Exciting update, Ledger has a new product, Ledger Recover, that’s launching soon: https://www.ledger.com/recover
Self-custody is at the core of our offering, and your Secret Recovery Phrase is securely generated on your device. We have no access to it. This will NEVER change. We are uncompromising about security.
Here’s what Ledger Recover is and what it isn’t, explained by our CTO Charles Guillemet and further down below.
Ledger Recover is an optional subscription for users who want a backup of their secret recovery phrase. You don’t have to use it, and can continue managing your recovery phrase yourself if that’s why you bought a Ledger.
This is not automatically enabled by any firmware updates. This is your choice.
For full FAQs:https://support.ledger.com/hc/articles/9579368109597?docs=true
But first and foremost, how is your Secret Recovery Phrase (SRP) generated? Ledger uses the BIP39 standard for the generation of the SRP on all of our devices.
This is generated by the secure element of your device and is ONLY ever shared with you. Never us.
More here: https://support.ledger.com/hc/en-us/articles/4415198323089-How-Ledger-device-generates-24-word-recovery-phrase?docs=true
If you choose to subscribe, Ledger Recover encrypts a version of your private key and splits it into three fragments (using Shamir Secret Sharing) – all of this happens on the Secure Element chip, so your Secret Recovery Phrase is not at risk.
These encrypted fragments are stored by 3 different parties on cryptographically-secure Hardware Security Modules.
Individually, these encrypted fragments are completely useless. When you want to restore your keys, 2 of these 3rd parties will send back their fragments to your Ledger device (and not us as an organization), which will be able to reconstitute your Secret Recovery Phrase.
Decryption can ONLY happen on a Ledger’s Secure Element chip, which has never been compromised. So why did we develop Ledger Recover? To provide full peace of mind to some of our users.
You need to approve the service on your Ledger, otherwise the backup is never created. This is why we have secure hardware and a secure screen – trust your device. There's no backdoor to a backup.
Self-custody remains and will always be the core principle of Ledger. The ethos of self-custody is that it’s your choice – you can choose to manage all your assets yourself, or you can have a backup with Ledger Recover. It’s up to you – and that won’t change.