I have some security problems to solve, and frankly, don’t even know where to start. I’d appreciate some feedback from the experts here...
Problem 1: Protecting API keys that have rights to withdraw crypto currencies from exchanges.
Problem 2: Protecting private keys for crypto currency wallets hosted on 3rd party servers.
Problem 3: Making code immutable unless multi-signatures are supplied. The code that processes withdrawals.
Problem 4: Making data immutable unless multi-signatures are supplied. The whitelist addresses the code will check against to prevent withdrawals outside of the whitelisted wallets.
The payoff for a hacker that cracks the protection is significant.
Potentials I’m considering:
Putting all code, data & keys in blackbox protected with homomorphic encryption. Code receives the raw params (wallet addresses & amounts). Params are checked against whitelist in the blackbox & signed with API keys in the box.
Whitelist hosted on an immutable blockchain ledger, with code in a homomorphic blackbox.
Whitelist hosted on an immutable ledger. Signing happens in a homomorphic blackbox. Signatures & params sent to an immutable smart contract on a blockchain. Smart contract checks against the whitelist & processes the transfer.
I’m sure these problems have been throughly hashed over already. I have no experience in security, I’m sure some experts here can see all kinds of holes I might be missing.
Any feedback is greatly appreciated.