How to Create a DID and Issue a Verifiable Credential: A Step-by-Step Guide

Asymmetric cryptography uses two mathematically linked keys: a public key freely shared and a private key kept secret. The fundamental principle is that encryption with one key requires decryption with the other. Anyone can encrypt messages using the public key, but only the private key owner can decrypt them. This reverses the traditional symmetric model. Additionally, encrypting with the private key creates a digital signature—proving authorship since only the key owner could have done it. While this provides authentication, it sacrifices confidentiality since anyone with the public key can read the message. This dual functionality enables both secure communication and verifiable identification within the same cryptographic framework.

This section explains asymmetric key cryptography using public and private key pairs. Key principles include: key pairs must be created together, and private keys must never be shared. In encryption, the recipient creates the key pair, shares the public key, and the sender encrypts messages using the public key for secure transmission. In digital signatures, the sender creates the key pair, signs messages with their private key, and the recipient verifies using the public key. This system ensures confidentiality, authentication, and data integrity in digital communications.

Asymmetric encryption uses mathematically interdependent public and private key pairs. The sender encrypts messages using the receiver's public key, which is publicly available, and only the receiver can decrypt using their private key. This ensures confidentiality over insecure channels. Digital signatures provide non-repudiation by using the sender's private key to sign messages. The process involves: (1) Sender calculates hash of plaintext. (2) Sender encrypts hash with their private key to create signature. (3) Receiver verifies by decrypting signature with sender's public key and comparing hashes. For combined security, both encryption and signatures are used: sender encrypts plaintext with receiver's public key and signs with their private key. Receiver decrypts with their private key and verifies signature with sender's public key.

Asymmetric cryptography uses key pairs (public and private) for encryption/decryption, solving key distribution and digital signature problems that plagued symmetric encryption. Diffie and Hellman's 1976 breakthrough enabled secure communication without trusted third parties. Key terms include plain text, encryption algorithm, public key (shared openly), private key (kept secret), ciphertext, and decryption algorithm. Public key encryption provides confidentiality: sender encrypts with recipient's public key, only recipient can decrypt with private key. Digital signatures provide authentication: sender signs with private key, anyone verifies with sender's public key. In practice, hash functions are applied before signing for efficiency.

Asymmetric encryption uses mathematically linked key pairs (public and private) where data encrypted with one key can only be decrypted by the other. This enables secure communication without shared secrets. Digital signatures combine hashing and private key encryption: the sender hashes the message then encrypts the hash with their private key. Recipients decrypt the signature with the public key and compare hashes to verify authenticity and detect tampering. This bidirectional system provides both confidentiality and authentication capabilities.

The verifiable credential trust triangle consists of three roles: issuers (organizations/government agencies that issue credentials), holders (individuals/entities that request and present credentials), and verifiers (parties that request and verify credentials). Zero-knowledge proofs allow holders to present only minimum information needed. The Trust Over IP Foundation, launched by Northern Block and 28 organizations within the Linux Foundation, enables trustworthy data exchange between any two parties on the internet. The stack uses a dual-layer design with governance on the left and technology on the right, acknowledging that trust is an outcome of how humans organize themselves and the technology used.

Verifiable credentials are the electronic equivalent of physical documents like driver's licenses or diplomas. They cryptographically prove that data was issued by a specific issuer to a specific holder. The trust triangle consists of three parties: the Issuer (who creates and signs the credential), the Holder (who receives and stores it), and the Verifier (who needs to verify it without contacting the issuer). This structure allows verification without requiring direct integration between all parties, solving the scalability problem of traditional identity verification. Examples include driver's licenses, college diplomas, library cards, and medical records.

Verifiable Credentials operate through a three-party trust model: (1) The issuer creates and validates credentials (e.g., employer, university, government agency); (2) The subject receives and controls their credentials; (3) The verifier validates credentials presented by subjects. This model enables direct information flow from issuing sources to verifying parties. Using the Navy MilGears example, service members receive credentials from the DOD, then present them to universities for verification, accelerating career opportunities while maintaining control over their information.

The trust triangle model defines three roles in SSI: issuer, holder, and verifier. The issuer trusts the holder and issues credentials; the holder trusts the verifier to present credentials; and the verifier trusts the issuer. This eliminates the need for centralized surveillance or phone-home systems because no single party knows both issuance and verification. Roles are dynamic and context-dependent—one person can occupy multiple roles simultaneously, and roles change based on the situation. This model enables secure, decentralized identity verification where privacy is preserved, issuers don't learn about credential usage, and verifiers don't track users across interactions.

Self-Sovereign Identity (SSI) uses a physical analogy: a piece of leather represents sovereign identity that the individual owns and controls. The trust triangle consists of issuer (who creates credentials), holder (who controls credentials), and verifier (who validates credentials). The verifiable data registry is where issuers write their Decentralized Identifiers (DIDs) to ledgers accessible by all verifiers. The blockchain's role is essentially decentralized key management or decentralized PKI, originally discussed at the 2015 Rebooting Web of Trust conference where pioneers like Vitalik Buterin and Greg Maxwell addressed how to do decentralized key management more simply and scalably than PGP.

The fundamental purpose of DLT is creating public, immutable registers. Cryptocurrencies are applications of this technology, but the underlying DLT serves as a public register with near-infinite applications. Examples include decentralizing INDECOPI's trademark register, SUNARP's real estate records, and notary document storage. The technology provides trust through decentralization, making it difficult to hack or alter records. Understanding DLT as a technology rather than a product is essential for recognizing its potential applications.

Distributed Ledger Technology functions as a public peer-to-peer system that shares a registration system. It operates like a national public database where participants collectively maintain records without relying on a central authority.

Distributed ledger technology (DLT) enables the collaborative creation of digital ledgers where a database of assets is shared across a network of sites, geographies, and institutions, with all participants having identical copies. The European Securities Markets Authority describes DLT systems as records of electronic transactions maintained by a shared or distributed network of participants (nodes), forming a distributed validation system that makes extensive use of cryptography, including computer-based encryption techniques such as public keys, private keys, and hash functions used to store assets and validate transactions.

Distributed Ledger Technology (DLT) is a distributed database maintained over a network of computers where information is added in blocks, with participants sharing identical cryptographically secured records; it operates on either public networks (open, no central authority, all data visible) or private networks (limited access with tiered authority), using public-private key combinations for asset security and verification processes (consensus-based or proof-of-work) to create permanent, time-stamped records that are currently immutable.

Distributed Ledger Technology (DLT) is a decentralized database system that maintains shared, immutable records across a network of computers, eliminating the need for intermediaries to process transactions; blockchain is one specific type of DLT that organizes transactions into blocks chained together, creating a secure and transparent system where records cannot be modified or changed once recorded, with two main categories being public blockchains (open networks where anyone can participate) and private blockchains (permissioned systems with controlled access).