01
Create a trust anchor
A root CA creates a key pair and signs its own demo certificate. This lab explicitly trusts that root.
Keys exist only in memory for this session.
Researcher · Senior software engineer
Rafael Torres
Moreno
Digital identity, privacy and cloud engineering.
I work across research and product engineering to build digital services that are secure, useful and worthy of trust.
A little about me
01 / Profile
Curiosity,
put to work.
I hold a degree and a master’s in Computer Science, but my journey into technology started long before that—back when I was just a kid, fascinated by how computers work. This early curiosity transformed into a passion for security and privacy, and eventually became the driving force behind my decision to pursue a PhD in Distributed Digital Identity Systems.
I pride myself on my adaptability—whether I’m working in a team or independently, I consistently perform at a high level. I’m someone who thrives in dynamic environments, quickly adjusting to new challenges without losing focus on the goal. My ability to make informed decisions with confidence has always helped me bring projects to a successful finish.
Ultimately, I approach every task with dedication and commitment, always striving to deliver my best. My experience spans a variety of settings, but my focus on cutting-edge technologies and security is what truly excites me.
Education
- PhD, Distributed Digital Identity SystemsUniversity of Murcia
- Master's in New TechnologiesUniversity of Murcia
- Degree in Computer ScienceUniversity of Murcia
02 / Career
Experience
Over 10 years of experience across systems, software development, research and cloud engineering.- Senior software engineerCactusSoft
- Pre-doctoral security & privacy researcherUniversity of Murcia
- Pre-doctoral security & privacy researcherIBM Zürich
- iOS DeveloperLeverade
- Intern, Department of Information and Communications EngineeringUniversity of Murcia
- Intern, Department of Information and Communications EngineeringUniversity of Murcia
- Systems administratorCieza City Council, Murcia
03 / Journal
Writing
Ideas on technology, without the hype.- ↗
Smart contracts, what the heck?
What's behind the fancy name?
- ↗
Distributed Ledger Technology and Blockchain
Short introduction to DLT and Blockchain
- ↗
Non Fungible Tokens, or the NFT issue
An NFT short introduction and reflexion
04 / Research
Publications
Research papers and academic contributions on privacy, digital identity and distributed systems.- From Research to Privacy-Preserving Industry Applications: Workshop Summary
- Privacy-Preserving Identity Management and Applications to Academic Degree Verification
- Data Protection by Design in the Context of Smart Cities: A Consent and Access Control Proposal
- Implementation and evaluation of a privacy-preserving distributed ABC scheme based on multi-signatures
- Towards a standardized model for privacy-preserving Verifiable Credentials
- A trusted approach for decentralised and privacy-preserving identity management
- OLYMPUS: A distributed privacy-preserving identity management system
- Identity Management: State of the Art, Challenges and Perspectives
- The OLYMPUS Architecture—Oblivious Identity Management for Private User-Friendly Services
- Privacy-Preserving Solutions for Blockchain: Review and Challenges
- Chapter: An Overview on ARIES: Reliable European Identity Ecosystem
- ARIES: Evaluation of a reliable and privacy-preserving European identity management framework
- OLYMPUS: towards Oblivious identitY Management for Private and User-friendly Services
05 / Playground
Small tools,
real concepts.
Interactive explorations of tokens, public-key trust, contract logic and login security.JSON Web Token
Local only
Inspect a token's header and payload. The token stays in this browser; its signature is not verified.
Header
Payload
Decoding does not validate authenticity. Never trust claims until the signature is verified by a trusted system.
Live sequenceWaiting
TextareaJWT decoderBase64 / UTF-8 APIsJSON.parse()Date.now()UI output
- Waiting for a token.
Follow a message from key creation to verification. The cryptography is real; this compact demo certificate is not an X.509 certificate.
ECDSA · P-256 · SHA-256- 01Root CANot created
- 02Identity certificateNot issued
- 03Signed messageNot signed
02
Issue an identity certificate
The CA signs a certificate that binds “Demo User” to a public key. The private key stays with its owner.
Create the root CA first.
03
Sign and verify a message
Issue a certificate first.
Root self-signatureNot checked
Identity certificateNot checked
Message signatureNot checked
A teaching model of a PKI trust chain: no X.509 parsing, revocation checks, or external trust store. Reloading the page discards all keys.
Live sequenceWaiting
UI / JSWeb Crypto APILab stateJS verifier
- Create a root CA to begin.
A tiny vending-machine contract. Each purchase checks its rules, changes state and emits an event.
Local simulation · no blockchainVending machineDemo contract
Stock3
Price0.01 ETH
Balance0.00 ETH
Three items are in stock. Try a purchase.
Transaction logLocal
The rules
function buy() external payable {
require(stock > 0, "Sold out");
require(msg.value == price, "Wrong amount");
stock -= 1;
emit Purchased(msg.sender, msg.value);
}- require checks conditions before changing state.
- A valid purchase reduces stock and increases the contract balance.
- emit records an event for apps watching the chain.
- When stock reaches zero, the next purchase reverts and state stays unchanged.
This is a browser simulation, not compiled Solidity and not connected to a wallet or network.
Live sequenceWaiting
Demo UIJS contract modelLocal stateEvent log
- Submit a transaction to trace its execution.
See how repeated password guesses behave with and without basic protections. This is a fixed, offline simulation against one fictional account.
Synthetic account · no networkAttempts0
Failed0
AccountReady
Authentication eventsLocal
The demo runs four fixed guesses locally. With protections off, the weak demo password is found; lockout or MFA changes the outcome.
Training model only. Real systems must enforce rate limits and MFA on the server, store passwords with a slow salted hash, and avoid revealing whether a username exists.
Live sequenceWaiting
UI / guess loopLogin simulatorLocal stateMFA input
- Sign in or run the fixed attack to begin.
Open to thoughtful collaborations