Privacy-aware academic credential verification
A signed academic-credential system that verifies integrity and lifecycle state while keeping student claims out of public lookup.
Project definition
Problem statement
Academic awards need an accessible way to confirm issuer authenticity, record integrity, and current status. A conventional lookup can expose a name, student number, programme, or complete certificate even when the verifier needs only a status decision.
The engineering problem is to combine cryptographic verification with lifecycle state and holder-controlled disclosure while keeping student claims out of the public response.
Project objectives
- Issue synthetic credentials with RFC 8785 canonical JSON and Ed25519 signatures.
- Protect private signing material and holder bundles with AES-256-GCM.
- Allow holders to disclose only selected committed claims.
- Support minimal public lookup, revocation, replacement, and signing-key rotation.
- Measure tamper detection, disclosure size, public leakage, lifecycle decisions, and local verification latency.
Project structure
Project components
Credential issuer
Validates synthetic award input, builds salted claim commitments, signs the canonical payload, and encrypts the private holder bundle.
Cryptographic subsystem
Provides RFC 8785 canonicalisation, Ed25519 signatures, AES-GCM records, and salted SHA-256 commitments.
Public verifier
Checks the stored signature and status by random reference and returns seven registry fields with no student claims.
Selective presentation
Builds and verifies a holder-selected claim subset against the commitments in the signed payload.
Lifecycle service
Rotates signing keys and changes active credentials to revoked or replaced states with an optional successor reference.
Experiment and tests
Runs seven verification conditions per credential and retains trial data, summary metrics, six figures, and automated test evidence.
Methodology
Project workflow
- 01Issue
The API validates synthetic award data, commits each private claim, signs the canonical payload, and returns an encrypted-at-rest holder bundle.
- 02Share the reference
A random public reference or QR URL accompanies the credential without placing student claims in the URL.
- 03Check public status
The verifier checks signature and registry state and receives active, revoked, replaced, invalid, or unknown.
- 04Present selected claims
The holder chooses claims, creates a presentation in the browser, and submits the signed payload and selected disclosures.
- 05Verify the presentation
The service checks the signature, every disclosed commitment, credential registration, and current lifecycle state.
Demonstration scenario
An issuer creates a synthetic engineering degree credential. Public lookup confirms that it is active without showing the student. The holder then discloses only name and qualification, and the commitments verify. An altered name fails. After replacement, the old reference reports the successor while the corrected credential remains active.
Engineering
Tools and method
- Web application
- Nuxt and Vue for reference checks, selective claim presentation, readable status, and an issuer workflow guide.
- Application API
- FastAPI with strict validation, administrator protection, bounded requests, public rate limiting, security headers, and CORS control.
- Data layer
- PostgreSQL for signed commitment records, encrypted holder bundles, signing-key history, lifecycle state, and privacy-safe audit events.
- Cryptography
- Maintained cryptography primitives for Ed25519 and AES-GCM, with RFC 8785 canonical bytes and versioned custom proof metadata.
- Evaluation
- A reproducible synthetic matrix covering complete and selective disclosure, five negative conditions, rotation, revocation, replacement, and response size.
- Delivery
- Container-based setup, security and threat-model records, retained evidence, editable documentation, and explicit production boundaries.
Testing
Evaluation
Evaluation measures
- 100 percent expected outcomes across 280 controlled verification trials
- 100 percent rejection across the five declared malicious conditions
- Zero declared student claim fields in the public response
- Selective presentation size compared with complete disclosure
- Old and new signing-key credentials verified after rotation
- Revoked and replaced credentials rejected after state changes
- Approximately 1.12 ms local p95 verification latency
Project boundaries
- The project uses only synthetic student and institution records.
- The custom proof is inspired by W3C VC concepts but is not a conformant W3C Data Integrity cryptosuite.
- It does not integrate with Aadhaar, DigiLocker, NAD, or a live university student system.
- A valid result verifies a signed digital record and status, not the truth of the award or the identity of the presenter.
- Production deployment requires institutional authentication, hardware-backed key custody, legal review, monitoring, recovery, and external testing.
Included
- 01Credential API and public verification interface
- 02Selective claim presentation builder
- 03Signing, encryption, QR, key rotation, revocation, and replacement modules
- 04Forty-credential, 280-trial controlled experiment
- 05Complete source code in a private GitHub repository
- 06125-page project documentation in PDF and editable Word formats
- 0720-page setup and usage guide
- 0848 annotated references
Project record
No information is collected on this page.
- Permanent project ID
- GP-CS-1BTR0TJ
- Catalogued
- 21 Aug 2026
- Completed
- 24 Aug 2026
- Verified
- 24 Aug 2026
- Demonstration
- Included in repository
Handover
After purchase
- 01Payment is confirmed
The project is marked unavailable and cannot be purchased again.
- 02Repository access is granted
The buyer's submitted GitHub account receives access to the private repository.
- 03The purchase record is delivered
The certification sheet is prepared from the reviewed buyer details and sent privately by email.