I am planning on building a small e-wallet website to learn the basics of encryption and handling accounts, transactions, and balances in Bitcoin.
I want to learn how to make a website where the database does not hold anyone's private data.
What client-side encryption and hashing algorithm should I use? What algorithm or process should I use to ensure that the users encrypted and hashed data is secure on the server?
Using brainwallet, the process for account creation is this:
- The client creates a private key.
- The user enters a username/password
- The client encrypts the private key with a password. The client hashes the password and username. The client sends data to the server.
- The server stores the hashed username/password and encrypted private key to the database.
Now, whenever a user wishes to spend a transaction on my site, I am attempting to use brainwallet to send transactions. The process for this will be:
- The user types in a username and password.
- The client sends a hashed username/password to the server.
- The server responds with an encrypted private key for that user.
- The client decrypts the private key with a password.
As a side note: is this a sound process for storing and transmitting data to the server?