I’m new to development using web3 technologies and I have a use case where I want to store private data about the user in the public blockchain Polygon.
This data should be recorded to be tamper proof and indisputable, however I also want to protect users privacy. This is why I came up with an hybrid solution I will discuss later. The user will then be able to decide which third party will have access to this data, and this third party should be able to certify the data is the one recorded in the blockchain. I came up with a solution, which I would like to challenge to get your wise opinion 🙇
My backend will have a public/private key pair, and I will store the private keypair securely off-network.
The data from the user will be encrypted using the public key and then stored on-chain with a simple smart contract. I will also publish publicly how the data is combined and which algorithm is used to get ciphertext.
The plain data is also stored in a private database with as much security as I will been able to setup.
Whenever a user will share the data with a third party, my backend will then generate agian ciphertext, and also encrypt the axact same data with the third party public key.
Both ciphertexts will be sent to another smart contract which will emit an event. The third party will be able to listen this event and certify the data is correct by decrypting it with its private key, encrypting it using my public key and then comparing to the on-chain stored data.
The user (if he is a kind of a nerd) will also be able to certify the data, because he knows it. He can simply use the public encryption method to compare with on-chain stored data, and third party sent data.
What do you think about this ? I’m open to any suggestion
PS 1: The weakness is the database, which is a single point of failure. However I compared many web3 solutions and according to me none of them is mature or powerfull enough, nor protect the data from being public. I’m planning however to setup a distributed private database. I’m still open to suggestions though 😛
PS2: If it happen that the data is corrupted or deleted in the database with an attack, I will be able to reconstruct it using the off-network store private key.