Please describe your proposed solution
Solution Overview:
Problem: There is a growing demand for decentralized identity solutions on public blockchains. Users, legal entities, and governments often need to prove their real-world identities to other parties, before or after on-chain transactions. Establishing verifiable relationships will increase trust, simplify regulatory compliance, and accelerate adoption of Cardano.
Lacking Solutions: Cardano doesn’t yet have a complete solution in place for decentralized identity. Other solutions that establish on-chain trust based on possession of an NFT or by consistently using a well-known Cardano address have issues. With those approaches, an owner cannot easily implement security best practices like rotating keys or having multi-signature approvals while using a stable identifier. Any solution that requires publishing decentralized identifiers (DIDs) or credentials on-chain or to other public verifiable data registry is also problematic from a privacy perspective.
Identity Solution Technology: We’ve selected the Trust Over IP (ToIP) Foundation’s KERI, ACDC, and CESR specifications, and we’ll will use several components already built by the WebOfTrust community. These are designed with autonomy, security, and privacy as essential features. These comprise a strong foundation for decentralized identity and credentials that we believe will scale, evolve, and become broadly adopted. Many of its users will deploy these solutions without needing complex blockchains designed to prevent double-spend. This approach appeals to large entities and governments that are cautious about locking into an identity solution based on public blockchain technology to control their reputational trust. For more background information on the KERI stack, see the introductory posts at
<https://medium.com/finema>, specifications at <https://trustoverip.org>, and implementations at <https://github.com/weboftrust>.
Growing Adoption: In the identity technology community there is growing interest in the KERI stack, with 19 sessions at the Internet Identity Workshop in April 2024, including one from us,
<https://kentbull.com/2024/04/29/iiw-38-keri-acdc-session-list/>. Adoption of KERI solutions are beginning. The European Banking Authority is now piloting a solution where they may require European banks to report their financial results with the trusted authenticity of the reporting individuals and their official roles. See https://www.eba.europa.eu/sites/default/files/2024-04/04863f1e-1fbc-4e2ea29f-4e8115e2bf94/nord_vlei.pdf. There are multiple startups dedicated to the KERI stack. The Cardano Foundation is also actively participating with the KERI community and building KERI-based identity wallets with the goal of accelerating adoption of Cardano. See <https://identity.cardanofoundation.org/>.
Design Approach Considered: As one potential solution for Cardano, we initially explored how Plutus scripts could validate the KERI stack’s identifiers, key rotations, and credentials. With such a capability, Cardano solutions for specific use cases could require strong identity. Unfortunately, designing and implementing with those requirements would involve specialized expertise and take perhaps over a year to achieve, since it would involve complex Plutus scripts and/or enhancing Plutus itself to accommodate the design constraints. We may propose CIPs to describe what’s needed and encourage work on this problem.
Design Approach Selected: For this Fund 12 KERI Auth project, the design approach builds on top of existing Cardano and KERI capabilities. It will allow the browser extension and sample website to associate a set of Cardano addresses with an existing KERI identifier with optional credentials, by issuing a new attestation that in effect declares “I control this KERI identifier and that Cardano address.” We plan to implement or leverage CIP-0008 Message Signing to achieve this. See <https://developers.cardano.org/docs/governance/cardano-improvement-proposals/cip-0008>. Such attestations can be verified by others via KERI Auth or related services.
Use Case: We’ll implement the browser extension interacting with a demo website to generate a credential:
- The user will navigate to the website;
- Authenticate and authorize via the browser extension using KERI;
- Complete a form on the website that includes the user’s Cardano address(es);
- The website or KERI Auth extension may interact with a Cardano wallet implementing CIP-0008 to verify control over that address;
- The browser extension will then create a verifiable credential (attestation) that links the KERI identifier and the Cardano address;
- The user can share the credential; and
- Another user can receive, view and verify the credential
Project Engagement: We’ll continue to engage with the ToIP communities and a number of Cardano projects, to understand their identity needs and to validate our value proposition against those. For example, we’ve already started a discussion with Landano (a Catalyst-funded project).