+
+
Overview
+
Welcome to Gradecoin!
+
Blockchains are incredibly simple yet can appear very complicated, we will see how they work and practice programming production cryptography code.
+
This server is the sandbox for the PA1, it's currently running the Gradecoin application. Gradecoin is the faux currency we will use to simulate a blockchain network. At the end of the simulation, the amount of Gradecoin you hold will be your PA1 grade.
+
A quick summary: authenticate yourself to the system using public key encryption.
+Craft Transaction proposals and tag them using JWTs.
+When there are enough transactions then you can propose Blocks in the same way.
+Blocks need to be mined beforehand using Proof-of-work, or brute force.
+
Gradecoin offers 3 endpoints at /register, /block and /transaction. You can only send GET requests to /block and /transaction without authorization.
+The server is programmed in RESTful architecture, there are no DELETE, PUT or UPDATE operations, though.
+
Gradecoin uses a Proof-of-work block accepting mechanism. It uses single round Blake2s hashing which produces 256-bit (64 hexadecimal characters) output. The target hash is 24 bits or 6 hexadecimal characters of 0. During testing, I could mine a block on average around 2-7 minutes.
+
+We're expecting you to use existing tools and implementations. Standards are hard. Don't roll your own crypto. Feel free to ask questions. Collaborate.
+
+
You might ask,
+
+But if nobody has any Gradecoin then how do we have transactions?
+
+
There is a bank! Their public key is 31415926535897932384626433832795028841971693993751058209749445923 and they have some amount of Gradecoin preloaded. It's also the only account that you can send transactions requests to yourself.
+
Coinbase
+
The first transactions of a block is called the coinbase. They are the author of the block proposal and if the block is accepted then they get compensated for their efforts with some Gradecoin.
+
Public Key Signatures
+
Gradecoin uses 2048 bit RSA keyspairs.
+
Services
+
/register
+
+- Student creates their own 2048 bit RSA
keypair
+- Downloads
Gradecoin's Public Key from Moodle
+- Encrypts their JSON wrapped
Public Key, Student ID and one time passwd using Gradecoin's Public Key
+- Their public key is now in our database and can be used to sign their JWT's during requests
+
+
/transaction
+
+- You can offer a Transaction - POST request
+
+- The request should have
Authorization
+- The request header should be signed by the Public Key of the
by field in the transaction
+
+
+- fetch the list of
Transactions - GET request
+
+
/block
+
+- offer a [
schema::Block] - POST request
+
+- The request should have
Authorization
+- The [
schema::Block::transaction_list] of the block should be a subset of [schema::Db::pending_transactions]
+
+
+- fetch the last accepted [
schema::Block] - GET request
+
+
Authorization: The request header should have Bearer JWT.Token signed with Student Public Key
+
Questions
+
This all sound complicated!
+
+- I've drawn inspiration from actual Bitcoin transactions and warp. The simplicity of the system is how little interfaces it has.
+- Don't know where to start? Gradecoin uses RESTful API; simple
curl commands or even your browser will work! This website can help as well.
+- JWT Debugger and the corresponding RFC
+- Remember that you are absolutely encouraged to grab off-the-shelf implementations for every cryptography primitive you will use. You can start by finding a code snippet to generate a RSA keypair?
+
+
I found a bug!
+
Thank you! Please let me know so we can solve it.
+
I hacked the server!
+
That wasn't supposed to happen :( I did not place any intentional vulnerabilities to the system so if you cracked something, it was not intended. Please don't abuse it and let me know so I can patch it.
+
Submission?
+
At the end of the simulation, your Gradecoin balance will be your grade. I will also expect a unique client programmed in either;
+
+- c
+- c++
+- perl
+- rust
+- python
+- random assortment of bash scripts
+
+
If your favourite programming language is missing please let me know 🤷?
+
Can my friends play?
+
Sadly, no. Student's who are enrolled to the class will receive one-time-passwords for authentication.
+
How and or Why?
+
+
+
+
+ Gradecoin
+