AcadVault: A Privacy-First Blockchain Credential Framework Achieving O(1) Batch Issuance via Merkle Tree and SSS-based Distributed Key Recovery

Abstract

A national audit that revealed 10,000 fake credentials among 400,035 public employees demonstrates the severity of the global threat posed by academic credential fraud. Although blockchain-based credential systems provide a promising countermeasure, existing architectures suffer from four persistent shortcomings: (1) credentials stored in plaintext on IPFS expose personally identifiable information (PII) to anyone who obtains the content identifier (CID); (2) batch issuance entails N independent transactions with O(N) cumulative gas scaling; (3) single-point-of-failure master-key management leaves encrypted credentials vulnerable to loss of keys; and (4) verification events are not logged on-chain, precluding lifecycle analytics. In this paper, we present AcadVault, a privacy-preserving decentralized application that addresses these limitations with four contributions: (1) Hierarchical Deterministic (HD) subkeys for ChaCha20-Poly1305 AEAD encryption provide per-credential confidentiality and integrity for all credentials stored on IPFS with zero centralized key storage; (2) a sorted-pair Merkle tree protocol performs O(N) client-side leaf hashing and commits all N credential hashes in a single O(1) on-chain transaction, achieving 99.88% per-credential gas reduction at N=1,000; (3) Shamir’s Secret Sharing (t,n)-threshold scheme over GF(2^8) distributes decryption key custody among institutional guardians using information-theoretically secure shares; and (4) seven indexed on-chain event types provide immutable lifecycle tracking for issuance, revocation, verification, and key recovery. Validated on the Ethereum Sepolia testnet, AcadVault shows 62–77% gas saving per single operation and 99.88% batch saving at N=1,000 via O(1) on-chain Merkle anchoring, offering scalable and cost-effective grounds for institutional adoption.