Intro.
“Self-Sovereign Identity” (SSI) is based on the use of a distributed ledger and the use of more traditional techniques to implement a system where the user becomes completely “owner” of their data and where privacy is guaranteed.
As we will see, one of the key tools of the new identity system is the so-called cryptographic wallet – a software program, online platform, or hardware device – where the keys necessary to be identifiable, as we will see, are stored.
Decentralized Identifiers (DID).
Among the standards necessary for the functioning of the SSI model, the first is represented by decentralized identifiers (DID), a new type of “identifier”. A DID is a component of a new level of decentralized identity that has 4 properties:
- Persistence
- Resolvability
- Cryptography
- Decentralization
According to the W3C1 definition, a DID is a new type of identifier: that is, nothing more than an alphanumeric string that identifies a resource.
By resource, we mean any object that can be identified, from a web page to a person to a planet. This string looks very much like any other web address, but it starts with “did:” instead of “https:” or “http:”.
On a strictly technical level, a DID is a type of URI2 (Uniform Resource Identifier), which is a string of characters that identifies an abstract or concrete resource in a specific and unique format.
Within the set of URIs, there are URLs3 (Uniform Resource Locators) and URNs4 (Uniform Resource Names).
A URL is a subclass of URI that is used to locate a resource via its location on the web. Every web page, file, image, video, has its own URL. The important factor is that these identifiers can change.
The second subclass of identifiers is defined as URN and is used to identify a resource by its “name”. An example of a URN is the ISBN code: this uniquely identifies a book, but gives us no information about its location or where it is located on the network. The important factor is that this identifier cannot change over time.
Essentially, a DID is a URN that can be “searched-resolved” to obtain a standardized and persistent set of information about the resource that is identified by the DID. For a resource, we can think of a person, a collective association/organization or an object. Therefore, the information related to the DID is information related to people, collective associations/organizations, or objects.
Another characteristic of DID is related to cryptography. A DID is associated with a pair of cryptographic keys (public key and private key), and the holder of the private key (kept in their wallet) can prove that they are the controller of the DID.
These private and public keys use the blockchain as a “shared source of truth” to demonstrate to third parties their control over the data, without relying on centralized registries.
A DID is nothing more than an alphanumeric code that represents a generic resource. I will have a DID and you will have a different DID than mine. This code has a precise scheme and is composed of 3 parts: “Method,” “DID Method,” and “Method-Specific-Identifier.”
- The first part is called Scheme-Method and is nothing more than the prefix “did:”
- The second part is defined as DID Method and is very important because it identifies the decentralized registry or blockchain on which such DID has been resolved. For example, if it is resolved on the Bitcoin blockchain, it will be expressed as “did:btcr.”
- The third part is defined as Method Specific-Identifier and is the extension (string) that characterizes the DID for the specific resource (my DID, your DID). For example, my specific DID for bitcoin could be the following: did:btcr:13n29cn30cn3ncr84dc. A completely generic DID is reported as: did:example:123456789abcdefghi
Each DID is registered autonomously, directly by the owner within permissionless and/or permissioned blockchains. There are no intermediaries, and that’s why it’s called Self-Sovereign Identity. Each user is fully sovereign of themselves and their own identity.
SSI is based on the idea that an individual can open several private communication channels with third parties such as people, collective entities, and objects. It is appropriate to specify that there are different types of DIDs, precisely because, as we have seen before, the latter is a generic identifier.
For example, there is a DID that is defined as “DID Subject” and a DID that is defined as “DID Controller.” An example that allows explaining the difference could be the following: when a parent controls a DID that identifies their child. The “DID Subject” is the child, but the “DID Controller” (at least until the child reaches the age of majority) is the parent.
However, when the child comes of age, they will become both “DID Subject” and “DID Controller.”
Furthermore, this information (i.e., who controls or who is the subject) is inserted into a particular document that is defined as “DID Document.” Each DID has its own “DID Document” where there is a standardized data structure that provides the specifications and metadata (such as information necessary for the computer document to be correctly formatted, managed, and preserved over time) associated with the DID. We can imagine DID Documents as instruction booklets that accompany DIDs, inside of which there are metadata that help counterparties identify the counterpart during a connection.
A fundamental role in the new identity model under examination is played by Verifiable Credentials (VCs). VCs can be defined as declarations, made by a certifying third party, about an identity and characterized by cryptographic proof. Once a DID is created, an infinite number of credentials can potentially be linked to it.
Verifiable Credentials “certify” some attributes of a subject or other types of information related to them (such as possession of a driver’s license, possession of a school diploma, a pilot’s license, a birth certificate, etc.).
Verifiable Credentials.
Verifiable Credentials are a way of representing the attributes that we all associate with our identity. In general, attributes can be of any type: a health certificate, which certifies whether or not I have a pathology, or even just a certificate issued by any entity.
These attributes, in the context of identity, are called “Credentials.” In the context of Self-Sovereign Identity, however, Credentials are called Verifiable Credentials.
