0

I want to create a collection of NFTs with unlimited supply. This way one NFT gets minted every time someone buys one. I don't need a limited supply because I want these NFTs to work as a "member ID" for a particular platform (I don't want a limited amount of users).

I understand that the minting policy will be unlocked for eternity.

What I am wondering right now is what happens with the security of the keys in this particular case: with locked minting policy NFTs this is not a risk, because if a malicious actor gets access to those keys, he/she won't be able to mint or burn any token.

What happens in this case? How can I assure a decent level of security if I want to build a server that will manage the minting of these member NFTs?

I think that this question can also be related to this other one, that hasn't received an answer yet: What is the best (and most secure) way to store private keys in an Express server?

Improve this question

1 Answer 1

Reset to default
2

If you want to add security to this setup, you might want to consider using a multi signature setup. Say, for example, a 3 out of 5 signatures are needed. Then an adversary needs to retrieve at least 3 keys to break the security of the minting policy. If you keep the keys on different machines, it's harder to break the security.

In addition, another excellent way is to use a hardware wallet for signing. This keeps the signing keys offline and never loads them on a computer.

It all a question about how far you want to go with security and how good do you implement the security.

In general, when you have signing keys on your machine, always store them encrypted with, for example, GnuPG. In this case, even if the machine is compromised the keys might not.

What kind of logic is necessary for a user to get access to such a platform? If this is paying you an x amount of ada this can be implemented with plutus scripts, this adds another layer of security.

Improve this answer
2
  • Thanks for your answer. It is pretty clear to me so I marked it as accepted. I understand that the best way to store keys when they need to be in a server is with encryption. What I don't get about this approach is that, to encrypt something, you need a phrase or password, right? So, to decrypt the key, you'll need access to this phrase or password. What happens then with the security of this information? What should I do?
    – Falcon Stakepool
    Commented Jul 13, 2022 at 21:25
  • Good question, in general, this password is in your head and is only used when you want to sign a transaction with the signing key. You use a GnuPG command that temporarily unencrypted the skey file with your password.
    – Fermat
    Commented Jul 14, 2022 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.