1
$\begingroup$

I’m new to development using web3 technologies and I have a use case where I want to store private data about the user in the public blockchain Polygon.

This data should be recorded to be tamper proof and indisputable, however I also want to protect users privacy. This is why I came up with an hybrid solution I will discuss later. The user will then be able to decide which third party will have access to this data, and this third party should be able to certify the data is the one recorded in the blockchain. I came up with a solution, which I would like to challenge to get your wise opinion 🙇

My backend will have a public/private key pair, and I will store the private keypair securely off-network.
The data from the user will be encrypted using the public key and then stored on-chain with a simple smart contract. I will also publish publicly how the data is combined and which algorithm is used to get ciphertext.
The plain data is also stored in a private database with as much security as I will been able to setup.
Whenever a user will share the data with a third party, my backend will then generate agian ciphertext, and also encrypt the axact same data with the third party public key.
Both ciphertexts will be sent to another smart contract which will emit an event. The third party will be able to listen this event and certify the data is correct by decrypting it with its private key, encrypting it using my public key and then comparing to the on-chain stored data.
The user (if he is a kind of a nerd) will also be able to certify the data, because he knows it. He can simply use the public encryption method to compare with on-chain stored data, and third party sent data.

What do you think about this ? I’m open to any suggestion

PS 1: The weakness is the database, which is a single point of failure. However I compared many web3 solutions and according to me none of them is mature or powerfull enough, nor protect the data from being public. I’m planning however to setup a distributed private database. I’m still open to suggestions though 😛

PS2: If it happen that the data is corrupted or deleted in the database with an attack, I will be able to reconstruct it using the off-network store private key.

Improve this question
$\endgroup$
3
  • $\begingroup$ What is your actual goal? Storing sensitive data in a blockchain in general is a bad idea, even if encrypted: When the key leaks, that data is public. Forever, and no one can change it $\endgroup$
    – tylo
    Jul 8, 2022 at 19:39
  • $\begingroup$ @tylo my goal is to keep the data private while having it recorded permanently in a proovable way. Blockchain is perfect for the “proovable” part but not privacy. Your comment is right, what would you have done to avoid this problem ? $\endgroup$
    – Jeff
    Jul 11, 2022 at 7:49
  • $\begingroup$ Tbh.. first think about what you want to achieve, and then realize blockchain is not the right tool. It never is, unless the goal is to burn a lot of energy. $\endgroup$
    – tylo
    Jul 12, 2022 at 2:46

1 Answer 1

Reset to default
1
$\begingroup$

First of all, I haven't exactly understood what is your goal and I think this is more of a system design question. Anyways, from my understanding is that you are trying to create a secure and verifiable data sharing service. Some notes on your thoughts :

  • On most blockchains, Ethereum for example storing a byte on chain is insanely expensive (see here for example) , this is why other blockchain architectures have been developed, like Filecoin for example, but this specifically is for storing large amount of data. If I remember correctly the minimum amount is about 32gb of data.
  • I think if we tried to prove the security of your construction, if we considered that no information about the data is saved on the client side except some way to access them (a URL for example) then we would need to consider, which breaks the whole point of your system and Web3 in general. On the other hand if we decided to allow some information for example a hash of the data to be stored on the client then, simple outsourced end to end encryption and then the client sending a hash of the data would work without the need of Web3, or with Web3 related technologies only as a backup of the real data.

Let me hear your opinion about my thoughts in the comments.

In general, when someone tells me he wants to create a new super/fantastic/whatever application instrumenting Web3 and how this will change the world I ask the following:

  1. Are you sure this cannot be done without Web3?
  2. Are you sure this cannot be done without Web3?
  3. What exactly Web3 brings to your solution that other wise cannot be provided?
  4. Are you sure you want to sacrifice a disproportionate amount of usability for "security" in your application?
Improve this answer
$\endgroup$
3
  • 2
    $\begingroup$ Come on, web3 is doing just great! $\endgroup$
    – fgrieu ♦
    Jul 10, 2022 at 14:39
  • $\begingroup$ @fgrieu 🤣🤣🤣🤣🤣 $\endgroup$
    – JAAAY
    Jul 10, 2022 at 15:30
  • $\begingroup$ Thanks @JAAAY, you are right I don’t plan to store large amount of data on-chain, images and so will be hosted using IPFS services and this is also why I plan to use Polygon which is a sidechain. Regarding your second thought, I want to use blockchain technology to record permanently the data in a proovable way (this part is crucial). This is the only feature of the blockchain really interesting me. $\endgroup$
    – Jeff
    Jul 11, 2022 at 7:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.