I am creating my own wallet as hobby project. I want to avoid using metamask, so idea is to store private key encrypted(AES) on my server, where salt will be my password.

When I enter password and log in to my account, server will send encrypted key back to me which will be stored into local storage or cache. To do transaction I will then have to put password each time, which will decrypt private key from local storage, sign transaction and send signature to network via web3.js.

Another option where user doesn't have to put password each time would be, to log in, private key encrypted would be stored in storage or cache and on callback while storing it would decrypt private key and store it into javascript variable (memory). User would then be able to sign transactions without password prompt. It would lose password on page refresh, but that's the cost.

Now I know cold wallet and metamask is way more secure, but I want to avoid both, to make users life easier, but for me this is research project.

I am interested from security perspective in what cases would this be vulnerable? In case server is breached and someone gets password it can decrypt private key. Ok, this is breach server + somehow get your password. Another options?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.