0

I have a big question regarding the security of my system.

Well, what happens.. I developed my contract using ECDSA, that is, it is only possible to do actions in my contract if the transaction is signed with my account.

The problem with this is that the privateKey of my account that I use to encrypt the data needs to be in the web application, because that's where the user performs the action.

My question is that because it is a privateKey in my wallet, the web application keeps it public, in other words, anyone who takes my privateKey will have access to my account.

And here comes the situation that I needed help.

1º How to store my privateKey so that no one can access it? My web application is developed in Vue, and my backend in Node.

or

2nd how would I be able to perform some action to encrypt the data in the backend and return something indecipherable in the front and so the user proceeds with the transaction (confirm the data in the metamask and etc.. )

Improve this question
1
  • Why not use a browser wallet, such as Metamask, which holds the private key?
    – Lauri Peltonen
    Commented Jan 13, 2022 at 11:16

1 Answer 1

Reset to default
0 
I developed my contract using ECDSA

I have no idea what you are trying to say by that and I am certain that you are just expressing yourself wrong here ;)

You wrote a contract using solidity, right?

Let's get back to the original question: Security of private key. As you already stated, you can't keep your private key in the frontend. Anyone would be able to extract it and use it. So that is no an option.

Your first idea sounds good. You can keep your private key in your node backend. The frontend sends a request to the backend, the data/action is signed and a transaction is sent to your Smart Contract.

Unless the user has to use its own MetaMask to sign the transaction. In that case, the backend signs the data, send it back to the user and the user's MetaMask sends the transaction.

Does that help?

Improve this answer
2
  • In this case, the user needs to use Metamask's own wallet to sign the transaction. When I said that I use ECDSA it is the cryptography class in solidity using openzeppelin lib. But you gave an answer in which "backend sign the data and return to the user", the question is how would I do that? Is there a way for me to sign the transaction on the backend and return it to the user on the front to call the Metamask and complete the action? What would an example of this look like?
    – Crazy
    Commented Jan 13, 2022 at 13:09
  • Well, that would be a frontend communicating with a backend and has nothing to do with Ethereum or blockchain. You would need to create a backend service that exposes API endpoints. Your frontend sends data to one of these endpoints, in order to sign the data. The backend service answers with the signed data. Now your frontend is able to request the user to sign a transaction with the data. A package for Nodejs would be express.
    – Donut
    Commented Jan 13, 2022 at 13:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.