

to sign a transaction, you will need

to ask StrongBox to give you your keys

and then compute the signature

in the rich OS side of things.

So that means that your keys are exposed

to any software attacks.

And there was another issue,

which is the display.

Because, for instance, you might think

about this kind of attack where you think

you are about to sign a transaction

that is like sending 0.1 Bitcoin

to your friend, while under the hood, this

is another transaction that is signed.

As you don't have a strong

link between what is displayed

and what is actually happening,

then you cannot trust your display.

So this is the two main things

that are missing today

on the current Android-based architecture,

and this is what we are solving

with Ledger Atom.

So with the screen,

kind of just to summarize that,

what you're saying is that there's pieces

of malware, so if someone gets infected,

the malware can essentially trick.

It'll still show the send transaction,

don't send transaction,

or install this software, don't install

this software, but it pretty much changes

what it looks like someone is doing.

Exactly.

Got it.

And so when that happens,

when I looked at the demo device,

there was a bar on the top.

It's like this little ledger bar

that says it's secure.

Is that when that feature is activated?

Yeah, exactly.

So you have these two worlds

that are running in parallel.

You have Android that is displaying

the Android application, and you have

the secure zone that is displaying

the secure world, as if it would

be like an individual independent device.

And then you have this secure bar

at the top of the screen

that indicates what is displayed.

Is it the secure world

or is it the Android world?

Otherwise, you might imagine a malware

that makes you think

that you are in the secure zone.

So that's why there was this secure bar

that indicates if it's Android

that is actually displayed

or if it's the secure zone.

Got it.

And so something on stage that you were

talking about and many other people

as well that we're presenting

this device is that there seems

to be kind of two issues, right?

There's convenience and the typical

smartphone device that a lot

of people carry in their pockets.

It does a million things.

It has access to their whole life.

And then you have things

that are very focused on high security,

like a hardware wallet, like many of the

previous devices you guys have launched.

And the goal with this device

is to bring those a bit closer together.

Now, a lot of our audience I know is more

on the, like they want a smartphone that's

more private and secure and or open source

and that's kind of what they're targeting.

So it was very clear though,

and you even said to set expectations,

that this is coming more from

that security perspective first and then

you're trying to build that in later.

Is that kind of a correct way

to phrase how you guys are handling this?

No, this is a correct way to present it.

However, privacy is also something

that is very important for us.

On the Android porting,

we are putting a specific attention

to privacy, for instance.

We won't go as far as GrapheneOS,

for instance, but we are taking plenty

of ideas from Graphene that will

be inside the porting of Android.

On top of this, we also

have a privacy switch.

This switch is able to cut directly

the access of the microphone

and the camera to the power line.

That means that when you switch it off,

like in hardware, it's switched off.

And we have this kind

of small privacy features.

Nice.

And so let's say I use, like I love

to use Signal, ProtonMail, a VPN.

It sounded like there's almost a new

platform or a new way, potentially

in the future, for apps to be able

to use that secure element of the phone.

By default, they probably don't or won't,

but apps can choose to use that.

Is that correct?

Yeah, exactly.

This is totally correct.

On the secure element,

we have our operating system that provides

plenty of cryptographic primitives.

And it's possible to anyone to load

its own application on the secure element.

On the Android side, so if you think

about Signal, so Signal is great.

It does like end-to-end encryption

from you to me so that if anyone is trying

to spy the communication,

like everything is encrypted,

it cannot deduce any information.

However, if I have a malware on my phone,

whenever I read my Signal message,

the malware is able

to read my conversation.

And by the way, that's

not science fiction.

There are Pegasus and all the software

that are doing this.

And unfortunately,

those attacks cost even less now with AI.

So what we could do is to do a porting

of the Signal so that the message is

actually decrypted within the secure zone.

So as soon as you receive a message,

you could click on the message, it would

switch automatically to the secure zone,

and then the message would be decrypted

and displayed by the secure world.

So this is a part of the primitives.

We don't do the porting of signal,

but technically it's possible.

Yeah, that's very cool.

I mean, I think the way

that it was presented on stage

was end-to-end encrypted to the element.

So like theoretically,

if two people have like a ledger phone,

they're both using Signal.

