Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf

#identiverse
Architecture & Standards
What is a Verifiable
Credential, and Why
Does it Matter?

#identiverse
Identity Standards Architect
Kristina
Yasuda
Microsoft

#identiverse
This talk is NOT about W3C Verifiable Credentials
Data Model, JWT-VC,s JWT-VPs, LDP-VCs, LDP-VPs,
etc.
It’s about…
(you’ll see)

#identiverse
How do we normally present
Identity?
(notice that it does not say “digital identity”)

#identiverse
Plastic Cards in a Physical Wallet
Source: Unsplash

#identiverse
What is the emerging way to
present Identity?
(that we have been so excited about)

#identiverse
Digital Cards in a Digital Wallet
+
…and other things
Caveat: digital wallets can
also hold…

#identiverse
Let’s experience
a digital wallet.
(is it really that exciting?)
Imagine when you checked into a
hotel to attend Identiverse.

#identiverse
Issued to Me
Physical Wallet Digital Card
Cards are issued to me (owner of the
wallet)
1. Physical wallet and emerging digital wallet
+

#identiverse
Issued by the Authoritative Issuer
Cards are issued by the authoritative
issuer
Plastic Card Digital Card
+

#identiverse
Cards are Portable
I can carry the cards with me (for
example, in a wallet)
+

#identiverse
Multi-Use of a Single Credential
I can use the same card multiple times
+

#identiverse
Combine Multiple Cards in One Transaction
I can show multiple cards at the same
time
+

#identiverse
Issuer Might Not Know When and Where the
Card is Used
Issuer of the card might not know
when and where I use the card

#identiverse
Similarity in the Experience and Features
Issued to?
Issued by?
Portable?
Multi-Use?
Combining multiple cards?
Issuer knows?
Yes
Yes
me
the authoritative
issuer
Might not
Yes
+

#identiverse
What are benefits of
“Digital Cards”?

#identiverse
Use-Case: Digital Driving License*
Everything is moving
into the phone
Reducing human error
during verification
Unlocking online Use-
Cases
* Same value propositions will apply to the other credentials such as University Graduation Credentials for example

#identiverse
How are “Digital Cards”
different from the way we
are used to presenting
identity online?

#identiverse
Yes, Federated Sign-in
* Each company has offerings in both Consumer and Enterprise spaces
Consumer* Enterprise*

#identiverse
A new artifact introduced in the “Digital
Cards” model*
* Some “Digital Cards” use-cases do not require user signed artifact.
Issuer-signed Card
(what is issued)
User
Signature
User-signed Card
(what is presented,
only in digital cards model)
- Claims about the
User
- User Identifier
- User’s Public Key
Issuer
Signature
- Claims about the
User
- User Identifier
Issuer
Signature
Not Bearer! Owned by a user who controls
the private key tied to a public key.
Claims inside can be about another user, if
delegated

#identiverse
Not everything changes,
but some important differences
Issuer
(Website)
Verifier
(Website)
Holder
(Digital
Wallet)
Federated Sign-in Digital Cards model
Identity
Provider
(Issuer)
Relying
Party
(Verifier)
Issuer-
signed
Sign
Issuer-
signed
Sign
User-signed
Sign
User
Agent

#identiverse
Issued to?
Federated Sign-in Digital Card
Cards are issued
to me (owner of
the wallet)*
Issuer signed
card is issued to
the Relying Party
(via the User
Agent)
*Issuer only has limited technical means to control at which verifier the user is going to use a digital credential. Not
talking about delegation/guardianship scenarios here.
2. Federated sign-in and emerging digital wallet

#identiverse
Issued by?
The authoritative
issuer (Identity
Provider)*
* Ratio of the Issuers to the Verifiers varies, too.

#identiverse
Portable?
(Identifier is what would allow Card portability)
Globally unique
identifier - not
namespaced and
is portable.*
User identifier
namespaced to
the Identity
Provider
* Depends whether the Verifier accepts non-namespaced identifier brought by the User.

#identiverse
Multi-Use?
Same card can
be used multiple
times*
ID Token is one-
time use
* Same Issuer-signed credential, different user signature per presentation

#identiverse
Combining multiple cards from multiple
issuers in one transaction?
I can show
multiple cards
from multiple
issuers in one
transaction
RP receives one
ID Token from
one IdP in one
transaction*
* IdP can aggregate claims from multiple issuers, but authority of the original issuer is gone
* Focus is on the deployed features of the Federated sign-in

#identiverse
Issuer knows about my usage?
Depends on the
use-case whether
Issuer of the card
knows when and
where I use the
card*
Issuer of the ID
Token knows
when and where I
used it, always
* Some use-cases require the Issuer knowing where the card is used.

