Best approach to creating a Lite Wallet

Question

We are connecting to our nodes via our own API,  and Multichain PHP library - We have a few thousand addresses running, each connected to a user that is matched on our own DB. This is fine so far as we are managing user balances. Since this will include tens of thousands of customers, I am hoping Multichain will support that. But for users that want to use a Lite Wallet...

Just wanted to check if this is the correct way to create a Lite Wallet using our API:

1. In the app, connect to one of our nodes, send command to createkeypairs to get the private, public and address (we will store that as a hash, combined with a name and password, and store locally on the device. In the app, we will ask the user to back the data up just in case they need to import the privkey again.

2. On entry, the app is connected to one of our nodes, or user can choose their own full node to connect to.

3. The app api will import the address (not privkey) to that connected node, and then send commands (getaddressbalances, listaddresstransactions, gettransaction etc) to get info to show in the Lite Wallet

4. When sending, createrawtransaction, signrawtransaction, sendrawtransaction 

5. When trading with other assets, create offers via createrawexchange etc..and other users can see what is being offered and accept.

Does the above seem ok?..

If a user connects to another node, then our api has to check if address has been imported and then import if not there,... Is there anything else we need to think about?

We are aiming to produce something similar to the Waveswallet.io - we use AngularJS 4 for web, and Fusetools for Mobile. Chain permissions are open except for admin and mining and there is a native currency. 

I am not a programmer, but i have to guide my PHP and API coders on the best approach and they are fairly new to Multichain. Does the above sound about right?..

Answer 1

You should probably have light users generate their own private keys (and corresponding addresses) locally, rather than use createkeypairs on a node, because in the latter case the node has seen the private key.

In addition the signing should take place on the light users' device, so the unsigned transaction must be passed to the light user for signing before being passed back to transmit to the network.

Also consider the fact that under the architecture you propose with these modifications, while full nodes cannot steal a user's funds, the user is still dependent on the individual node it connects to, to get an accurate balance, and help them build transactions correctly. The more secure way to do it is for end users to connect to the network directly, i.e. to multiple peers, using an SPV-style wallet. But this is a lot harder than what you're suggesting.

Comments

I would like to do an SPV wallet, and will do that eventually...this is just a quick way to get something up and running that works..especially in the Philippines. Can you point me to the docs for creation of private keys suitable for Multichain?..I remember seeing something somewhere...

---

First you can use a MultiChain cold node: http://www.multichain.com/developers/cold-nodes-wallets/

Or you can use any bitcoin-compatible library for generating private keys and corresponding addresses. Just make sure your MultiChain chain is set up with bitcoin-compatible addresses.

---

what are the disadvantages to setting up bitcoin-compatible addresses, if any?..Any reason why this is not set as default?..Since my chain is running already, I can't really change it now, maybe that is possible in upcoming version?..So for now, I can just follow the steps as detailed on that page, as to how Multichain private keys and addresses can be created..

---

MultiChain provides for separate address spaces on each blockchain to prevent application-level errors sending a transaction on the wrong chain. Apart from that there's no reason not to use bitcoin-style addresses.

And yes, if you can't change a chain's addressing scheme now, you can just follow the instructions for creating private keys and addresses. The underlying cryptography is identical to bitcoin – just the textual format of the addresses and private keys is different.