Most web apps that accept bitcoin (whether it's an exchange, a gambling site, etc) provide the user with a public address for depositing bitcoins into their account.
How are these web applications storing the private key associated with the deposit address? What is the best practise for the storage of the private keys from a security standpoint? What is the best storage procedure for web developers looking to create large quantities of key pairs for their web applications?
If you only need receiving addresses, then you need only a table for those along with a column that flags to prevent it from from being used a second time.
Keys can be generated in bulk: - http://bitcointalk.org/index.php?topic=101708.0
Now just because you aren't saving the private key on the web host doesn't mean security can be lax. If a host were compromised, the attacker could replace the Bitcoin addresses in the table with addresses under the control of the attacker.
For situations where the Bitcoin client needs to send transactions, a cold wallet / hot wallet method will help lessen the damage should the system become compromised.
Here's additional information for Securing online services:
Generally, the public keys are generated from a public generator and the private keys are generated from the corresponding private generator, stored on a highly-secure machine. No communication is permitted to the machine holding the private generator.
You do have to know that Bitcoin keys can be generated by generators. The public generator generates a series of public keys and addresses while the corresponding private generator generates the corresponding series of private keys. There is no way to determine the private generator given the public generator.
The flow goes like this:
A new public address is needed.
The next public address is assigned, using the public generator.
The machine holding the private generator is already watching every payment and will detect any payment to a key generatable from its private generator.
When a deposit is made, the private generator machine detects the deposit and issues a transaction to transfer the funds to an appropriate hot or cold wallet. (Or waits until the hot wallet is low, or whatever it's programmed to do.)
The regular machine also notices the deposit (because it knows the public keys) and credits the user.
The math is (oversimplified!):
Private generator: P (a random 256-bit number)
Public generator: GxP (P times the generator constant, an EC point)
Account ID: I (an incrementing number)
Account public key: GxHash(I) + GxP (EC point)
Account private key: P+Hash(I) (256-bit number)
This works because Gx(P + Hash(i)) = GxHash(I) + GxP
So the account private key is the private key corresponding to the account public key. The account public key can be generated from the account ID and the public generator. The account private key can be generated from the account ID and the private generator. No private keys can be generated without the private generator.
