We're building an application which will leverage blockchain for financial transaction within itself.

We won't be forcing users to manage their own keys. Our clients (we're building a B2B platform) will manage keys for their users. We are building a white-label platform and need to provide key-management as a solution.

We don't want to develop the key management system ourselves.

The needs of the system:

  • Securely store private keys of users
  • Sign data with private keys within the system (no decrypted keys leaving or entering)
  • Generate new keys
  • Communicate with our backend through an API

We've looked into self-hosted HSM and CloudHSM solutions. Alternatively we would use HashiCorp Vault or Amazon Secrets Management.

What are the best practices?


When it comes to private keys or secrets that are critical such as in the case of cryptocurrency where if you loose the private key the funds are gone forever, always rely on hardware, less on software and never on cloud. You can use cloud resources for other things, but never give your critical assets if their loss means you're out of business or you'd suffer a huge impact. HSM are probably the best solution at the moment. I wouldn't suggest using Amazon's solutions, I think they're known for not having the greatest security. And you can choose whether to host the HSM by yourself or hold them in third party vaults depending on the amounts. You don't want to risk your well being by holding too much amount and become a risk yourself, but if you handle your assets to third parties, you want to make sure no one from there could get their hands on your assets as well.

  • Thanks for the answer! One issue we have is - we're not sure where to buy HSMs. There is no publicly available pricing and or "buy" anywhere for commercial HSMs Oct 16 '18 at 9:31
  • In general, many providers for hardware/ software require you to contact them to receive information about pricing or to buy from them, you should look for "Contact us" or something similar on their website and talk with them via email/ phone conversation afterwards.
    – rtsec
    Oct 18 '18 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.