0

I want to store information on the blockchain, but some part of it is private and must be available to selected clients (for example, users who belong to a common company)

How can this be done?

The only thing that comes to my mind is to encrypt the data. Thus, clients who have a private key will be able to read it. But with this approach, a new problem appears, if one of these clients is hacked and the private key falls into the wrong hands, then all data can be read.

Perhaps some of you can advise on the best options?

Wen Chiang
  • 3
  • 1
  • 4
    "if one of these clients is hacked" -- then anything you do to protect the data is compromised. Until you specify what the risk actually is and what you want to protect against, there is no such thing as "unhackable". Encryption is the solution to this problem. Key management becomes a side issue until the risks are better defined. – schroeder Aug 25 '21 at 13:46
  • If one of the users is a whistleblower and publishes decrypted data...? – usr-local-ΕΨΗΕΛΩΝ Aug 25 '21 at 13:55

1 Answers1

0

Blockchains and secrecy are not best friends.

A blockchain is made for information to be permanent, to last forever. Blockchains and encryption can be used creatively, for example by publishing a piece of encrypted information today (an encrypted book), and releasing the key in the future (releasing the book with proof of writing date).

You can indeed store encrypted information on the blockchain, however you must deal with key management, which is damn of a complex task.

Clients sharing the same private key is nonsense. You would use a symmetric encryption and share the key. When the key is leaked, everyone around the world is able to read the information and verify its authenticity.

You may opt to use an authentication system to mediate. Alice logs in with their corporate credentials to a server that stores the key securely (in hardware) and displays the decrypted information. Alice, who can just read the screen, does not have information to validate the authenticity of the data, but at least trusts the central system that the information comes from the Blockchain. This is a 30.000ft view, because no requirement was specified about authenticity and all possible threat models.

But, in the very beginning, why choosing a blockchain ever for confidential information? We share confidential information with corporate users since decades without the need of blockchain in the beginning.

usr-local-ΕΨΗΕΛΩΝ
  • 5,310
  • 2
  • 17
  • 35