1

I am thinking about starting my own product that will be something similar to a wallet. But I want to make sure I make everything as secure as possible so nothing gets leaked and it's not another slope incident. Currently, my idea was to use Fernet encryption to encrypt private keys and store them in my DB. But is there a more secure and better way?

Improve this question
3
  • the most secure way is to NOT store them in your DB ;) - added more details in the answer.
    – Concise Labs
    Commented Sep 28, 2022 at 6:03
  • Are you talking about user private keys or how to best store your organization's private keys like the program update authority, etc? For the latter, cold wallet or multisig with various trusted people in your organization.
    – Whiteseal
    Commented Sep 29, 2022 at 0:48
  • Users @Whiteseal
    – Pixeled
    Commented Sep 29, 2022 at 20:49

2 Answers 2

Reset to default
1

Storing private keys of other users is NOT ideal.

I don't see the need for you to store the keys in a DB (on the server) if you are trying to build a product like a wallet.

for example, Phantom stores it on the users device:

enter image description here

Improve this answer
3
  • This won’t be an app or somewhere where I can store it on their end. Is a database the only way?
    – Pixeled
    Commented Sep 29, 2022 at 20:48
  • I am unable to do anything with the users device nor access any files. Can’t think of many other ways
    – Pixeled
    Commented Sep 29, 2022 at 21:02
  • storing in a DB is one thing, but if you(your app) have to use the private keys to take an action on behalf of the users, the users need to unconditionally TRUST your application to do the right thing. Essentially handover the custody to you, is this a tradeoff you and your users should be comfortable with, no?
    – Concise Labs
    Commented Sep 30, 2022 at 4:56
1

If - for what reason ever - you need to store the users' private keys on your server, then you must include a secure transport from the user to your server in your considerations. The best option is to encrypt the data end-to-end, which means they need to be encrypted on the user's device with a key so only the user can decrypt it, and you should not get knowledge of that encryption key under any circumstances. This makes it impossible for other parties (including) to access the private data.

To accomplish that, you must not use symmetric encryption, but asymmetric or hybrid encryption (the latter uses symmetric encryption for the data, but uses asymmetric encryption for the encryption key itself).

In general, avoid inventing your own stuff, instead check the approaches in proven solutions that already exist (keypass could be one of them).

Improve this answer
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.