Understanding Self-Sovereign Identity: A Technical Introduction

The 2019 IIW demonstrated an explosion of SSI products, with Demo Day expanding to 25 demos (14 new products, 8 independent wallets, 5 KYC solutions). Simultaneously, DID methods matured significantly, with four major categories emerging: ledger-based, pure-based, layer two, and alternative methods. Over 32 DID methods now exist in the W3C registry, all requiring open public specifications. The DIDComm protocol is being developed as the interoperability standard enabling agents and wallets to communicate regardless of which DID method is used, serving as the 'thin waist' of the SSI protocol stack. Verifiable Credentials is expected to become a W3C recommendation within 30 days, including three formats: Link Data Signatures, JSON Web Tokens, and Zero Knowledge Proofs. The SSI interoperability stack consists of four layers: Layer 1 (DID networks and methods), Layer 2 (cross-ledger communication via DIDComm), Layer 3 (verifiable credentials trust triangle), and Layer 4 (governance frameworks).

Several development resources exist for implementing SSI: Hyperledger Indy handles the network layer (DIDs, schemas, revocation registries), DIDComm protocol handles peer-to-peer communication, mobile agents (like Xamarin-based agents) for mobile devices, and cloud agents (like Aries Go Agent) for web applications. The speaker demonstrates SSI wallets showing how users can scan QR codes to establish connections, view their connections, and manage what information they share. The wallet interface allows users to accept or decline connection requests, preventing unwanted connections from being established without consent. The demonstration shows issuing credentials (like age and favorite color) and verifying them without revealing underlying data.

An agent is an extended wallet that operates passively and runs on behalf of the user in the cloud or internet without requiring user presence or actions. Agents can perform operations like sending messages, receiving requests for VCs, sharing credentials, accepting VCs from issuers, storing credentials, and exchanging data with other agents. Agents can store VCs in the cloud with full encryption, interact with blockchains to create new identities, and communicate via crypto-protected messages. They can be thought of as 'wallets on steroids' - full-scale services with APIs. This represents a significant evolution from passive wallets that require user action to active systems that operate autonomously on behalf of users.

The technical implementation of SSI relies on open-source components from the Hyperledger Indy framework, which is strongly backed by a large open source community and compliant with W3C standards. The core components include Indy agents that interact with other agents, manage secure storage, and communicate with public ledgers on the internet. Controllers built on top of agents provide business logic defining how each agent should behave.

DIDComm is a meta-protocol that enables secure, authenticated peer-to-peer messaging between parties with Decentralized Identifiers (DIDs), using encrypted messages relayed through mediators to overcome network challenges like firewalls and intermittent connectivity; it provides a foundational framework where anyone can build additional protocols on top for applications like verifiable credentials, chat, and location sharing, while maintaining privacy through herd privacy features and enabling trust establishment through credential exchanges.

Zero-knowledge identity systems support advanced proof types including selective disclosure (revealing only specific fields from credentials) and predicate proofs (proving conditions like age > 18 without disclosing any credential metadata). These proofs are generated through circuit-based verification where the prover demonstrates knowledge of valid credential data while revealing nothing else. Verifiers receive only the proof that the user meets specified criteria, maintaining privacy while enabling trustless verification.

In privacy-preserving identity proofs, credential holders have attributes (name, nickname, address, date of birth, ID number). The goal is to present credentials to verifiers while preserving privacy by disclosing only a subset of attributes and proving predicates on these attributes. This is solved using Sigma protocols on top of signature schemes like BBS+ signatures. The issuer signs individual attributes, and the holder presents a credential where the verifier can verify that revealed attributes are signed by the issuer without revealing the actual signature, achieving unlinkability.

Zero knowledge proof enables the system to share limited data based on requirements by authorities through selective disclosure or predicate proof without compromising sensitive information. Selective disclosure means displaying only data necessary to prove a requirement. Predicate proof avoids displaying personal information by asking a question like 'is this person old enough to become a member?' and performing a mathematical calculation to return only true or false, thus not compromising sensitive information such as displaying date of birth.

Zero-knowledge proof mechanisms enable selective disclosure where users can obscure certain fields while revealing others, or prove predicates without revealing full data. For example, a user can prove their birth date is greater than 19 years ago without revealing their exact birth date. This uses Camenisch-Lauter signatures (CL signatures) which allow selective revelation. Other signature styles compatible with W3C standards exist for cases where full disclosure is acceptable or simpler mechanisms are preferred.

Decentralized identity systems support zero-knowledge methods including selective disclosure and predicate proofs. Selective disclosure allows users to reveal only necessary information without exposing the full credential. Predicate proofs enable users to prove conditions like age being greater than 21 without revealing their exact age, using mathematical comparisons to verify that a number falls within a certain range or meets specific criteria.

Layer 3 implements verifiable credentials using the trust triangle model (issuers, holders, verifiers) with revolutionary capabilities: verifiers can independently verify credentials without contacting the original issuer, eliminating privacy problems of centralized identity verification. This means individuals can prove things to third parties without revealing unnecessary information or relying on intermediaries. In the Trust Over IP ecosystem, anyone—individuals, organizations, or IoT devices—can potentially become an issuer of credentials. A sensor on an oil pipeline could issue signed credentials about sensor readings that regulators can verify. However, this openness creates critical governance challenges: determining which issuers should be trusted. Governance frameworks at various layers provide mechanisms to establish trusted issuer lists. Layer 4 addresses entire ecosystems of applications and organizations needing coordinated governance, exemplified by the proposed 'Internet of Education' involving thousands of educational institutions worldwide. Governance frameworks at this level must address membership directories, auditors, and accreditors to ensure all participants follow established rules.