And theoretically, if there's a Signal

that goes down to the secure element,

even malware installed on both people's

devices wouldn't be able to access,

which is a pretty impressive thing.

Because even Meredith is very public

about the fact that Signal doesn't

really target endpoint security.

It's something that users kind

of have to handle.

Exactly.

Very cool.

So in the future,

do you hope to prioritize

more of that like consumer market?

or is this always something

that you guys see as a niche product

for high security individuals?

I think security

and privacy shouldn't be a niche.

I think everyone is becoming

very aware that, especially with AI,

that the stakes become really higher

when it comes to security.

So the retail market is our first market

and I think it's not a niche

and I think the needs

for security are growing over time.

So I think that there

will be a big success for this product.

Crypto is definitely an important use case

because this is a use case where security

is so paramount, but security is important

for many different use cases.

Messaging is one of them.

At the end, we are creating

like a security platform.

It's a technology platform.

So targeting a go-to-market

that would be more enterprise-focused

or government-focused is totally possible.

It's more about creating the go-to-market

and getting the certification,

for instance, if you target government

and this kind of thing.

This is a part of the thing that we have

in mind, but we are definitely starting

with the retail.

Very nice.

And I know it's really bad timing with all

these things because in the last few days,

there's been that implant attack where

people were reading the screens and kind

of getting around the secure enclave.

But you guys mentioned on stage

that you're planning to pretty much extend

the protections of the device so that even

if someone tries to tamper with the screen

or get into the device at all,

it would still trigger.

What does that look like?

Let's say I'm an attacker.

I intercept this phone

as it's being shipped out.

I try to get in and let's say

I somehow got in and changed something

and then I got it to the person's door.

What would actually happen

to that person now?

So for this kind of attack,

there are like two main ways.

Either you make your device

so simple that anyone can verify

that it's the one that is expected.

So our current devices can be opened

and so on, so you can inspect.

And the second solution is to create

a solution that is robust enough

so that if someone is trying to probe,

modify or anything, it would be detected.

And for Atom, we went through

that route and we worked

for months because the problem

of this solution, of this path,

is that it's much more difficult.

Creating a solution that is robust enough

so that a very motivated attacker,

that like a large criminal organization,

wouldn't be able to break,

that's something that is not easy.

So we worked during months with the Donjon

team that is doing offensive security

and the the hardware team

that was designing this shield in order

to make it robust and resistant.

So we also filed patent

because we did plenty of innovation.

And the idea is to create an active shield

so that if ever you are trying

to move the shield, it would be detected

directly and send a bit directly

to the secure element explaining

that the shield was removed.

And also there was a mesh

circuit that is active.

And if you're trying to drill

into this shield, the circuit is sending

a signal every few microseconds.

And you have like a monitor

that are verifying that the signal arrives

at the right time and so on.

So if you drill into this, like you

would break the circuit and it

would be detected directly.

So that means there is also like a small

cell in order to have battery,

even if the big battery is drained.

So this is all that we have built.

It's much more complicated than this, but

in the main line, this is how it works.

Very cool.

And you teased very briefly

that you're going to retroactively apply

that to your current products as well.

What does that process look like?

That won't be the exact same mechanism

because it completely depends

on the design and so on.

And we won't take the millions of devices

that we created to put this inside

and that wouldn't fit, by the way.

So that won't be the same techniques.

So what we are doing is mostly two things.

So first of all,

strengthening the supply chain security.

So on the manufacturing,

on our supply facility, everything

is very well controlled and so on.

When it comes to our authorized reseller,

we will strengthen the requirements

and audits and so on.

So this is the first part

that we are doing.

So it's ongoing and we will continue.

And on the device side, we will add

an additional countermeasure in order

to give higher guarantee to the user

that the device that he receives

was not tampered during the transport.

I won't explain how it works yet

because we are accelerating on this.

We have several different tracks,

and it's not completely settled

which one will be chosen,

but something will happen, yes.

Got it.

Just a couple more questions here.

Post-quantum, I feel like it's shared

a lot, and there's been a few algorithms

now that have been advertised

as post-quantum, and then we found some

pretty severe vulnerabilities in those,

and NIST actually had to roll them back.

So how can we right now

in 2026 confidently say that a device

is post-quantum for the next...

because we don't know when Q-Day happens.

So what kind of confidence do we have

in the post-quantum right now?

