-
-
Overview
-
Welcome to Gradecoin!
-
Blockchains are incredibly simple yet can appear very complicated, we will see how they work and practice programming production cryptography code.
-
This server is the sandbox for the PA1, it's currently running the Gradecoin application. Gradecoin is the faux currency we will use to simulate a blockchain network. At the end of the simulation, the amount of Gradecoin you hold will be your PA1 grade.
-
A quick summary: authenticate yourself to the system using public key encryption.
-Craft Transaction proposals and tag them using JWTs.
-When there are enough transactions then you can propose Blocks in the same way.
-Blocks need to be mined beforehand using Proof-of-work, or brute force.
-
Gradecoin offers 3 endpoints at /register, /block and /transaction. You can only send GET requests to /block and /transaction without authorization.
-The server is programmed in RESTful architecture, there are no DELETE, PUT or UPDATE operations, though.
-
Gradecoin uses a Proof-of-work block accepting mechanism. It uses single round Blake2s hashing which produces 256-bit (64 hexadecimal characters) output. The target hash is 24 bits or 6 hexadecimal characters of 0. During testing, I could mine a block on average around 2-7 minutes.
-
-We're expecting you to use existing tools and implementations. Standards are hard. Don't roll your own crypto. Feel free to ask questions. Collaborate.
-
-
You might ask,
-
-But if nobody has any Gradecoin then how do we have transactions?
-
-
There is a bank! Their public key is 31415926535897932384626433832795028841971693993751058209749445923 and they have some amount of Gradecoin preloaded. It's also the only account that you can send transactions requests to yourself.
-
Coinbase
-
The first transactions of a block is called the coinbase. They are the author of the block proposal and if the block is accepted then they get compensated for their efforts with some Gradecoin.
-
Public Key Signatures
-
Gradecoin uses 2048 bit RSA keyspairs.
-
Services
-
/register
-
-- Student creates their own 2048 bit RSA
keypair
-- Downloads
Gradecoin's Public Key from Moodle
-- Encrypts their JSON wrapped
Public Key, Student ID and one time passwd using Gradecoin's Public Key
-- Their public key is now in our database and can be used to sign their JWT's during requests
-
-
/transaction
-
-- You can offer a Transaction - POST request
-
-- The request should have
Authorization
-- The request header should be signed by the Public Key of the
by field in the transaction
-
-
-- fetch the list of
Transactions - GET request
-
-
/block
-
-- offer a [
schema::Block] - POST request
-
-- The request should have
Authorization
-- The [
schema::Block::transaction_list] of the block should be a subset of [schema::Db::pending_transactions]
-
-
-- fetch the last accepted [
schema::Block] - GET request
-
-
Authorization: The request header should have Bearer JWT.Token signed with Student Public Key
-
Questions
-
This all sound complicated!
-
-- I've drawn inspiration from actual Bitcoin transactions and warp. The simplicity of the system is how little interfaces it has.
-- Don't know where to start? Gradecoin uses RESTful API; simple
curl commands or even your browser will work! This website can help as well.
-- JWT Debugger and the corresponding RFC
-- Remember that you are absolutely encouraged to grab off-the-shelf implementations for every cryptography primitive you will use. You can start by finding a code snippet to generate a RSA keypair?
-
-
I found a bug!
-
Thank you! Please let me know so we can solve it.
-
I hacked the server!
-
That wasn't supposed to happen :( I did not place any intentional vulnerabilities to the system so if you cracked something, it was not intended. Please don't abuse it and let me know so I can patch it.
-
Submission?
-
At the end of the simulation, your Gradecoin balance will be your grade. I will also expect a unique client programmed in either;
-
-- c
-- c++
-- perl
-- rust
-- python
-- random assortment of bash scripts
-
-
If your favourite programming language is missing please let me know 🤷?
-
Can my friends play?
-
Sadly, no. Student's who are enrolled to the class will receive one-time-passwords for authentication.
-
How and or Why?
-
-
-
-
- Gradecoin
-