Understanding Decentralized Identity with uPort on Ethereum

This tutorial demonstrates how to implement Secure Sign in with Ethereum (SIWE) authentication using RainbowKit, covering the complete process of wallet connection, message signing with nonces, backend verification of signatures, and session management with JWT tokens and cookies for secure user authentication in web applications.

Sign In with Ethereum is a decentralized authentication protocol (EIP-4361) that enables users to control their digital identity using their Ethereum account and ENS profile, solving the problem of centralized login systems where users have no control over their data; it provides a standardized message format with domain binding security features to prevent phishing attacks, allowing users to selectively share their identity data across web3 applications without relying on traditional intermediaries.

Sign-In with Ethereum is a decentralized authentication standard that enables users to sign into web applications using their own cryptographic keys, providing a unified approach to user authentication that supports both direct wallet-based authentication and identity provider-based flows, while incorporating security features like nonce validation to prevent replay attacks and domain validation to mitigate phishing attacks.

Sign-In with Ethereum (EIP-4361) is a decentralized authentication standard that enables users to control their digital identity through their Ethereum account, replacing centralized identity providers by allowing DApps to authenticate users via signed messages containing domain authority, user address, statement, version, chain ID, nonce, timestamps, request ID, and resources, while providing a consistent machine-readable format for improved user experience and consent management without requiring gas costs for end users.

Sign in with Ethereum allows users to use their Ethereum accounts as web identities, providing an alternative to Google or Facebook login systems. This approach combines with other protocols like ENS and proof-of-humanity to create anti-spam mechanisms—making it expensive and difficult to create multiple fake accounts, thereby improving security and authenticity across online platforms.

Decentralized identity (DID) enables regulatory compliance without storing all identity data or onboarding customers individually. Enterprises can onboard customers through DIDs that meet regulatory requirements (like Jumio for US requirements) without storing sensitive data. This solves the problem of high costs in identity verification and cybersecurity, where it's very cheap to claim security but expensive to actually be secure. Zero knowledge proofs enable proving information without revealing it, solving the security-privacy trade-off in identity systems. In DeFi, where trustless enforcement mechanisms exist, users don't need to reveal their identity to participate. Zero knowledge proofs allow proving someone is a US resident not on a denied persons list without revealing any more information. This enables automated trading engines that can trade regulated assets with people who can prove jurisdiction compliance without revealing identity. The technology is advancing rapidly and will enable more privacy-preserving compliance in the future.

This video demonstrates how to create verifiable credentials using Decentralized Identifiers (DIDs) and integrate them with Zero-Knowledge Proofs (ZKPs) for secure, private identity verification. The presenter shows a simple UI where users can connect wallets, create DIDs, generate claims with specified schemas (like KYC for date of birth), and verify age-based constraints without exposing sensitive personal data. The key insight is that ZKPs allow proving statements (such as being above 18 years old) without revealing the underlying information, enabling privacy-preserving credential verification on-chain.

Zero knowledge proofs (ZKPs) are cryptographic protocols that allow one party to prove possession of certain information to another party without revealing the information itself, consisting of three core properties: zero knowledge (the verifier learns nothing about the underlying data), completeness (if the prover knows the secret, they can always successfully prove it), and soundness (false proofs cannot be generated). These proofs enable privacy-preserving identity verification where users can prove attributes like age or citizenship status without revealing sensitive personal information, addressing the fundamental challenge that blockchain addresses alone cannot support complex coordination requiring identity data beyond wallet addresses.

Anonymous credentials enable privacy-preserving identity verification where holders can prove specific attributes (like salary ranges, attribute equalities, or set membership) without revealing underlying data, using composite proof systems that combine multiple cryptographic primitives including BBS+ signatures, accumulators for revocation, range proofs, verifiable encryption, and Circom-based ZK-SNARKs for arbitrary predicates, all implemented in a modular Rust/WASM architecture supporting both selective disclosure and unlinkability.

