2

I wanna to store some personal data as a string to my smart contract with simple store function like a note:

mapping (address => string[]) private addressToNotes;

function store (string memory newNote) external {
   addressToNotes[msg.sender].push(newNote);
}

function getNotes () external view returns(string[] memory) {
return addressToNotes[msg.sender];
}

I tried in some ways but when i call store function, i can see my data (string) in transaction details and it is not secure. what is the secure way to doing this??

1
  • Please accept the answer if it resolved your issue, or comment if you need any further help...
    – prc
    Mar 1, 2023 at 11:49

1 Answer 1

3

That's right, everything in the blockchain is public, so the only way to store information on the blockchain that you don't want everyone to be able to read is by encrypting it before storing. But then not even the smart contract can process it, because if you want the smart contract to be able to decrypt the message, then you would have to store the decryption key in the smart contract, which would then break all the secrecy again.

So if the information can be accessed only from the outside, then store the data encrypted and you're fine!

EDIT: add an example of encryption using node js

const crypto = require('crypto');
 
const algorithm = 'aes-256-cbc';
 
const key = crypto.randomBytes(32);
 
const iv = crypto.randomBytes(16);
 
function encrypt(text) {
    let cipher = crypto.createCipheriv(algorithm, Buffer.from(key), iv);
    let encrypted = cipher.update(text);
    encrypted = Buffer.concat([encrypted, cipher.final()]);
    return { iv: iv.toString('hex'),
    encryptedData: encrypted.toString('hex') };
}
 
var encrypted = encrypt("Hello World!");
console.log("Encrypted Text: " + encrypted.encryptedData);

// Then you can call your contract store() with the encrypted data

8
  • How about combination of keccak256 and encodePacked ?
    – Alireza
    Mar 3, 2023 at 11:36
  • Can you explain how to do that with code?
    – Alireza
    Mar 3, 2023 at 11:36
  • keccak256 is a hashing function, not an encryption function. It can be used to verify that you know the original, by computing it again having the original message, but you cannot revert it back to the message if you do not know it. There is a million ways to do encryption off-chain, so I will share one of the possibilities in an edit of my reply, just as an example...
    – prc
    Mar 3, 2023 at 11:49
  • I mean whoever calls store function should enter a password and then , encrypted string + hashed password , and function will stores this combination of hash and encrypt , then when user calls getNotes function should entered password to decrypt the string, is it possible?
    – Alireza
    Mar 3, 2023 at 12:02
  • That is not advisable because of possible front running attack of the password.
    – prc
    Mar 3, 2023 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.