Let’s think about the “physical” credentials we all have and use today: our identity card, driver’s license, birth certificate, or our degree hanging on the wall. We are all used to holding such credentials physically, inside our wallet rather than in a drawer. When requested (such as a passport at the airport), we can present them to the person who is authorized by law to verify their authenticity (such as checking that the passport has been issued by a competent authority).
Verifiable Credentials are therefore a way to represent the certificates that we are used to knowing as “physical” in a completely digital way. Verifiable Credentials are, by their nature, a radical innovation: a citizen can hold any attribute related to them inside their smartphone, in a completely digital way. It is true that digital certificates have existed for several years now: Verifiable Credentials are structured differently, thanks to features that make them secure, unchangeable, and independently verifiable.
Verifiable Credentials can be thought of as “objects” that a user receives from an issuer, who signs them digitally. Just like in the case of a physical certificate, once a user has received a Verifiable Credential, they can manage and show it whenever they want, in a completely independent way (just like a card inside our wallets, signed by the issuer and then in our sole possession).
Verifiable Credentials can be held directly inside smartphones, for example, and can be shown for verification, recreating the “physical” model within the digital world.
In this way, through Verifiable Credentials, citizens and users can interact with the digital world: it is also possible to create a decentralized trust system within a world where digital data has never really been able to return to the complete possession of users.
The schema followed for the issuance and management of Verifiable Credentials allows users to be completely independent in managing them, enabling the self-sovereignty of the data held by citizens.
There are mainly three roles in the issuance, management, and exchange of Verifiable Credentials:
- An issuer (Issuer) of credentials: an issuer can be any entity, from a ministry, for example, to a family member. The credentials that can be issued can be of any type, and offer different levels of security depending on who is the issuer of that credential. The issuer sends the credentials directly to the user, also called the holder.
- A user (Holder) receives credentials digitally signed by one or more issuers. Once the credential is sent to the holder, they can manage it completely autonomously: they can present it to those who request it without the issuer ever being involved. And that’s why Verifiable Credentials mirror the world of physical credentials in a digital context!
- A verifier (Verifier) can be any entity that “verifies” credentials shown to them by a user. The Credential contains all the data necessary to verify it, such as who the issuer is, who the Credential is issued to, and whether or not it has been modified over time. Blockchain technology (or the Verifiable Data Registry) is used to check the validity of the credential held by the holder.
A credential that most of us use daily (by holding and showing it) is the driver’s license.
The functioning of the system related to the concept of a driver’s license could be as follows:
A citizen takes a driving test and has a digital wallet (i.e. crypto wallet) based on Self Sovereign Identity standards. Once the driving test is passed, the Motor Vehicle Department will release a Verifiable Credential representing the license through its system. The Verifiable Credential will contain the license holder’s name, validity of the license, and other useful information. The citizen receives the license and holds it as a Verifiable Credential within their digital wallet.
A police officer stops the citizen for a check: the citizen can show their license as a Verifiable Credential. Through the cryptographic properties of the Credential, the police officer can verify the holder and by checking the Blockchain, they can verify that it is still valid.
In the above example of the license, the citizen was able to show their attribute to a Verifier in a completely privacy-preserving way.
Verifiable Credentials enable what is known as selective disclosure: a Holder can show only the necessary data to a Verifier without having to show all the data contained within the Verifiable Credential.
For example, a citizen stopped by a police officer may be able to prove to the Verifier that they have a driver’s license without even showing their name, thanks to the cryptographic properties of Verifiable Credentials.
Among the mechanisms that contribute to reducing individuals’ exposure of personal information are the concepts of Zero-Knowledge Proof and Selective Disclosure, both centered on the principle of data minimization.
According to Zero-Knowledge Proof, thanks to an advanced privacy-oriented encryption system, it is possible to attest to the existence of certain attributes regarding an entity (person, organization, or object) without the need to expose identifiable information about its identity. In other words, the Zero-Knowledge Proof mechanism allows for the demonstration of a statement without the need to disclose it.
Similarly, through the concept of Selective Disclosure, the user, at the moment they want to present information (claim) that is part of a Verifiable Credential, can disclose only some information instead of exposing the entire document.
The possibility of not revealing identifiable information, combined with the concepts of Zero-Knowledge Proof and Selective Disclosure, undoubtedly represents a significant advancement in guaranteeing users’ right to the protection of their personal data.
1 W3C – non-governmental organisation whose main activity is to establish technical standards for the World Wide Web concerning both markup languages and communication protocols
2 URI – sequence of characteristics that universally and uniquely identifies a resource. Examples of URIs are: a web address (URL), a document, an image, a file, a service, an e-mail address, the ISBN code of a book, a telephone number.
3 URL – a sequence of characters that uniquely identifies the address of a resource on a computer network, such as a document, image, video, typically present on a hostserver and made accessible to a client.
4 URN – a sequence of characters that identifies a resource by a ‘name’ in a particular domain of names known as a ‘namespace’. A URN can be used to describe a resource without hinting at its location or how to obtain a representation of it
Market and Data
_old_Become an author
Wallet