#identiverse
Certain Differences
-> can address different use-cases
Issued to?
me
Relying Party
Issued by?
Authoritative Issuer
Portable? (Identifier)
Possible
Within IdP
Multi-Use?
Yes
One-Time
Combining multiple cards?
Yes
Not used
Issuer knows?
Depends
Yes

#identiverse
When are the use-
cases enabled by the
differences of
“Digital Cards”?

#identiverse
Use-Case: Identity Governance
Attribute-level
Attestation
3. Use-Cases when digital wallet is useful

#identiverse
Use-Case: Authentication at the Edge
No Account Creation *
* Need a verifier who is ok not to create an account

#identiverse
Use-Case: Supply Chain
Scale across
thousands of
organizations
+ independent from the
Issuer Availability
+ Ad-Hoc Trust* Possible
* When decision whether to trust a source of a request/response can be made when receiving that request/response (at a runtime)

#identiverse
Beyond Technical Integration:
Legal Agreements, Compliance, etc. (not a new problem)
Digital Cards
model
Issuer
(Website)
Verifier
(Website)
Holder
(Digital
Wallet)
Legal
agreement*
Legal
agreement*
Legal agreement*
Federated Sign-in Identity
Provider
(Issuer)
Relying
Party
(Verifier)
End-
User
Legal agreement
* Can be ad-hoc trust or a legal agreement.

#identiverse
Use-Case: Digital Driving License
Public Perception

#identiverse
Benefits of Digital Cards
Public Perception
Scale Cross-
Organization
Trust
+ independent from the
Issuer Availability
No Account Creation
(e.g. Authentication
at the Edge)
Attribute-level
Attestation

#identiverse
Isn’t this talk about “Verifiable
Credentials”?

#identiverse
Meet Verifiable Credentials
The idea of Verifiable
Credentials is to design
components and
mechanisms necessary
to use “Digital Cards”.
Multiple design choices
possible.

#identiverse
Data-Models and Credential Formats of
Verifiable Credentials
* ISO/IEC 18013-5 mDL provided by Zetes Industries S.A.
Verifiable Credentials
W3C Verifiable Credentials
Data Model
JWT-VC LDP-VC
AnonCreds mDL data model
CBOR-
encoded,
COSE
signed
JSON-
encoded,
JSON
signed*
SMART
Health
Cards
…
…

#identiverse
Standards that enable Verifiable Credentials
Component Standards
Exchange Protocol OpenID for VC Issuance, OpenID for VPs
Subject-Signed
Authentication
Self-Issued OpenID Provider v2
Credential Formats W3C JWT-VC, W3C LDP-VC, ISO mDL, IETF SD-JWT, etc.…
Entity Identifier DID methods, Raw keys, X.509 certs, etc.
Cryptography EdDSA, ES256K, etc.
Revocation Status List 2021, Revocation List 2020, Accumulators, etc.
Trust Frameworks Trusted Registries, Ledgers, etc.

#identiverse
How to find your peaceful spot for your use-case
inside a Verifiable Credentials ecosystem?
- Scope
- Enterprise / Consumer / Government
- Market
- Established / Emerging
- Use-Cases
- High Assurance / Low Assurance
- Identity of
- Individual / Legal Entity / Machine
Key Slide

#identiverse
Food for thought
- Attestations to prove security of a digital wallet?
- Usage of the Cloud components?
- Will Verifiers request digital cards more often than needed?
- Attributes of each user in one place – higher risk for hacking?
- Maturity of the Trust Frameworks?
…
4. Verifiable Credentials: Pros and Cons

#identiverse
What we did not talk about
- Revocation
- Selective Disclosure
- Refresh
- Delegation / Guardianship use-cases
- Unlinkability
- (Web3 – digital cards are possible without blockchain/DLT)
…
4. Verifiable Credentials: Pros and Cons

#identiverse
Now that you know what
verifiable credentials are good for…
Where in a verifiable credentials
ecosystem does your use-case belong
to?
What aspects need a deep-dive to realize
your use-case?*
* Business? Legal? Technical? Standards? else?

#identiverse
* Session may be called “Building Secure, Trusted and Interoperable Self-Sovereign Identity with
OpenID Connect” in some parts of the Identiverse website.
*

#identiverse
Yes, flexibility of verifiable
credentials is both exciting and
confusing.

#identiverse
But with a little bit of imagination
your use-case will find a cool spot.

#identiverse
Some Real-life Examples
mobile Driving Licence Vaccination QR Code

#identiverse
Why these two are moving forward?
mobile Driving Licence Vaccination QR Code
• One large Verifier – TSA
• No usage of Advanced Cryptography for
Selective Disclosure or Predicates
• Not doing Holder Binding
• Make choices across technical stack to ensure interoperability (e.g. exchange
protocols, credential format, data model, crypto suites, etc.)
• Finding a verifier that does not require account creation
• Focus on the existing ecosystems
Mutual to both

Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf

Similar to Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf (20)

Recently uploaded

Recently uploaded (20)

Verifiable Credentials_Kristina_Identiverse2022_vFIN.pdf