DIDs Explained: Self-Sovereign Identity & Blockchain Trust

Zero-knowledge proofs allow cryptographic proof of meeting certain criteria without revealing the underlying data. Instead of sharing a date of birth, you can cryptographically prove you're over a certain age threshold. The issuer attests to your eligibility, and you can prove this fact without revealing anything else. This is essentially identity affiliation and eligibility verification in one credential, signed by the issuer.

Zero knowledge proofs (ZKPs) enable individuals to prove specific attributes (such as age or citizenship) without revealing underlying personal information, offering a powerful solution for privacy-preserving identity verification in digital systems; this technology can be applied to various use cases including anonymous voting, programmable airdrops for humanitarian aid, and combating AI fraud through proof of personhood, while maintaining user control over their identity data.

Zero knowledge proofs (ZKPs) are cryptographic protocols that allow one party to prove possession of certain information to another party without revealing the information itself, consisting of three core properties: zero knowledge (the verifier learns nothing about the underlying data), completeness (if the prover knows the secret, they can always successfully prove it), and soundness (false proofs cannot be generated). These proofs enable privacy-preserving identity verification where users can prove attributes like age or citizenship status without revealing sensitive personal information, addressing the fundamental challenge that blockchain addresses alone cannot support complex coordination requiring identity data beyond wallet addresses.

Zero-knowledge proofs (ZKPs) offer significant opportunities for digital identity systems that exist outside the DeFi ecosystem. Regulators are particularly interested in these opportunities because ZKPs can overcome limitations inherent in current zero-knowledge systems at a certain computational cost. This enables more privacy-preserving and efficient identity verification solutions that address current regulatory and privacy concerns in digital identity management.

Zero knowledge proofs enable privacy-preserving verification in identity systems by proving statements without revealing underlying data. Circuits have public inputs (verification parameters like age thresholds, operation types) and private inputs (claims, Merkle proofs, revocation proofs). Generic circuits handle common operations including equation checking, value comparison, and list membership, reducing trusted setup requirements. Proofs can be used off-chain for website authentication and DAO voting, or on-chain within smart contracts for actions like fund withdrawals. Current proof generation takes approximately five seconds, with optimization efforts targeting one-second generation for mobile usability. Identity systems are developing platforms allowing issuers to issue claims through APIs without managing cryptographic keys, simplifying the process while maintaining security.

Decentralized Key Management System (DKMS) is an essential open standard for managing private keys in self-sovereign identity systems, addressing the critical challenge of securely storing, backing up, and recovering cryptographic keys across multiple devices. Unlike traditional centralized key management, DKMS uses a two-layer architecture with edge agents (running on personal devices) and cloud agents to enable encrypted backups, multi-device synchronization, and recovery through either offline methods (paper wallets, hardware wallets) or social recovery (sharding recovery keys among trusted connections). This standardization enables interoperable identity wallets that are not locked to specific vendors, solving the fundamental problem of key management that has historically hindered widespread adoption of decentralized identity systems.

Four foundational standards enable decentralized identity systems: (1) Distributed Identifiers (DIDs) - W3C specifications for reliably identifying things without central coordination; (2) Distributed Key Management Systems (DKMS) - standards for managing cryptographic keys across multiple devices including revocation, rotation, and lifespan management; (3) DID Authentication - protocols for reliable authentication between parties using DIDs; (4) Verifiable Credentials - standards for proving claims like driver's licenses, citizenship, work authorization, and educational qualifications without relying on central authorities.

