Press F for fullscreen
Preparing…
Decentralized digital verification of university certificates using Hashgraph technology
Universities in Gaza already embed one. It links to a verification page and it settles whether the paper in your hand was forged.
That page, that database, that institution. The whole chain of trust terminates at a single machine one organisation happens to run.
Downtime, compromise, or a department that stops paying the hosting bill — and every certificate ever issued becomes unverifiable.
A lithium-ion battery fire at the National Information Resources Service data centre took down the national mobile identification system with them.
The best-resourced, most professionally managed infrastructure on earth, cascading anyway.
A dependency so widely shared that its failure was indistinguishable, for many users, from the internet itself failing.
A fixed 256-bit digest of the exact bytes of the PDF. Change anything and it stops matching.
The university signs that digest with its private key. Authenticity, and non-repudiation.
Stored by content address, retrievable from any gateway rather than from one host.
Hash, signature and CID written to a distributed ledger. No single operator can revise it.
SHA-256 for integrity, RSA signatures under the university's private key for authenticity, and a tamper-evident record for every certificate issued.
Public checking by QR scan or signature entry, internal search by student or national ID for authorised staff, with a real-time verdict.
A hierarchy of administrator, university staff and public verifier — with secure delegation, and system-level barriers to privilege escalation.
Decentralized storage, working QR codes, and certificates that stay verifiable independent of the issuing institution's operational status.
Creates and revokes staff accounts, manages system settings, reads every audit log, revokes certificates. Strong authentication is the design recommendation for this role.
Uploads student certificates, supplies metadata, requests issuance on the university's behalf, generates QR and verification links, reads their own audit trail.
Unauthenticated. Can check a certificate by signature, CID or QR code. Can modify nothing — the read path needs no account, and is given none.
Size and true file type
SHA-256, read in chunks
The university's private key
IPFS, via Pinata pinning
Hedera Consensus Service
Scan the QR, or paste the signature
Cryptographic validity
Hedera mirror node
IPFS, if the bytes are wanted
crypto.subtle.digest — press Space to alter one character.| Proof-of-work blockchain | Hedera Hashgraph | |
|---|---|---|
| Finality | Probabilistic — wait for confirmations | Deterministic, in seconds |
| Consensus | Mining races | Gossip about gossip, then virtual voting |
| Cost per record | Variable, occasionally absurd | Fixed and predictable |
| Energy | Proportional to security | Negligible |
| Governance | Diffuse | A known council of institutions |
The full certificate lifecycle for the University College of Applied Sciences: a Flutter Web platform for upload, issuance and public verification; a Laravel back-end for authentication, RBAC and orchestration; a Python/FastAPI Core for hashing and signing; a Node.js bridge to Hedera; IPFS storage with proof anchoring; QR and signature verification, plus internal search by student or national ID.
Native iOS and Android applications — the Flutter choice keeps that door open. Dedicated key management (HSM or HashiCorp Vault); the signing key is a mounted PEM file in development. W3C Verifiable Credentials and DIDs. A bulk verification REST API for large institutional use.
Core function depends on Hedera and IPFS remaining available. Outages, protocol changes or fee changes on either would disrupt issuance or verification.
The university's signing key is a locally mounted PEM file on the Core service, so security is partly the hosting environment's access control.
Administrator authentication is JWT with device fingerprinting and a single-session policy — strong, but not multi-factor.
Files stay available only while actively pinned. Content addressing guarantees identity, not permanence.
An HSM or HashiCorp Vault, for isolation, rotation and audit logging of key use. Then multi-factor authentication for administrators.
Compile the existing Flutter codebase to iOS and Android. Adopt W3C Verifiable Credentials and DIDs. Add a bulk verification API for institutional volume.
Testing concentrated on the back-end and front-end. The Core and Hedera Bridge services are the named gap, and the next thing to close.
A certificate should outlive the server that issued it.