Self-Sovereign Blogging

Sometime in 2011, I decided to use Flickr to host the images on my blog. My reasons for that ill-fated decision are lost, but I suspect, based on what I was doing in 2011, that I saw using cloud-based services as a way to off-load some of the work, storage costs, etc. Part of the reason for using Flickr probably has something to do with the Movable Type set up I was using in 2011. In 2013, I switched to a custom blogging platform I wrote that uses a combination of Emacs macros and a Perl program for assembly of the content files. I stopped using Flickr for this purpose in 2016 and just hosted the images myself, but all the entries on my blog for that 6-year period still used Flickr.

Not too long ago, I noticed that all the images being served by Flickr had a black background like this:

fuse microservice overall

Not exactly what I want. I suspect that some change at Flickr having to do with transparent images caused this. Admittedly, storing diagrams with transparent backgrounds for a blog is not Flickr's mainstay, so I don't blame them for this. They're just pursuing their own objectives. And that's the point I'm making:

Without a contract that gives me clear promises about what Flickr intends, I'm at their mercy. Note that this is true with any cloud service, especially those you're not paying for or using outside their main use case. They can go away at any point. They can change their business model. We've seen plenty of online services go away. We should expect it.

So, I decided I needed to fix my blog by hosting all the images myself. Fortunately, I can program, so I wrote a Perl program to do the following:

  1. Open the blog file and run through it looking for images hosted at Flickr, keeping a list
  2. Download all the original images from Flickr (which involves parsing the Flickr page to find the right URL for the original image file)
  3. Process the blog file, replacing all images referenced in the anchor and image tags with the names of the local files.

Of course, that simple algorithm ignores all the little problems that always come up. But writing the program was fun and now, I'm running it (slowly to not look like a DDoS attack to Flickr). Soon, my cloud problem will be in the past and my blog will be self-sovereign. Of course, I still rely on hosting (AWS) and DNS (Google) but those are much more basic services that are likely to not go away anytime soon. And if they do, there are clear substitutes.


Centralized Services Needn't be Evil to be a Problem

Microsoft Passport Logo

I ran across this story today about Microsoft forgetting to renew the Passport.com domain and cutting off millions of users from service. It's no longer available at its original home, so the link is to the Wayback machine copy.

There are several lessons here:

  1. We like to talk about centralization being bad because it potentially gives power to evil actors. But let's not forget that centralization can be bad merely because organizations can be incompetent, forgetful, or inept. Leadership shifts. Policies expire. Companies fail. Systems decay. By all accounts, Microsoft is a well-run place, but relying on a single actor to make things work for millions is no way to do something as fundamental to human autonomy and dignity as digital identity.
  2. The use of just-in-time callbacks to build trust in an identity credential can put millions out of service for simple authentication checks. Imagine if every use of the driver's license required a real-time call back to the Drivers License Bureau. Instead, let's build identity systems that allow people to hold credentials that don't need real-time verification to check fidelity and provenance.
  3. Domain names are not identity. They're rented and so can't be permanent. The story on doublewide.net is interesting history, but the domain was impermanent. Thankfully, places like the Wayback Machine preserve some of it. Consider donating! I did.


Future-Safe Archives

In an interesting podcast format—voicemails—Dave and Doc raise the issue of future-safe archives. This is one of those important, but not-urgent-enough issues that gets far too little attention.

As they point out, we have Internet Archives, but that's just a copy and, while better than nothing, doesn't always preserve the original. I've got several different thoughts in my head after listening to Doc.

First, I think preserving things is worthwhile. When Doug Kaye decided to shut down IT Conversations, he did so early enough that he could "endow" its preservation at Internet Archives and pay for the preservation of the domain name, at least for a while. Consequently all the links still work. And the shows are still available. It's not perfect (e.g. the pictures don't load—at least not today), but it is preserved.

My second thought is that the Web is a fluid place. Hence the WayBack Machine. Doc and Dave are discussing blogs, and they grow but old stuff doesn't often change. (Hey! They're like blockchains! :) ) I can easily envision archiving and preserving blogs. Other sites are harder. I think about iMall, for example. iMall was an ecommerce company I founded with Ross Jardine in 1994 and worked on until we sold it to Excite@Home in 1999. There were thousands of variations to iMall.com over the years. The WayBack Machine has many of them, but not likely all. What does it mean to preserve that? I'm not sure. Maybe the WayBack Machine is the best we can do.

P.S. This new podcast needs an RSS feed!

Update: Dave says: "Phil, the RSS feed is the feed of my blog. I'm going to wait until it gains traction, i.e. Doc and I get a regular thing going, to give it its own feed." Fair enough.


Four Pillars of an SSI Network

The restored Stoa of Attalos in Athens

A few weeks ago Andy Tobin posted an excellent piece on the Three Pillars of Self-Sovereign Identity:

  1. Secure connections
  2. Digital data “watermarking”1
  3. A trusted, tamper-proof public key directory

I encourage you to pop over and read it to understand the technical underpinnings of SSI. The point Andy is making is that all of these are necessary for a functioning SSI system. I hear far too many people saying that decentralized identifiers (DIDs) are all you need. That's like saying the Web is all about HTML, ignoring HTTP and URLs.

But, a functional identity metasystem needs more than just technical standards. We often hear that the internet is a product of standards, and while that's true, it also only exists because people strung cable, wrote code, created rules, built organizations, and formed alliances. SSI has similar needs and meeting them won't happen just because we define nice protocols and write some open source code. I wrote about this earlier in a piece on Decentralization and Coherence.

