I am trying to use Ethereum private and public keys for message encryption like PGP and I found out this npm module on github, https://github.com/pubkey/eth-crypto#encryptwithpublickey, which it lets you get public key from private key, encrypt message with public key, and decrypt message with private key. I am using MetaMask as the web3 interface for my dapp and I am trying make the message encryption works seamlessly. However, I cannot find a way to automatically pass in MetaMask default account's private key to the npm modules rather than manually clicking export private key from MetaMask's extension UI.
3 Answers
The point of Metamask as a product is to never expose the private key to the web applications that the user browses to. In order for you to use that particular tool to encrypt data in a custom way, Metamask as a plugin would need to include a hook to have the web application pass in the data to be encrypted, and have Metamask to the encryption itself.
This is similar to the idea of signing a message; there's an established standard for using a private key to sign a given message, and Metamask provides a hook to allow application developers to send a string to Metamask and have it sign the string and return the signature, never exposing the private key.
The approach you'd probably want to take with your application is not to work with Metamask, but to create a utility that fulfils the same role as Metamask (is an Ethereum wallet in its own right), such that it receives the private keys (or mnemonic phrase) from the user, and then has the keys available to encrypt data for the user.
answered Jul 23, 2018 at 17:48
-
Thank you for the comment, I was thinking about using MetaMask's signing workflow. However, the signing function is pretty limited, which I don't think I can build a PGP like encryption messaging system upon it. You are right, I'll look into building a Ethereum client with encryption system built in. Jul 23, 2018 at 18:11
Your private key shouldn't be automatically sent to any website, that's actually a security feature. Since anyone with your private key would allow to any website that has access to it would also have full access to your ethereum account, that's not only desirable, but i would also recommend to use a different account solely to encrypt and decrypt messages, because if any security issues arise from this or any other site, you would only loose the secrecy of said messages and not your funds or any other functionality associated with your main account.
answered Jul 23, 2018 at 14:58
-
Totally agree with you. What would you recommend me to do for message encryption on ethereum besides using whisper. Jul 23, 2018 at 15:20
You can use Metamask's built-in decrypt functionality.
Check this out: https://betterprogramming.pub/exchanging-encrypted-data-on-blockchain-using-metamask-a2e65a9a896c