3
  • Method for signup and login should not be cumbersome; ie: simple as normal methods of username/password or facebook and google oauth.
  • Should not be cumbersome to request user to input seed to login :P

user 1 (credentials)-> seed unique (ABS9...) -> address (SSDBS9...) -> Do the transaction

user 2(credentials) -> seed unique (RBS9...) -> address (TREBS9...) -> Do the transaction

  • 2
    Could you specify the location of the application? Is it a website or a Wallet? What's the purpose? – Tobi MZ Feb 16 '18 at 10:01
1

Your server or somebody else should never ever have access to the unencrypted seed, if not needed. You could connect your app with a centralized server and store a securely encrypted seed-file there.

  1. User visits your website / app
  2. User sees "Connect with Dropbox / Google Drive"
  3. User Login with OAuth @ Dropbox / Google Drive
  4. User sets a secure password at your application
  5. Generate a new seed (cryptographically secure)
  6. Encrypt the seed with the password (see key derivation functions / AES)
  7. Encrypted seed is stored at Dropbox / Google Drive

When you want to store the securely encrypted seed on your own server, you could use Secure Remote Password protocol (SRP) for the authentication. This way you could use the same password for authentication and encryption.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.