Hacker News Reader

Comment by runeks | Hacker News Reader

So... how, exactly, do they propose tying together a human being with a public key, thus creating a DID, without the use of a central registrar?

As far as I can see, in the end it just comes down to users trusting the same set of registrars — which we already have in the form of Certificate Authorities.

View on HN

"So... how, exactly, do they propose tying together a human being with a public key, thus creating a DID, without the use of a central registrar?"

The answer, as you might expect, is with a blockchain.

There was a booth last week at the decentralized web summit for the "BTCR DID Method" which I believe is sponsored by W3C. You can read about it by going here:

https://decentralizedweb.net/science-fair/

Here you are:

"The Bitcoin Reference DID method supports DIDs on the public Bitcoin blockchain The Bitcoin Reference DID method (did:btcr) supports DIDs on the public Bitcoin blockchain. The Bitcoin Reference method has minimal design goals: a DID trust anchor based on the Bitcoin blockchain, updates publicly visible and auditable via Bitcoin transactions, and optionally, additional DID Document information referenced in the transaction OP_RETURN data field. No other Personal Identifiable Information (PII) would be placed on the immutable blockchain.

A secondary intent of the BTCR method is to serve as a very conservative, very secure example and some best practices for creating a DID method. The use cases for BTCR are focused on anonymous and pseudo-anonymous identities, web-of-trust style webs of identity, and absolute mimimal personal information disclosure. Other DID methods will likely need to loosen these standards.

Some aspects of the BTCR method will not be practical if inappropriately scaled — for instance, there is a transaction cost to update keys and DDO object, potential UTXO inflation (i.e. one additional unspent output for every BTCR-based identity), and even if segwit isn't used it could cause blockchain bloat. However, identities using the BTCR method can be a strong as Bitcoin itself -- currently securing billions of dollars of digital value."

I still don’t quite get it.

What would I put in the Bitcoin blockchain in order to create a DID? A public key hash and what else? In other words, what do I want to tie together with a public key, using the Bitcoin blockchain, in order to use it as an identifier?

And who's to stop Bob from coming onto the farm and changing the Bessy's rfid chip?

It depends on the DID method. The DID is a string with the following pattern: did:<method>:<method-specific-id>. There's a variety of DID methods with different underlying public ledgers, such as Bitcoin and Ethereum. The <method-specific-id> depends on the <method>. For instance, there's DID methods that use the underlying wallet address as the id and others use the smart contract deployed.

The DID system doesn't use any central registrars. Connecting a key with an entity consists of the entity represented by the DID publishing the key in their DID document. That document is then published on some ledger (can be blockchain but could also be, e.g., IPFS) so that others can discover it.

Most of the reference I found have some relation to blockchain in it. Do you know of existing work of DID + IPFS?

There is bunch of discussions happening currently about how to get Identity right and how applications using IPFS can use DID for their identity management.

Some links:

- https://github.com/ipfs/dynamic-data-and-capabilities/issues...

- https://github.com/ipfs-shipyard/peer-star/issues/6

- https://github.com/ipfs-shipyard/peer-star/issues/7

Also, browse around in the repositories and their open issues.

Thx. These are great.

I would like to also add https://github.com/ipfs-shipyard/peer-star/pull/15 to the list of links.

If anyone is really into decentralized identities and authentication, please give it a read. Feedback would be appreciated!

I mentioned Keybase's use of DID's in another comment in this thread. They've done a great job of demonstrating how a fairly non-technical user can generate their own PGP keys and cross reference these keys to various social identities and attestations. The records for each user's attestations and identity claims are written to the bitcoin blockchain, which gives users the ability to continue use of these identity claims, even if Keybase were to cease existing. Blockstack's identity model has some similar features, and in general, I've found the successful use of DID's to be blockchain agnostic, which is (IMHO) the way it should be.

I am wondering about this too. The spec says:

> Because DIDs reside on a distributed ledger, each entity may serve as its own root authority—an architecture referred to as DPKI [0] (decentralized PKI).

There is a whole bunch of related docs in the WebOfTrust github repo's, many of which are related to blockchain (which does not have my interest, ATM).

The spec continues:

> Note that DID methods may also be developed for identifiers registered in federated or centralized identity management systems. For their part, all types of identifier systems may add support for DIDs. This creates an interoperability bridge between the worlds of centralized, federated, and decentralized identifiers.

Then later on there is a chapter on DID Resolvers [1] but this does not have much detail. So, I guess, the actual resolving mechanisms are out of scope of the spec.

[0] https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust...

[1] https://w3c-ccg.github.io/did-spec/#did-resolvers

Reply on news.ycombinator.com