1

I'm about to work on my first ethereum project.

When a user opens the MySecretApp, they will create a transaction on the ethereum blockchain.

My questions are:

1) Am I sharing the ethereum blockchain (and the billion existing transactions) with other companies? Or can I create a new chain that only contains transactions coming from MySecretApp?

1) How do I verify that a hacker with an app called HackersFakeApp doesn't publish a transaction to my chain? I only want to store transactions that come from my app.

  • Is the transaction created on the user's machine, or on a server that you control? – Jesse Busman Nov 22 '17 at 21:40
  • It would be from a physical device (with wifi) that they buy from me – bigpotato Nov 22 '17 at 22:06
3

One possible setup:

  • Store a private key inside the physical devices. It should be the same for all devices, and only known to you. You should make sure people can't get at it using whatever mechanism your hardware provides.

  • Write the public key of this private key as a constant into your smart contract

  • When creating a transaction, the device uses the private key to sign a message containing the details of the transaction (e.g. method ID, arguments, sender and a sequence number)

  • The device broadcasts the transaction, with the signature as an argument

  • The smart contract re-constructs the message and verifies the signature of the message

At this point you can be certain that only transactions that were sent from one of your devices will successfully execute.

If you have more questions just comment, I will update this answer.

  • 1
    Thanks! Is this a common setup for blockchain with physical devices? Is it safe to have the private key stored on all these devices? I would think that normally the devices would have public keys, and the smart contract would have the private key..? (I'm a total noob, so please correct me if I'm wrong) – bigpotato Nov 22 '17 at 22:31
  • 1
    @Edmund This is a common setup. You should never store secret information in a smart contract, because all smart contract code is publicly visible in the blockchain. Many chips used in the embedded world have a permanent locking mechanism built-in as a hardware feature. After flashing it, you can enable the lock and nobody can read the program memory anymore. You should only give away the private key in locked memory. The device that is verified as being the source of certain information should hold the private key. The code that does the verifying always holds the public key. – Jesse Busman Nov 22 '17 at 22:39
  • 1
    Wow this is great info! I had the wrong idea. So using this setup, would that mean consensus is not necessary? I'm honestly not sure how consensus works... to my knowledge, Ethereum handles that automatically so I don't have to worry about it, so I can just create transactions and code with the assumption that everything is safe / secure. Is this correct? – bigpotato Nov 22 '17 at 22:52
  • 1
    @Edmund Consensus happens automatically inside the Ethereum platform. All you have to do is broadcast a transaction with sufficient fee, and wait until it has been confirmed by being mined into a block (usually within 5 to 40 seconds) and successfully executed. – Jesse Busman Nov 22 '17 at 23:01
  • 1
    You're the best!! Everything is so much clearer now. Thanks so much! – bigpotato Nov 22 '17 at 23:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.