Credentialing Platform Frequently Asked Questions

Yes, Block.co is a European company based in Nicosia, Cyprus.

For forgery to be proved, valuable resources and time need to be allocated. Block.co’s solution helps you prevent forgery with blockchain technology, providing a fast and easy validation mechanism without the need for intermediaries.

Any institution, may it be a public one, a local authority, or any private corporation that issues documents for which they wish to have an enhanced level of security and immutability.

We insert the metadata transaction ID and the Merkle proof back to the certificate once the transaction is complete.

The University of Nicosia (UNIC) in Cyprus. In 2014, UNIC became the first university globally to offer a Masters’ degree in Digital Currencies, the first university to accept bitcoin for tuition fees, and the first globally to develop a solution to issue academic certificates on the Blockchain, out of which the company Block.co was spined off.

https://block.co/verify-credentialing

You can see examples of our validators as follows:

University of Nicosia: https://www.unic.ac.cy/verify/

University of Finance and Economics Mongolia: https://www.ufe.edu.mn/English/Default.aspx?page=9067

Ayia Napa Municipality: https://www.ayianapa.org.cy/validator.php

Block.co validators:

https://validator.block.co

https://block.co/verify-credentialing

https://testnet-validator.block.co

Please note that the list is not exhaustive as our technology is Open Source Code.

Copy and paste the transaction id on any public bitcoin/litecoin block explorer to see all the details.

It has proved over the years to be the most secure blockchain.

Proof-of-Work public blockchain security is measured by the processing power (aka hashrate, because it calculates cryptographic hashes) that the network spends on security. Bad actors need to get a majority of the hash rate to attack the network and even so they are limited to what they can do. Bitcoin is the most secure because it has the highest hash rate, so much so that even global companies and state actors cannot really be incentivized to amass that much processing power.

We feel there is not much to gain by using Ethereum blockchain.For more insights regarding our design principles, please read the relevant article on our blog: http://staging-blockco.temp312.kinsta.cloud/design-principles-future-directions/

We managed to create a solution that covers our requirements without needing complex smart contract functionality, which is prone to more attack vectors.

Yes. Our solution just requires storing some data on a public blockchain and thus it is blockchain agnostic.

Being able to make attacks requires significant processing power, or hashrate. Hashrate depends on the specific hashing algorithm used by the network. As long as the network has the highest hashrate for the specific algorithm it is very secure. Bitcoin is the network with the highest hashrate on the SHA-256 algorithm. Litecoin is the network with the highest hashrate on the Scrypt algorithm.

Yes, since our solution is blockchain agnostic. All is needed is to be able to store a small amount of data on that blockchain. However, using a private blockchain limits the solution significantly given that it will only be auditable and transparent for the members of the private blockchain. However, that can also have its uses.

With PDF signatures, one uses the traditional centralized Public Key Infrastructure (PKI). The issuers need to register with a Certificate Authority (CA) that will verify their signature and sign in turn that it is valid. This process is centralized and has several single points of failure that we want to avoid through decentralization. Please see article on our design principles.

A hash function takes an arbitrary size of binary data and produces a fixed size random sequence of bytes, call a hash (or hash value or digital fingerprint or digest). This is a one-way process and there is no way to get back to the data from the hash value. Even the smallest modification to the original data would produce a completely different hash value which is impossible to relate with any other hash value.

In public key or asymmetric cryptography, a key-pair is two keys that are mathematically related. One is called public key and the other private (or secret) key. The mathematical relation ensures that what one key can do the other key can undo. Only the public key can be shared with others. In practice, this allows two participants to exchange encrypted messages or authenticate messages via digital signatures.

The owner of a private key can sign a message and send both the message and the signature to the recipient. The recipient can use the corresponding public key to ensure that the message was not tampered with.

For efficiency reasons we typically sign the cryptographic hash of a digital file. The hash uniquely represents the file and is faster to sign.

PKI uses public key cryptography to allow for secure message exchange between participants online. More importantly it allows for uniquely identifying users/entities online, i.e., what is the public key of John Smith. John Smith will be validated the same way he would be validated in real life (ID, passport) and a digital certificate that contains John’s public key will be created and disseminated as needed. PKI, effectively tries to solve identity and secure distribution of public keys. Certificate Authorities (CAs) are the entities responsible for creating the digital certificates and are federated for scalability.

Web of Trust tries to solve the same problem as PKI in a decentralized way, i.e., without the Certificate Authorities (CA). To achieve that, it allows users to vouch for other users, e.g. John says that Mary is who she says she is, and that her public key is X. If several people, maybe known in real life, claim that a public key corresponds to Mary then others will be more inclined to trust it. Since there are several such trust connections between the participants, it is called a web of trust.

It uses PKI.

It uses neither (arguably, it uses a Decentralized form of PKI).

Verifiable PDFs (or vPDFs) is the open-source technology that Block.co leverages. VPDFs allow anyone to ensure that a PDF’s integrity is secured by anchoring a hash of that PDF on a public blockchain. Since public blockchains are decentralized and immutable the hash will be tamperproof. Thus, it can be trusted that it was never modified, which allows anyone with the PDF to validate the document by consulting directly with the blockchain (and not necessarily the entity that created the PDF). In addition, we make sure that the identity of the person that created and anchored the PDF document can be validated in a decentralized way by consulting several public online resources that the entity controls.

PKI signature scheme with CAs issuing digital certificates has been in operation for many years. It works, albeit not without issues. There have been several occasions that CAs have been hacked (and in some cases it was even an inside job) so that certificates, and thus all security depending on them, were compromised. I.e. CAs are a central point of failure. vPDFs provide a practical way to ensure that several public online sources are consulted to ensure identification of an entity’s public key thus improving on the centralized nature of CAs. The actual data and signatures are also immutable and tamperproof further improving on trustworthiness.

In addition, the PDF signature mechanism makes use of a feature called Incremental Updates to add signatures which was proved to be prone to several attacks, effectively bypassing the signature. VPDFs use the simpler and more practical solution of hashing the entire document, therefore eliminating this type of attacks.

A bitcoin address is constructed by the public key of a key-pair. It can be thought of as an account in Bitcoin where you can receive funds and send funds from.

From the client’s Bitcoin address which can be seen during validation. All different identity mechanisms used to ensure the client’s identity are also displayed, to a user validating a vPDF document.

We currently make use of three methods although more can be easily added according to the clients’ requirements. First, a domain name verification is used where our client proves ownership of a domain name that they are using. Second, Block.co provides a verification service that can also be used. And finally, a GitHub verification method can be used where the client uses their GitHub account to prove ownership of their identity.

Although, each one of the identity verification methods above are centralized, when used in conjunction ensure that there is no centralized point of failure.

We are issuing/anchoring/storing the cryptographic hash of the digital document. This is an over-simplification that we use for the purpose of this Q&A. In reality more data are stored based on a meta-protocol that has been constructed to allow for additional functionality like timestamping, batching, etc.

A vPDF contains a blockchain proof in the metadata (the non-visible, machine-readable part of the PDF). The proof can be used to validate the document.

Our vPDFs are self-contained as they include the blockchain proof within the document itself. They are self-verifiable because you do not need any software download to verify its authenticity, just drag’n’drop on an open-source validator that anyone can host.

We add the PDF metadata in a deterministic way which allows us to remove them without influencing the integrity of the remaining document.

We add additional transactions that can invalidate previous transactions according to the meta-protocol that we have designed and implemented.