So what you refer to is the attack

that happened on Hawk and others,

and they are part of the second wave

of standardization.

We have the first wave of standardization

that have standardized ML-DSA, FN-DSA,

and hash-based cryptography.

And on these three, we have strong

confidence that they are secure.

At the end, you never know because this

is how our asymmetric cryptography works.

It's just a matter of putting all

the cryptographers working on those trying

to break them doing cryptanalysis.

And if after like 30 years,

this is what we are talking

about for lattices,

if after 30 years, like nothing progressed

and the best attack still requires several

times the age of the universe to break it,

then we think it's secure.

So this is how like cryptography works.

And for the ones that are already

standardized, this is where we are.

We never know, especially

with LLM where like mathematical

like research is going so fast.

So we never know, but we think confidently

that these three at least are secure.

For the second wave, it will take a few

more years where cryptographers are trying

to attack each other.

And we need a second wave because

the first wave was very conservative

and we ended up with quantum algorithms

that are producing very large

signatures and so on.

So there are plenty of engineering

trade-offs that are not so good.

So that's why we are trying

to do lightweight, more lightweight

post-quantum cryptography.

This is the second wave.

And at the end, maybe the solution

is crypto agility, meaning that when you

build the system, your system must be able

to be upgraded to another quantum

signature algorithm just in case

the previous one would be broken.

And on our side, we have an operating

system that can be upgraded.

So when we say we are quantum-ready,

that means that we are integrating

the current standardized

post-quantum signature algorithm.

But if they are new to be added,

we can also upgrade our system.

Very cool.

And the last question I have

is just on usability.

I feel like if someone's interested

in the phone, I feel like the main thing

for the regular person to decide,

is this a phone I should buy at all?

Is it a secondary phone

or is it a primary phone?

Is app compatibility?

So I kind of heard that it might be GMS

compatible, but I know a lot of people

might not like the privacy implications

of going with just regular Google

Play services on the device.

So I know it's a bit early

and the device isn't fully decided yet,

but what are your guys' thoughts

on kind of app compatibility

and the different approaches to doing

that with, is it Ledger OS or Atlas OS?

We have a Ledger operating system

on the secure zone, and for the Android

Zone, this is a regular Android,

and we target to obtain GMS.

So for now, we don't have it.

So we cannot say that we are GMS

compatible because we primarily target

the support of every single Android

application rather than the privacy

feature that you have without GMS,

which are more like the tracking provided

by Google that would be removed.

So the trade-off that we've chosen

was more to have like more compatibility

with more apps and so on because

more and more, like the apps,

for instance, like banking apps

and other apps do not run on Graphene

because of the requirements and so on.

So we prefer going to GMS for this reason.

Makes a lot of sense.

Do you have any,

I know it's tough because you want

to make this a high security phone.

Is there any thought or like maybe down

the road you'll allow like unlocking

a bootloader to flash something else

and then relock the bootloader?

Or is that, I know these questions

are very speculative, and just wondering.

So we don't really plan

to unlock the bootloader, but at the end,

the device architecture is such that even

if your Android is fully compromised,

your device is still secure because there

is this independent, autonomous second

world that is in charge of security.

So even in our model,

like your Android is fully compromised.

As long as you verify

that you are on the secure mode

and what you do on your secure mode

is exactly what you want, all the assets

that are in the secure world stay secure.

So this is really the power

of this architecture.

And I won't ever say that the Android

part won't have vulnerabilities.

Plenty of vulnerabilities,

plenty of maybe exploits.

We will do the secure

updates all the time.

But at the end, it doesn't really matter

because the security is on the other side.

Yeah, I mean, I think the way

to put it is if someone doesn't have

that secure side of the operating system,

if malware gets on your phone

and you unlock your password manager,

sometimes you don't have

to unlock your password manager.

All that data is gone, all your messages.

But if someone theoretically

has that element,

they'll never get the actual hard things.

They're not going to get your seeds

from your cryptocurrency wallet.

They're not going to get your password.

So it's a cool system.

I hope it gets adopted

by other phone companies as well.

So I think it's pretty

revolutionary stuff.

So thank you guys for everything.

And thank you, of course, for your time.

I know you guys are crazy busy right now.

Thank you.

Yeah.