How are the private keys generated, and where are they stored?

The key generation process in Tangem Wallet differs depending on whether you create a wallet with or without a seed phrase.

Creating a wallet without a seed phrase:
When you create a wallet without a seed phrase, the private key is generated using a hardware random number generator on the card chip. The entropy for the random number is taken from the chip's physical sensors. This means that each key is unique and truly random.

The main advantage of this method is that the key never leaves the chip in the clear. The chip's main purpose is to ensure the private key's integrity and security.

The hardware random number generator is a component of the Samsung chip. Find the security assessment document here.

Creating a seed-phrase wallet:
When creating a seed-phrase wallet, the Tangem application selects 12 (or 24) random words from a list of 2048 based on the BIP39 seed-phrase standard.

The selected combination of words is converted into a binary seed phrase, which is used to generate a set of private keys and public address pairs. The resulting private keys are downloaded and stored on Tangem cards.

Key Security and Storage:
All methods of creating a wallet work the same way for storing keys. No one can access the keys, whether they stole the card, work for Tangem, or even own it. The private key cannot be removed from the card under any circumstances.