Supposedly, we have a decentralized app with two roles: the deployer of the smart contract (the admin) and others (participant). In order to "play the game" (do some actions in the app), admin has to verify participants first based on some data they provide. Some of it must be public, some of it must not. To exemplify better, we have the following Solidity code snippet.
// Solidity code
struct Participant{
address participantAddress; // visible to everyone
string name; // should be visible only by admin
string SSN; // social security number-like info, should be visible only by admin
uint team; // the "team" of the participants, visible to everyone
bool hasBeenVerifiedByAdmin; // should be visible to everyone
bool hasPlayed; //should be visible to everyone. Can play only after being verified by admin from the GUI of the app
}
mapping(address=>Participant) public participantsList; //a list of participants
I predict some of you will say that if I don't want private data out in the open, perhaps you should not store it in a smart contract in the first place. But if that's the case, for the sake of the current design, let's assume this is necessary.
The question is, then, how should I handle this?
My ideas were about end to end encryption, since Solidity has no encryption capabilities on its own.
- At first, every participant should encrypt his sensitive data with admin's public key, so only he can decrypt it. However, as far as I know, the keys used in Ethereum/Blockchain are ECDSA keys and ECDSA is a signing algorithm, not an encryption one.
- Set up a server for encryption purposes. However, I have no idea how keys should be distributed to participants and admin (who can only be identified after their public Ethereum address) or which algorithm to use.
It is impossible to store private data on-chain. Even using the
private
modifier still allows miners to view the data stored in the struct.The only way this is possible is to provide the owner's Ethereum account's public key as a public property of the contract. Then, the relevant data can be encrypted using that public key, and be decrypted using the owner's private key.
I wouldn't use Ethereum for this anyway. Since this is a fully centralized application, you're better off hosting it yourself.