ZK Creds enables decentralized identity requiring both decentralized network and privacy to function, enabling self-sovereign identity where users prove attributes without revealing underlying information. Self-sovereign identity can leverage physical documents like passports by uploading information on-chain with cryptographic proofs of validity. ZK APIs unlock data that exists but cannot be used due to privacy or security concerns by transforming existing credentials into verifiable credentials. Hardware acceleration will become essential as ZK applications scale, with dedicated chips reducing proving and verification times within one to two years. ZK is particularly valuable for authentication scenarios where traditional server-based authentication is insufficient, enabling combining multiple cryptographic primitives for stronger attestations.

This section covers Verifiable Data Registry implementation options and SSI frameworks. VDR options include Cardano (public permissionless blockchain with proof-of-stake), Check (public permissionless blockchain based on Cosmos SDK designed for decentralized identity), Hyperledger Indy (permissioned ledger with custom consensus), and Hyperledger Besu (permissioned ledger for enterprise use). The Indy-Besu initiative is an experimental project replacing Indy's custom consensus with Hyperledger Besu, implementing SSI business logic as Solidity smart contracts. Kredo (formerly Hyperledger Aries) is a JavaScript framework implementing Indy credentials and W3C verifiable credentials, supporting multiple DID methods and VDRs. The framework provides pluggable architecture for different VDR implementations. DIDCOM is a secure communication methodology establishing encrypted channels between agents using keys associated with DIDs, supporting both online and offline scenarios over various transports. OpenID for Verifiable Credentials differs from OpenID Connect by supporting self-sovereign identity where holders present credentials directly to verifiers without intermediaries.

Polygon ID is a public blockchain project for identification that will be implemented on Polygon, a Layer 2 solution for Ethereum that is completely public. One motivation for developing this project was the failure of the 2017 referendum due to internet censorship by the Spanish government, which led to reconsideration of popular participation in internet-based systems. Unlike Bogoni's permissioned system, Polygon ID is expected to be an open-source, decentralized project with free use, allowing everyone to benefit from the system and participate in verification.

Polygon ID is a self-sovereign identity solution leveraging zero knowledge proofs. The system operates through a triangle of trust: identity holders possess credentials, issuers (governments, KYC providers, or users) issue them, and verifiers request proofs of attributes. Two issuance methods exist: signature-based (off-chain, free, verifiable on-chain) and Merkle tree-based (credential hashes in tree, tree hash on-chain). Credentials follow W3C JSON-LD standard. Users maintain multiple interchangeable identity keys with revocation capabilities through claims and revocation trees. Identity states publish on-chain, enabling anonymous membership proof. On-chain issuers can issue credentials from smart contracts, either as centralized issuers (owner-controlled) or self-issuers (based on on-chain data like token balances). The issuance process involves authenticating with Polygon ID, connecting MetaMask, and sending transactions to create Core Claims stored in smart contracts.

The decentralized identity ecosystem involves three key actors: holders (end users owning credentials), issuers (organizations like Instant issuing credentials after verification), and verifiers (businesses verifying users). These actors collaborate for cryptographic verification backed by verifiable data registries or blockchains. The Hyperledger Foundation provides three frameworks: Hyperledger Indy implementing decentralized ledger technology tailored for identity management; Hyperledger Ursa providing cryptographic libraries for strong cryptographic implementations; Hyperledger Aries providing secure and private communication mechanisms between actors. The Trust Framework created by Trust Over IP Foundation provides parallel technology and governance tracks across four layers: Layer 1 (ledger/governance), Layer 2 (DID protocol/governance), Layer 3 (credential exchange with secure communication), and Layer 4 (business domain focus like healthcare, KYC, travel).

Polygon ID provides a comprehensive technical ecosystem for decentralized identity development spanning multiple integration layers. The platform offers native mobile wallet applications for iOS and Android, third-party wallet integrations, and developer SDKs in Flutter and JavaScript for custom wallet development. Credential management includes an issuer node for issuance, revocation, and key management, with a marketplace providing access to free and paid credentials from various issuers. A schema builder tool enables developers to create custom credential schemas defining expected structures. Advanced identity features include a profiles system where users maintain multiple derived identifiers—genesis profiles, main profiles, and one-time temporary profiles—with no possibility for verifiers to link different profiles to the same identity. The iDen3Comm protocol enables transport-agnostic identity verification over HTTP/HTTPS, NFC, and Bluetooth, with special emphasis on NFC/Bluetooth implementations for enhanced privacy and offline capabilities.