0

We are planning to make a dapp in which we receive the encrypted hash of a file stored on ipfs. We need to decrypt it using our private key stored on the local computer. Is it safe to enter our private key in the front end part of the dapp and put the decrypting logic in the react ?

For the public key ,can we use the ethereum account's public key and decrypt it using the respective private key?

Also safer methods for storing private keys will be helpful

  • Just to make sure I'm understanding - you mean to ask if it's safe to engineer the dApp in a way where the users enter their private key in the front end, and the information stays client-side (as the decryption will be done inside the React logic) - is this correct? – The Renaissance Sep 24 at 13:00
  • Also, is the React app connected to the internet when the private key would be entered? If so, how is it connected? – The Renaissance Sep 24 at 13:05
  • Yes it is connected.Just like password validation happens in front end using js when the app is connected to internet,can the private key be entered in the react app for decryption without sending any data to backend – lahari Sep 24 at 15:56
  • Does that mean the app will run in the browser, or are you bundling it? – The Renaissance Sep 24 at 16:36
  • It runs in browser only – lahari Sep 24 at 16:49
0

Storing a private key in a dapp posits a lot of security challenges and security overheads. You may need to use a strong key encryption scheme to protect it from possible attack vectors. Moreover the private key does not have a logical relationship with the file being hashed.

It may be a better idea to use the concept of zero knowledge proofs and the combination of proving key and verification key instead of the combination of private and public key for this use case.

You can generate the file hash and then generate a proof of custody of file hash using Zero Knowledge Proof tools like Zokrates. The proving key and verification key will be generated for the proof of custody. From this, you can use the prover key in the Dapp while the users are trying to prove their custody of hash.

| improve this answer | |
  • Thank you for your suggestion.But we are not storing private key in the dapp.We are thinking to store it on local machine – lahari Sep 24 at 10:28
0

Browsers can be scary. MyCrypto once allowed users to import an account by entering their private key, but later reversed course. Now you can only do this on their Electron desktop app, which they have hardened and audited.

Here's a quote from their very informative article about this, which I would strongly recommend:

We’re asking the industry to follow us in deprecating support for direct private key access in the browser

In short, your thinking is sound. Theoretically, since everything is happening on the client side, the private key should be safe. But putting a private key in a browser at all opens up new vectors for attacks.

I would not recommend simply bundling as an Electron app either, unless you have considerable knowledge on hardening Electron, though I am not a security expert.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.