Storing an encrypted private key on a server

Question

I am planning on building a small e-wallet website to learn the basics of encryption and handling accounts, transactions, and balances in Bitcoin.

I want to learn how to make a website where the database does not hold anyone's private data.

What client-side encryption and hashing algorithm should I use? What algorithm or process should I use to ensure that the users encrypted and hashed data is secure on the server?

Using brainwallet, the process for account creation is this:

1. The client creates a private key.
2. The user enters a username/password
3. The client encrypts the private key with a password. The client hashes the password and username. The client sends data to the server.
4. The server stores the hashed username/password and encrypted private key to the database.

Now, whenever a user wishes to spend a transaction on my site, I am attempting to use brainwallet to send transactions. The process for this will be:

1. The user types in a username and password.
2. The client sends a hashed username/password to the server.
3. The server responds with an encrypted private key for that user.
4. The client decrypts the private key with a password.

As a side note: is this a sound process for storing and transmitting data to the server?

Answer 1

I am planning on building a small e-wallet website to learn the basics of encryption and handling accounts, transactions, and balances in Bitcoin.

This is really not the place to learn. Even the most hardened Bitcoin services get attacked on a regular basis.

Using brainwallet, the process for account creation is this:

"Brain wallets" are an incredibly easy way for users to lose all of their funds. It happens every day. Think your 8 word sentence is strong enough? Chances are that it's not, and there's at least three bots that will empty the wallet in seconds of it receiving funds.

Now, whenever a user wishes to spend a transaction on my site I am attempting to use brainwallet to send transactions.

The code you're referencing is just a frontend for blockchain.info and the bitcoinjs library.

As a side note: is this a sound process for storing and transmitting data to the server?

Blockchain.info uses this method for it's web wallet, but no, it's very unsafe and offers very little in the way of security. If your server is compromised, the keys still are. If you are malicious, you can just backdoor the client scripting and nobody would ever know. It is not secure, and a service using this type of system shouldn't be advertising itself as such.