Does it align with the base concept of blockchain, if one stores the hash value generated from IPFS network in a database?

Question

A friend of mine utilized IPFS to store data files regarding some user info.But for an android application of the same, he retrieved all hash values(same user but different files) and stored it in a database.I claimed that the security aspect was disrupted by it(since we use blockchain for security purpose) but he said that it's not the case. Could anyone comment on this?

Answer 1

I don't understand what this means:

he retrieved all hash values(same user but different files)

This is also not clear:

the security aspect was disrupted

"security" can be an overloaded term. It can mean:

1. Availability - your house is still there or insurance buys you a new one.
2. Integrity - it's still your house and the door is still locked. Nothing has changed since you were last there.
3. Confidentiality - no one knows what you keep in your house.

IPFS can be a distributed data store for large objects. S3 can be a data store, as can a USB stick or a database. IPFS and S3 have stronger availability assurances than a USB stick or a database. On the other hand, a USB stick or a database may have stronger confidentiality-oriented properties than IPFS or S3. S3 is centralized and depends on someone paying the invoice. USB sticks and databases depend on the owner not losing them.

A hash on a blockchain can verify existence and lineage of a document or record. A smart contract can hold, for example, 0x123... and a story about where it came from, who signed off - the history. It can answer questions such as "is this legitimate and where it come from?"

A client can hold a document, regardless of where it came from, and compute the hash. It can consult a contract to see if the hash of the document/record it has corresponds to a legitimate document that is known to the contract, or if it is just a made-up claim a.k.a. forgery.

I think you can work for yourself if the proposed architecture aligns with the assurances you want to present to users using the three above-mentioned elements of security.

1. How is availability ensured?

2. How is integrity ensured?

3. How is confidentiality ensured?

It's worth noting that the blockchain is generally very good at the first two but not especially good at the third, owing to transparency. It is often necessary to obfuscate data or store it off-chain to achieve confidentiality assurances.

Hope it helps.