+ Gradecoin
+ Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod +tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At +vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd +ubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
+ + +
+ Gradecoin
+
+
+curl commands or even your browser will work! This website can help as well.keypairGradecoin's Public Key from MoodlePublic Key, Student ID and one time passwd using Gradecoin's Public KeyAuthorizationby field in the transactionTransactions - GET requestschema::Block] - POST request
+Authorizationschema::Block::transaction_list] of the block should be a subset of [schema::Db::pending_transactions]schema::Block] - GET requestAuthorization: The request header should have Bearer JWT.Token signed with Student Public Key
+ Gradecoin
+ Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod +tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At +vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd +ubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
+ + +
+ Gradecoin
+ POST request to /register endpoint
+Lets a [User] (=student) to authenticate themselves to the system
+This request can be rejected if the payload is malformed (=not authenticated properly) or if
+the [AuthRequest.user_id] of the request is not in the list of users that can hold a Gradecoin account
Gradecoin's Public Key (gradecoin_public_key) is listed on moodle.
Gradecoin's Private Key (gradecoin_private_key) is loaded here
Student picks a short temporary key (k_temp)
Creates a JSON object (auth_plaintext) with their metu_id and public key in base64 (PEM) format (S_PK):
+{
+student_id: "e12345",
+passwd: "15 char secret"
+public_key: "---BEGIN PUBLIC KEY..."
+}
Encrypts the serialized string of auth_plaintext with 128 bit block AES in CBC mode with Pkcs7 padding using the temporary key (k_temp), the result is auth_ciphertext TODO should this be base64'd?
The temporary key student has picked k_temp is encrypted using RSA with OAEP padding scheme
+using sha256 with gradecoin_public_key (TODO base64? same as above), giving us key_ciphertext
The payload JSON object (auth_request) can be JSON serialized now:
+{
+c: "auth_ciphertext"
+key: "key_ciphertext"
+}
gradecoin_private_key as the key and auth_request.key key as the ciphertext, receiving temp_key (this is the temporary key chosen by stutemp_key, we can AES 128 Cbc Pkcs7 decrypt the auth_request.c, giving us
+auth_plaintextauth_plaintext String can be deserialized to [AuthRequest]User] object, insert to users HashMap <fingerprint, User>
+ Gradecoin
+ Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod +tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At +vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd +ubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
+ + +
+
curl commands or even your browser will work! This website can help as well.Blockchains are incredibly simple yet can appear very complicated, we will see how they work and practice programming production cryptography code.
+This server is the sandbox for the PA1, it's currently running the Gradecoin application. Gradecoin is the faux currency we will use to simulate a blockchain network. At the end of the simulation, the amount of Gradecoin you hold will be your PA1 grade.
+A quick summary: authenticate yourself to the system using public key encryption. +Craft Transaction proposals and tag them using JWTs. +When there are enough transactions then you can propose Blocks in the same way. +Blocks need to be mined beforehand using Proof-of-work, or brute force.
+Gradecoin offers 3 endpoints at /register, /block and /transaction. You can only send GET requests to /block and /transaction without authorization.
+The server is programmed in RESTful architecture, there are no DELETE, PUT or UPDATE operations, though.
Gradecoin uses a Proof-of-work block accepting mechanism. It uses single round Blake2s hashing which produces 256-bit (64 hexadecimal characters) output. The target hash is 24 bits or 6 hexadecimal characters of 0. During testing, I could mine a block on average around 2-7 minutes.
+++We're expecting you to use existing tools and implementations. Standards are hard. Don't roll your own crypto. Feel free to ask questions. Collaborate.
+
You might ask,
+++But if nobody has any Gradecoin then how do we have transactions?
+
There is a bank! Their public key is 31415926535897932384626433832795028841971693993751058209749445923 and they have some amount of Gradecoin preloaded. It's also the only account that you can send transactions requests to yourself.
The first transactions of a block is called the coinbase. They are the author of the block proposal and if the block is accepted then they get compensated for their efforts with some Gradecoin.
Gradecoin uses 2048 bit RSA keyspairs.
schema::Block] - GET requestAuthorization: The request header should have Bearer JWT.Token signed with Student Public Key
curl commands or even your browser will work! This website can help as well.Thank you! Please let me know so we can solve it.
+That wasn't supposed to happen :( I did not place any intentional vulnerabilities to the system so if you cracked something, it was not intended. Please don't abuse it and let me know so I can patch it.
+At the end of the simulation, your Gradecoin balance will be your grade. I will also expect a unique client programmed in either;
+If your favourite programming language is missing please let me know 🤷?
+Sadly, no. Student's who are enrolled to the class will receive one-time-passwords for authentication.
+Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod -tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At -vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd -ubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet.
+++JSON Web Tokens are representations of claims, or authorization proofs that fit into the
+Headerof HTTP requests.
JWTs are used as the MAC of operations that require authorization:
+They are send alongside the JSON request body in the Header;
+Authorization: Bearer aaaaaa.bbbbbb.ccccc
+
+Gradecoin uses 3 fields for the JWTs;
+
+{
+"tha": "Hash of the payload, check invididual references",
+"iat": "Issued At, Unix Time",
+"exp": "Expiration Time, epoch"
+}
+
+tha is explained in blocks and transactions documentations.iat when the JWT was created in Unix Time formatexp when the JWT will expire & be rejected in Unix TimeWe are using RS256, RSASSA-PKCS1-v1_5 using SHA-256. The JWTs you encode with your private RSA key will be decoded using the public key you have authenticated with. You can see how the process works here.