I've been thinking about designing a system, where every student's grades are stored on the blockchain in encrypted form.
However, I've read enough posts describing why this is not a good idea: Ethereum discourages the use of storage, and contracts cannot store the decryption key safely/hidden anyway (all contract data is visible to anyone on the blockchain, right?).
The system should facilitate a paid service for, e.g., companies that want information on a particular student.
My initial thoughts of such system is as follows (assuming both parties, i.e., university and company, have an Ethereum account with public/private key pair):
- The company sends a request to the university web server, requesting information, and providing the public key of the company.
- The university creates a smart contract with the encrypted information (under the company's public key) and a hash of the plaintext.
- The company sends a transaction to the smart contract, paying some amount of ether, whereafter it gets the encrypted information and hash. The contract then suicides and transfer its funds to the university.
- The company decrypts the information under its private key and verifies the hash.
There is a problem with this idea. After the smart contract (step 2.) has been deployed, the company can just read its data without sending any ether to it. How can this be fixed?
In general, what approach would I choose for designing such paid service for information retrieval?