how do I make users sign different strings with their private key separatelly

Question

Here is the the scenario.

Users come to my website and register(by using email and password). Then they login. After that, They add a new item(which has name and quantity fields). After Clicking submit, What happens is in a front-end or back-end, I generate the same amount of UUID-s that the quantity he specified. For example, if he added a new item ("Toy123", 15), I generate 15 UUID-s on that page. Then what I need to do is this user to sign these UUIDS with his private key. The thing is, I could make all 15 UUIDS into one and let user sign this final one with his private key, But I don't like this option because I need different kind of signatures for each uuids because each uuids means each item and each item is different. So what I need him to do is to sign these uuids seperatelly. I tried metamask, but It's not great, because to sign separatelly, metamask pops up a confirmation dialog for each uuids. Imagine if an user specified 150 uuids, 150 confirmation dialog? Doesn't seem great. That's why I don't want to use metamask. The second option is to ask an user for his private key and then sign each uuids programatically, but if I ask an user his private key, he is gonna be afraid.

I tried to explain the whole situation I'm facing. The question is: What do I do to sign an user's uuids separatelly with his private key without asking his private key? Is it possible with metamask?

Answer 1

You can't. Metamask follows a 1 dialog, 1 signature system for users' security. If you want to perform actions like this, you will need to implement your own signed (web3 has direct support for it), and ask the user to enter the private key. Note that you can do this entirely on the user's device, and the key does not have to be sent to your server.

That said, you could still very will do this with 1 sig/batch. Simply have the user sign a merkle root of the n values. If at any point in the future, the user wishes to transfer/modify/sell just one of those n values, you can produce a new signature on the old merkle root and the transformation taking place at that time. This still allows your user to prove ownership, and to authorize changes, without requiring n sigs to begin with.