<p>If you want to add security to this setup, you might want to consider using a multi signature setup. Say, for example, a 3 out of 5 signatures are needed. Then an adversary needs to retrieve at least 3 keys to break the security of the minting policy. If you keep the keys on different machines, it's harder to break the security.</p>
<p>In addition, another excellent way is to use a hardware wallet for signing. This keeps the signing keys offline and never loads them on a computer.</p>
<p>It all a question about how far you want to go with security and how good do you implement the security.</p>
<p>In general, when you have signing keys on your machine, always store them encrypted with, for example, GnuPG. In this case, even if the machine is compromised the keys might not.</p>
<p>What kind of logic is necessary for a user to get access to such a platform? If this is paying you an x amount of ada this can be implemented with plutus scripts, this adds another layer of security.</p>

CC BY-SA 4.0
2022-07-13T21:25:45.940Z
Thanks for your answer. It is pretty clear to me so I marked it as accepted. I understand that the best way to store keys when they need to be in a server is with encryption. What I don't get about this approach is that, to encrypt something, you need a phrase or password, right? So, to decrypt the key, you'll need access to this phrase or password. What happens then with the security of this information? What should I do?
Falcon Stakepool
CC BY-SA 4.0
2022-07-14T06:41:29.767Z
Good question, in general, this password is in your head and is only used when you want to sign a transaction with the signing key. You use a GnuPG command that temporarily unencrypted the skey file with your password.
Fermat
CC BY-SA 4.0
2022-07-13T06:48:51.550Z
2022-07-13T06:48:51.550Z
Fermat
<p>I want to create a collection of NFTs with unlimited supply. This way one NFT gets minted every time someone buys one. I don't need a limited supply because I want these NFTs to work as a &quot;member ID&quot; for a particular platform (I don't want a limited amount of users).</p>
<p>I understand that the minting policy will be unlocked for eternity.</p>
<p>What I am wondering right now is what happens with the security of the keys in this particular case: with locked minting policy NFTs this is not a risk, because if a malicious actor gets access to those keys, he/she won't be able to mint or burn any token.</p>
<p>What happens in this case? How can I assure a decent level of security if I want to build a server that will manage the minting of these member NFTs?</p>
<p>I think that this question can also be related to this other one, that hasn't received an answer yet: <a href="https://cardano.stackexchange.com/questions/8231/what-is-the-best-and-most-secure-way-to-store-private-keys-in-an-express-serve">What is the best (and most secure) way to store private keys in an Express server?</a></p>

<nft><minting><policy>
Unlocked NFT minting policy
# Unlocked NFT minting policy

(Asked by: username_0 on 2022-07-13)

I want to create a collection of NFTs with unlimited supply. This way one NFT gets minted every time someone buys one. I don't need a limited supply because I want these NFTs to work as a "member ID" for a particular platform (I don't want a limited amount of users).

I understand that the minting policy will be unlocked for eternity.

What I am wondering right now is what happens with the security of the keys in this particular case: with locked minting policy NFTs this is not a risk, because if a malicious actor gets access to those keys, he/she won't be able to mint or burn any token.

What happens in this case? How can I assure a decent level of security if I want to build a server that will manage the minting of these member NFTs?

I think that this question can also be related to this other one, that hasn't received an answer yet: [What is the best (and most secure) way to store private keys in an Express server?](https://cardano.stackexchange.com/questions/8231/what-is-the-best-and-most-secure-way-to-store-private-keys-in-an-express-serve)

**Tags:** nft, minting, policy

---

## 1 answers

### Answer by username_1 on 2022-07-13. Score: 2 | Accepted answer

If you want to add security to this setup, you might want to consider using a multi signature setup. Say, for example, a 3 out of 5 signatures are needed. Then an adversary needs to retrieve at least 3 keys to break the security of the minting policy. If you keep the keys on different machines, it's harder to break the security.

In addition, another excellent way is to use a hardware wallet for signing. This keeps the signing keys offline and never loads them on a computer.

It all a question about how far you want to go with security and how good do you implement the security.

In general, when you have signing keys on your machine, always store them encrypted with, for example, GnuPG. In this case, even if the machine is compromised the keys might not.

What kind of logic is necessary for a user to get access to such a platform? If this is paying you an x amount of ada this can be implemented with plutus scripts, this adds another layer of security.

> **Comments:**
> **username_0**: Thanks for your answer. It is pretty clear to me so I marked it as accepted. I understand that the best way to store keys when they need to be in a server is with encryption. What I don't get about this approach is that, to encrypt something, you need a phrase or password, right? So, to decrypt the key, you'll need access to this phrase or password. What happens then with the security of this information? What should I do?  
> **username_1**: Good question, in general, this password is in your head and is only used when you want to sign a transaction with the signing key. You use a GnuPG command that temporarily unencrypted the skey file with your password.  

---

