A friend of mine utilized IPFS to store data files regarding some user info.But for an android application of the same, he retrieved all hash values(same user but different files) and stored it in a database.I claimed that the security aspect was disrupted by it(since we use blockchain for security purpose) but he said that it's not the case. Could anyone comment on this?
Does it align with the base concept of blockchain, if one stores the hash value generated from IPFS network in a database?
I don't understand what this means:
he retrieved all hash values(same user but different files)
This is also not clear:
the security aspect was disrupted
"security" can be an overloaded term. It can mean:
- Availability - your house is still there or insurance buys you a new one.
- Integrity - it's still your house and the door is still locked. Nothing has changed since you were last there.
- Confidentiality - no one knows what you keep in your house.
IPFS can be a distributed data store for large objects. S3 can be a data store, as can a USB stick or a database. IPFS and S3 have stronger availability assurances than a USB stick or a database. On the other hand, a USB stick or a database may have stronger confidentiality-oriented properties than IPFS or S3. S3 is centralized and depends on someone paying the invoice. USB sticks and databases depend on the owner not losing them.
A hash on a blockchain can verify existence and lineage of a document or record. A smart contract can hold, for example,
0x123... and a story about where it came from, who signed off - the history. It can answer questions such as "is this legitimate and where it come from?"
A client can hold a document, regardless of where it came from, and compute the hash. It can consult a contract to see if the hash of the document/record it has corresponds to a legitimate document that is known to the contract, or if it is just a made-up claim a.k.a. forgery.
I think you can work for yourself if the proposed architecture aligns with the assurances you want to present to users using the three above-mentioned elements of security.
How is availability ensured?
How is integrity ensured?
How is confidentiality ensured?
It's worth noting that the blockchain is generally very good at the first two but not especially good at the third, owing to transparency. It is often necessary to obfuscate data or store it off-chain to achieve confidentiality assurances.
Hope it helps.
Thanks for the answer. IPFS generates hash values for each file we add into it. In general any blockchain technology is utilized as it's secure and there is no central authority right? But if we could get those hash values from a centralized database then what's the use of adding it to IPFS network? Could you please clarify it?– GeraldJul 24, 2019 at 7:06
1Consider this. Creator creates data => ipfs object. hash => contract. Contract decides if sender is authorized, adds hash. How we have a large object in IPFS that is endorsed by a smart contract. Verifier gets hash from database => reads IPFS doc => requests authentication of hash from smart contract => smart contract returns "true". Can there be any doubt the object data (bitwise) is authentic? One can construct an integrity assurance. IPFS is not yet ready to provide availability assurance. The database would be centralized. What happens if the database is unavailable? Jul 24, 2019 at 13:48
1It won't be possible to give more than a general answer when the question is very general. Jul 24, 2019 at 13:49