The Trust Over IP stack consists of technology and governance components. The technology stack includes the blockchain (Indy), agents (wallets and enterprise systems), data exchange protocols for issuing/verifying credentials, and applications. The governance stack involves coordination between all participants, potentially including legal agreements. This architecture enables trust at scale across the economy. Governance frameworks establish why verifiers trust issuers, similar to how we trust $20 bills (Bank of Canada authority) or credit cards (millions of users and merchants). This combination of technology and governance enables digital trust ecosystems like the Law Society-Ministry of Justice system.

Above the trust spanning layer, two fundamental approaches exist for trust task protocols: messaging-based (exemplified by DIDComm for trusted messaging) and data exchange/synchronization-based (exemplified by Decentralized Web Node for encrypted data sharing). These approaches mirror the evolution from email (SMTP) to web-based interactions (HTTP). The Trust Registry Protocol enables communication between trust registries, allowing queries about issuer/verifier authorization and disclosing trusted relationships between registries. This enables ecosystem governance frameworks like the VLEI system to specify authorized parties for specific tasks. The GLEIF implementation demonstrates practical deployment, using the Trust Over IP meta-model to create 24 governance documents for the global LEI system, establishing GLEIF as the root of trust with technical enforcement through their software.

The Trust over IP (ToIP) framework is a comprehensive architecture for achieving global interoperability in self-sovereign identity (SSI) solutions, consisting of four layers: Layer 1 (Utility Governance) provides public permissioned blockchains for creating decentralized identifiers (DIDs) and establishing technical trust; Layer 2 (Provider Governance) enables secure peer-to-peer communication through DIDComm protocols; Layer 3 (Credential Governance) defines how verifiers trust credentials through governance frameworks that authorize issuers; and Layer 4 (Ecosystem Governance) establishes broad trust circles for entire industries or communities. This dual-stack approach addresses both technical and governance aspects of digital trust, enabling universal interoperability for credentials like COV19 vaccination certificates without requiring direct integration between issuers and verifiers.

Governance frameworks establish rules enabling trust in credential systems, applying at every layer of the SSI stack. Examples include credit card networks (Visa, Mastercard) and passport networks. The Sovereign Foundation is developing meta-system governance frameworks that coordinate multiple networks under shared principles. This enables thousands of different governance frameworks for different trust communities—governments, corporations, universities, churches, neighborhoods, and families. Every credential has a governance framework behind it, enabling trust according to each community's policies.

Self-sovereign identity presents regulatory challenges because existing data protection regulations (GDPR in Europe, CCPA in the US, Canadian regulations) assume organizations act as data controllers when handling personal information. These regulations did not anticipate individuals controlling their own data through SSI. Collaborative efforts between industry stakeholders and regulators are addressing these tensions to ensure SSI infrastructure works within existing legal frameworks while enabling individual data ownership.

Privacy engineering differs fundamentally from traditional security by focusing on protecting user identity and preventing data linking. The LINDDUN framework addresses Linkability (connecting data fragments to identify individuals), Identifiability, Non-repudiation (proving who performed actions), Detectability, Data Quality, Unawareness (user awareness of data collection), and Non-compliance. Regulatory compliance has become increasingly important with GDPR imposing strict requirements on data handling, breach notification, and user rights to access and delete data. Multiple U.S. states (California, Pennsylvania, New York, Colorado) have enacted similar laws, creating enforcement mechanisms where affected individuals can sue companies for data breaches. Organizations must implement processes to comply with these requirements regardless of their location, recognizing that privacy violations can result in significant financial penalties and reputational damage.

The Sovereign Foundation has developed governance frameworks addressing how SSI works with regulations like GDPR. The key insight is that DIDs for individuals on immutable ledgers create challenges because data cannot be erased. The solution involves legal architecture where the Sovereign Foundation acts as designated data controller, with all network stewards as data processors. Most individuals should not need DIDs on public ledgers, as these are primarily for institutions issuing credentials.

GDPR compliance requires addressing public DIDs as personal data on immutable blockchains. Private pairwise DIDs can be easily deleted, solving erasure rights. The SSI community is working on GDPR-compliant consent receipts. Synthetic identities are addressed through agent policies requiring proof of connection necessity. Business models include service providers, credential issuers, verifiers, payment infrastructure, and governance framework consulting. The SSI community is forming task forces including business-focused ones, with entrepreneurs starting companies based on SSI ideas.

The eIDAS regulation specifies requirements for trust services and their legal value, with qualified digital signatures having legal value. Current SSI implementations often use keys associated with key IDs that are not qualified under eIDAS, creating challenges for legally binding transactions. While proof-of-concept systems demonstrate the technology, achieving full legal compliance requires addressing how to qualify DIDs. Additionally, publicly available keys in decentralized identity systems are considered personal data under GDPR, creating challenges that have not been fully clarified. While production systems work for business-to-business exchanges, applying them to government and public sector cases becomes problematic due to regulatory uncertainty.