Architecture & Security Model
Ledger Live follows a split-trust model: the Ledger hardware device (secure element) is the root of trust, and Ledger Live is a companion app responsible for user experience, network access, and optional third-party integrations. All signing operations occur on-device after explicit user confirmation. Ledger Live verifies firmware versions and checks signatures to protect against tampered firmware or compromised companion apps.
Key architectural components include:
- Secure Element (SE): Secure storage and execution environment for private keys and cryptographic operations.
- Companion App (Ledger Live): Provides UI, network interactions, and plugin integrations while delegating cryptographic operations to the device.
- Local Bridge/RPC: A local service that securely mediates requests between Ledger Live and the device using localhost endpoints or secure IPC channels.