The resolver layer talks to multiple systems (Indy, Fabric, Sawtooth, Interledger, Ethereum, BTC) and is being developed to leverage multiple blockchains without portability issues. It provides secure data store interfaces with vetted cryptographic libraries. State proof verification allows clients to validate data correctness, preventing man-in-the-middle attacks. Trust traits in Rust can reflect trust qualities, making resolvers more pluggable and extensible. A design goal is making cryptographic key management fit human relationships rather than requiring users to understand cryptographic seeds. Human brains are good at thinking about human connections but not cryptographic keys, so the system should automate complexity. The Sovereign Foundation does not endorse any vendor - it is a protocol anyone should be able to use. Context-specific identity systems make guarantees about attributes through governance authorities, registries, and auditors. Identity metta systems make no such guarantees - anyone can issue any credential, requiring chains of trust to verify credibility. Validator nodes bind attributes on the ledger and serve as trust anchors, simplifying auditing. Multiple sources of truth (steward organizations, agencies, credential issuers, government entities, employers) allow triangulation if one authority doesn't cooperate or has errors. Decentralized Key Management Systems (DKMS) enable remote revocation of identity agents. The Indy/Sovereign system is undergoing upgrades to include zero-knowledge proof capable credentials with multiple issuer signatures. Once complete, trust anchor objects will be specified for governance authorities, auditors, and creditors, looking more like smart contracts. The Sovereign Governance Framework Working Group is developing the business ontology and technical requirements for Layer 4 governance structures. The goal is for Aries to become an interoperable solution between decentralized internet data exchange initiatives. The project emphasizes practical interoperability, enabling people to talk to lots of people and accomplish things today. The project is Apache 2 license open source designed for anyone to use, whether adopting the full Sovereign network or selecting pieces.

The video introduces the Creators vs. Blood Cancer challenge where four content creators compete to register as many potential stem cell donors for the DKMS (German Cancer Bone Marrow Organization). The challenge framework includes solving location puzzles, completing individual challenges, and Side-Quests. The point system awards 1 point per registration, 2 extra points during Challenges, and 1 extra point per Side-Quest. The goal is to help cure blood cancer patients worldwide by building a large donor registry. The video demonstrates various creative approaches to registration, including street interviews, group approaches, and location-specific strategies.

Out-of-tree DKMS (Dynamic Kernel Module Support) packages are dynamically loaded as separate binaries rather than being part of the Linux kernel code. This distribution method means no source code licensing compatibility is required with the kernel, similar to how proprietary Nvidia drivers are distributed. This explains why Tuxedo drivers could technically exist without kernel license compatibility.

DIDs operate through a three-component architecture: the DID URI, a distributed key-value database (verifiable data registry), and resolution mechanisms. When a DID is resolved, it retrieves a DID document containing controller information, cryptographic keys, and service references. Different methods implement registries differently—blockchains provide decentralization, GitHub offers distributed storage, and ephemeral methods suit IoT. The cryptographic materials in DID documents enable authentication, credential verification, secure communication, and API access without centralized key management. This architecture transforms identifiers into portable cryptographic keychains.

This section covers verifiable credential exchange protocols and DID resolution methods. Exchange protocols include OpenID for Verifiable Credentials (works with any format, supports HTTP and offline scenarios), DIDCOM-based protocols (Aries, Diffie-Langley supporting any format and multiple transports), Mobile Driver License protocols (specific for MDL with NFC/Bluetooth/Wi-Fi/GPS support), and W3C Verifiable Credentials Data Model (REST APIs). DID methods include DID Key (self-resolving, ledger-independent), DID Peer (self-resolving with key rotation), DID DNS (leveraging existing DNS infrastructure), DID ION (using ION protocol on Bitcoin), DID Indy (Hyperledger Indy ledger), DID Cardano (Cardano blockchain), and DID Check (Cosmos SDK-based). Over 100 different DID methods exist for various approaches.

Daily life for individuals with DID is heavily dependent on appointments and schedules, with each day potentially being completely different depending on which personality parts are in control. The cumulative effort of managing multiple parts can lead to severe energy depletion and 'crashes' where all symptoms worsen simultaneously. Personality parts can communicate internally through dialogue and notes, but cannot directly communicate with external people as separate individuals. Conflicts between parts can occur both internally and externally, requiring careful management to maintain daily functioning and relationships.

The SD-JVC document was first introduced as an individual draft before the IETF San Francisco meeting, where it was adopted by the working group. The document was aspirational with concepts including profiling SD-JOT for verifiable credentials, defining data formats, media types, and verification rules. However, it was rough and needed significant work. The document includes sections on obtaining and validating public keys through HTTPS and web PKI, X509 certificates as root trust anchors, and DID document resolution. At IETF Prague 2018, discussion arose about whether DID resolution methods were necessary, with concerns that ID token resolution uses one method achieving interoperability, whereas DID resolution points to many resolution methods behind it. Following this, changes were made to the key resolution section, including clarification for X509 certificates and making key resolution mechanisms optional with respect to the verifier.