5

Lately I've been thinking about how to integrate Ethereum with other non-Ethereum systems. Would it be a bad idea to import and Ethereum keypair into an external (mobile/desktop) application, which could be used to verify one's Ethereum identity/conduct transactions?

Users would authenticate by using one's private key in response to a generated random challenge (decrypt or sign it), or use the embedded private key to sign Ethereum transactions and send them to some external system.

Would that be in line with the spirit and the general idea of Ethereum and/or pose a security threat to users?

EDIT:

The value of using such an app would be the ability to externally prove the ownership of an Ethereum account. It could be used to prove an ownership of an asset or transaction execution.

It would be possible to integrate smart contracts into existing non-Ethereum systems.

Improve this question
8
  • It sounds like in the spirit of Ethereum. You would generate keys to be used from the mobile device only, give them just enough ether to function.
    – Xavier Leprêtre B9lab
    Sep 9, 2016 at 10:34
  • Another idea is to ask the user to call a contract function you control from his/her wallet with a given random number, you log the event and your server verifies from blockchain exploration that the event occured.
    – Mikko Ohtamaa
    Sep 9, 2016 at 11:08
  • @MikkoOhtamaa but this would require spending Ether right? Wouldn't signing a challange with your private key be sufficient? I'm not sure if such a mechanism couldn't be used to hack the private key.
    – Blady
    Sep 9, 2016 at 11:16
  • @Blady: The only spend you need is to do is to pay the gas for the transaction fee. The benefits of this approach are that it works with any Ethereum wallet offering interaction with smart contract functions - you do not need to extract private key from your wallet for signing or to implement any special purpose signing user interface.
    – Mikko Ohtamaa
    Sep 9, 2016 at 11:22
  • @Blady Such a mechanism cannot be used to hack the private key, as the mechanism is basis of all Ethereum smart contract functionality.
    – Mikko Ohtamaa
    Sep 9, 2016 at 11:23

1 Answer 1

Reset to default
1

Would that be in line with the spirit and the general idea of Ethereum and/or pose a security threat to users?

Cryptographically proving your identity with Ethereum is a use case that has been discussed quite a lot. Signing a pre-defined message, or random challenge as you suggest, could be used somewhat similarly to today's 'signing in with Facebook' that websites offer, but with the benefit that in this case it'd be cryptographically infeasible to forge anyone's credentials.

Would it be a bad idea to import and Ethereum keypair into an external (mobile/desktop) application, which could be used to verify one's Ethereum identity/conduct transactions?

You would have to construct a very, very secure app for people to be comfortable putting their private key into it -- it would be a bad idea to ever store such a key, and the more security conscious would never load their key into an app (or even device) connected to the internet. Hacking your app would just be too attractive a target if any of your users are typing in private keys associated with high value accounts. You may be able to verify identities by having people sign pre-defined messages with their hardware wallets, etc, but networked devices + private keys generally is not a recommended combination.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.