1 of 12

did:tdw Open Questions

Andrew Whitehead

Stephen Curran

Brian Richter

IIW 38 - April 2024

https://github.com/bcgov/trustdidweb

2 of 12

Format overview

  • Instead of did.json, did.jsonl: containing newline-separated JSON entries
  • Each entry consists of:�[entryHash, versionId, versionTime, parameters, state, proofs]
    • entryHash: calculated over [previousHash, versionId, versionTime, parameters, state]
    • versionId: incrementing integer (from 1)
    • versionTime: incrementing ISO8601 date-time
    • parameters: mapping of updates to registered parameters (method, scid, hash…)
    • state: containing either value (new document state) or patch (update to previous state)
    • proofs: a list of data integrity proofs for the current entry

3 of 12

Example first log entry

  • [ "4fbja27mgf0bumtbg2b4hbzqc2ux9a9crrqx7w6cfnd97k9u7k5g",� 1,� "2024-04-15T19:56:18Z",� {"method": "did:tdw:1","scid": "4c99uuenu8gk6n3bgf09fuf350gx"},� {"value": {"@context": ["https://www.w3.org/ns/did/v1"], … },� [� {"type": "DataIntegrityProof", "cryptosuite": "eddsa-jcs-2022",� "verificationMethod": "did:tdw:example.com:4c99uuenu8gk6n3bgf09fuf350gx#y4SDXopT",� "created": "2024-04-15T19:56:18Z", "proofPurpose": "authentication",� "challenge": "4fbja27mgf0bumtbg2b4hbzqc2ux9a9crrqx7w6cfnd97k9u7k5g",� "proofValue": "z4vP3KptRsxFcjpatqHNpywvwV5AfmAYhkH…qpRqkfKZRAHi"}� ]�]

4 of 12

did:tdw: Deriving the log URL

  • did:tdw:{SCID}.example.com�—> https://{SCID}.example.com/.well-known/did.jsonl
  • did:tdw:example.com:dids:{SCID}�—> https://example.com/dids/{SCID}/did.jsonl

5 of 12

did:tdw Resolution Process

  • Download (or stream) the log file
  • Read log lines (up to requested versionId or versionTime)
    • Check for valid, incrementing versionId and versionTime
    • Update and verify the document state (SCID and required properties)
    • Verify the hash chain
    • Verify proofs
  • Add implicit services
  • Update document ID (??)

6 of 12

did:tdw Resolution: goals

  • Correctness: the resolver must provide certain guarantees about the validity of the log and SCID derivation
  • Speed: the resolution process must not be as lightweight as possible while ensuring correctness
  • Consistency and reliability: once the log has been downloaded, the resolution outcome should ideally be predictable (except for dereferencing)
  • Flexibility: we should avoid putting unnecessary restrictions on DID document structure

7 of 12

did:tdw Resolver goals: speed

  • Resolution should be as fast as possible
  • The resolver must respect the TTL parameter when provided, and should implement a default cache duration. It could cache commonly requested document states (specific versionIds)
  • Must take advantage of ETag and Last-Modified headers

8 of 12

did:tdw Resolver goals: reliability

  • It should be difficult to DoS a public resolver instance (universal resolver plugin)
  • Avoid excessive CPU and memory requirements
  • Limit impacts on external resources

9 of 12

did:tdw Resolver goals: flexibility

  • Avoid unnecessary restrictions on document structure
    • But do check the document ID, controllers, and authorized keys
  • No white-list for supported @contexts
  • Enable adoption of novel key types and proof formats

10 of 12

did:tdw: Validating proofs

  • A resolver instance can only support a fixed set of key types and proof formats
  • It would be best if the log could indicate ahead of time the range of support that it requires by using (not-yet-defined) cryptosuite, edition, or profile parameters
  • Not every proof must be verified: entries could include proofs in multiple formats, or rewrite proofs in the future
    • proofs are intentionally excluded from the hash chain
  • Benefits of JCS normalization: no context downloads, simpler normalization

11 of 12

did:tdw External controllers

  • Requiring controller keys to be embedded in the controlled document
  • Reasonable limits on resolution of controller documents?
    • Validating proofs requires resolution at specific times
    • Resolvers cannot be asked to support every DID method

12 of 12

did:tdw: Moving a DID

  • Previous versions of a document could have different IDs, from before a relocation
  • Is it valid to return a document with an ID that doesn’t match the request?