Self-Sovereign Identity Using WalletConnect for Issuing, Verifying, and Revoking Academic Credentials

Abstract

Student data at vocational high schools is managed solely by the schools, so external parties must contact the school to confirm a record, while account access still relies on passwords vulnerable to credential theft. This study implements a Self-Sovereign Identity system for student academic data at SMK Bina Sriwijaya Indonesia Palembang that combines passwordless WalletConnect authentication with credential issuance, verification, and revocation anchored on a public blockchain. Following the Design Science Research Methodology, the artefact was built as a web prototype using React.js, Express.js, and PostgreSQL, connected to MetaMask and to a CredentialRegistry smart contract on Ethereum Sepolia. Users authenticate through an EIP-191 challenge-response signature, student identity is expressed as a did:ethr Decentralized Identifier, and academic data is issued as W3C Verifiable Credentials whose canonicalised Keccak-256 hash and status are recorded on chain, while the complete record remains off chain. Evaluation covered four levels: eighteen black-box functional cases, thirty smart contract unit tests, seventeen backend tests, and fourteen security cases at the authentication and verification boundary, plus gas measurement of every state-changing function on Sepolia. All seventy-nine cases produced the expected output, which demonstrates functional conformance and correct access control rather than a general guarantee of security, since independent penetration testing and a formal contract audit were not performed. Within these limits, a verifier can check authenticity, issuer, and validity independently, without confirmation from the school and without exposing personal data on a public blockchain.

GS Cited Analysis