I am implementing a web application that deals with signing blockchain transactions similar to what all cryptocurrency stock exchange applications are doing. I am wondering how do they store private keys?
When creating a user account an online wallet is created that is public/private key pairs. Suppose that someone gets unauthorized access to the database, how to prevent him/her from stealing the credentials?
Solutions for protecting the password:
- Hashing the password prevents the cracker from seeing the actual text
- Salt the password before hashing prevents the use of rainbow tables or look-up tables.
Private key can't be hashed, we need its actual text.
A suggestion is to symmetrically encrypt the private key before storing in the database with the user's password. But this means that the user needs to decrypt the private on every transaction, which is kinda user unfriendly. I would like to implement something like Poloniex, Coinbase ...