We're building an application which will leverage blockchain for financial transaction within itself.

We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) will manage keys for their users. We are building a white-label platform and need to provide key-management as a solution.

We don't want to develop the key management system ourselves.

The needs of the system:

  • Securely store private keys of users
  • Sign data with private keys within the system (no decrypted keys leaving or entering)
  • Generate new keys
  • Communicate with our backend through an API

We've looked into self-hosted HSM and CloudHSM solutions. Alternatively we would use HashiCorp Vault or Amazon Secrets Management.

What are the best practices?

1 Answer 1


When it comes to private keys or secrets that are critical such as in the case of cryptocurrency where if you loose the private key the funds are gone forever, always rely on hardware, less on software and never on cloud. You can use cloud resources for other things, but never give your critical assets if their loss means you're out of business or you'd suffer a huge impact. HSM are probably the best solution at the moment. I wouldn't suggest using Amazon's solutions, I think they're known for not having the greatest security. And you can choose whether to host the HSM by yourself or hold them in third party vaults depending on the amounts. You don't want to risk your well being by holding too much amount and become a risk yourself, but if you handle your assets to third parties, you want to make sure no one from there could get their hands on your assets as well.

  • Thanks for the answer! One issue we have is - we're not sure where to buy HSMs. There is no publicly available pricing and or "buy" anywhere for commercial HSMs Commented Oct 16, 2018 at 9:31
  • In general, many providers for hardware/ software require you to contact them to receive information about pricing or to buy from them, you should look for "Contact us" or something similar on their website and talk with them via email/ phone conversation afterwards.
    – rtsec
    Commented Oct 18, 2018 at 9:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .