3

For smart-contracts and dApps it is in many cases important to put encrypted data on the blockchain, encrypted with the public key.

I have been searching, but there doesn't seem to be a way to decrypt the data using an extention like metamask through web3.js. If I would want to build a dApp with encrypted data on the blockchain, I could only decrypt it by asking the user to insert his private key every time the app needs to decrypt data. The user needs to copy the private key from the metamask extention, where he needs to insert his password in order to expose it, then proceed to copy it and paste it into the app, so that the app can decrypt the data. This is tiresome for the user and also a huge security flaw.

A much better way (the way it should be done) is where Web3.js has a function to decrypt data, so that the extention can decrypt it there, and return the decrypted data. But this doesn't seem to be possible.

Why haven't they implemented this (yet)? It seems quite important to me in order to build safe dApps and smart-contracts. If there are better ways to do this, I would like to hear it.

1 Answer 1

1

Metamask has implemented eth_decrypt. You can use encrypt from eth-sig-util to perform the encryption.

Unfortunately there isn't much documentation about it. It was discussed on several thread on github like https://github.com/MetaMask/metamask-extension/issues/1190, https://github.com/ethereum/EIPs/pull/1098 and https://github.com/MetaMask/eth-sig-util/pull/18#issuecomment-384796354. There's no EIP that documents the function.

2
  • How do you access the method? I've only used Web3.js, but this is from Metamask itself right? How does that work when a user uses a wallet extension other then Metamask? Mar 22, 2021 at 15:21
  • It is documented in the first link how to use it: Send a request command to the ethereum provider. Clients that do not support it should return an error.
    – Ismael
    Mar 22, 2021 at 16:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.