Ledger Donjon reads part of Coldcard Mk4's second secure element by double laser fault

In September 2023 Ledger Donjon researchers Karim M. Abdellatif and Olivier Hériveaux published a laser fault-injection attack on the Analog Devices DeepCover DS28C36, which the Coldcard Mk4 uses as its second secure element (SE2). Coinkite addressed the presentation in a post on 7 September 2023; the paper appeared on the IACR ePrint archive on 15 September 2023 and at FDTC 2023.

According to the paper, the chip resists single faults, but the researchers used Welch’s t-test leakage analysis to find two moments at which laser pulses extract the protected EEPROM user pages, with a 99% success rate; they state the attack can be reproduced within a day and that it affects users of the DS28C36, including the Coldcard Mk4. Coinkite says the work required removing and decapping the chip and gave access to about half of SE2’s memory slots.

Coinkite states that no seed was extracted: the Mk4 keeps the master seed in its first secure element, encrypted with a key that requires compromising SE1, SE2 and the main microcontroller, and SE2 holds only part of an AES-256 key plus the trick PIN and duress wallet data. It calls the result a validation of its multi-vendor design and says Ledger and the chip vendor coordinated disclosure with it over several months. Its disclosure history lists the status as partial material exposed, with no complete seed recovery demonstrated and no fix stated.