Social systems that are enduring, scalable, and generative require coherence among participants. Coherence allows us to manage complexity. Coherence is necessary for any group of people to cooperate. The coherence necessary to create the Internet came in part from standards, but more from the actions of people who created organizations, established those standards, ran services, and set up exchange points.

A functioning network for an identity metasystem is a social system, and building it requires a means of building coherence to align the actions of people and organizations. We created the Sovrin Foundation to do that. Over time its role may change, but right now, there are important tasks that must be done to create coherence.

Building a functional SSI network requires that, in addition to the technical standards, we work on several core areas: governance, community, operations, and adoption.

Governance

In a blog post on recent revisions to the Sovrin Governance Framework, I wrote:

Others in the blockchain space might wonder why Sovrin spends so much time, energy, and money complying with regulations. It's not just about various actors in the system being risk averse. An identity system that you can't use everywhere is just a different technology implementation of what we have now with Login with Apple (or Amazon or Google or Facebook or...). Credential issuers and credential verifiers of all stripes, including banks, governments, educational institutions, etc, must be comfortable with using Sovrin for it to gain universal adoption as an identity metasystem. These institutions will avoid using any system that is perceived as rogue or otherwise non-compliant

If the Sovrin community is not aiming to build a universal, interoperable system, then we're just building another silo that perpetuates all the problems with the existing silos: inflexibility, insecurity, and inconvenience.

Governance is critical to universal interoperability in an identity metasystem because all participants must be able to make their own decisions about who and what to trust. Governance gives assurances by providing process and accountability. As this Hackernoon article from Agata Slater says:

The hard part [of bootstrapping SSI] is setting up the governance and collaboration model that will ensure that the federation is reliable, secure, and affords appropriate data protection.

In particular, trust, the reason for an identity metasystem, can't exist without credential fidelity and provenance. And those require governance.

Community

The Sovrin community is the heart of what makes the identity metasystem work and is composed of identity owners, developers, Stewards, businesses, and other organizations, all acting in multiple roles, such as credential issuers, holders, and verifiers, and with varied interests, business models, compliance requirements, and geographic representation.

Developer involvement is one of the keys to a thriving identity metasystem. As I said earlier, standards are essential, but you need code to bring them to life. Interoperability requires more than standards. It needs a strong community of developers collaborating to ensure their solutions work together. Developer communities, like any other social system need coherence. Look at successful open source projects like the Linux Kernel, React, or Homebrew and you'll find a tribe, institution, market, or network, depending on scope and scale who served as the backbone of its global adoption.

Sovrin Foundation supports developers around the world in the Hyperledger Aries, Indy, and Ursa projects. This support includes project coordination and organization, training on the code bases so developers can come up to speed quickly, and bringing together the various groups as we did in the recent Aries Connectathon.

Another important community is comprised of the organizations who use Sovrin to build identity systems for their specific needs. While using a verifiable credential within a single industry vertical is a significant step forward, we believe the real benefit of an identity metasystem is when you can present a credential from your bank to a car dealership. Sovrin-based identity systems will open a world of possibilities that are only dreams today. The Foundation works to bring participants together in community-lead meetings, and through working groups where participants can solve problems together. The Sovrin Alliance is an important part of this effort.

Operations

The foundational layer of the Sovrin Network is a ledger for storing DIDs, credential definitions, and other important artifacts, that everyone needs for making trust decisions. Validation on the Sovrin ledger is based on a known set of nodes run by the Stewards. To operate the nodes on the Sovrin Network, the Sovrin Stewards use the open source code housed in the Hyperledger Indy project. They run code produced by the Hyperledger Indy project.

Some of the key operational functions of the Sovrin Foundation are coordinating code releases and supporting Stewards. The Foundation Ops Team monitors the nodes which run the Sovrin Network to ensure they operate in accordance with the Governance Framework and the network meets important requirements, like censorship resistance.

Sovrin Stewards are organizations approved by the Trustees to operate a node to maintain the Sovrin Ledger. The ledger is permissioned, meaning that the nodes are run by organizations known to the Foundation and in accordance with the Governance Framework. Stewards must contractually agree to the Sovrin Steward Agreement and Steward Data Processing Agreement with the Sovrin Foundation. These agreements commit them to terms and conditions relating to confidentiality, intellectual property, and data privacy, among others. The nodes run an RBFT consensus algorithm called Plenum to come to agreement on the content of the ledger. Stewards can include for-profit and not-for-profit entities as well as governments or anyone else who abides by the Sovrin Governance Transaction Author and Transaction Endorser agreements who wants to write transactions to the Sovrin Ledger.

Three ledgers are in operation now: the mainnet for production use, a buildernet for testing, and the stagingnet for non-production use that requires more performance stability than the buildernet offers. Depending on the needs of the Sovrin community, there could be other ledgers in the future.

Because Sovrin is a permissioned network, validator nodes are chosen for each of these ledgers according to a node selection algorithm defined by Sovrin's Technical Governance Board. The Foundation provides staff to monitor node selection, coordinate communications with Stewards, Transaction Endorsers, and Transaction Authors, and ensure the network is technically strong and operating in accordance with Sovrin governance agreements.

Advocacy, Evangelism, and Adoption

The fourth key function of the Sovrin Foundation is evangelizing self-sovereign identity and bringing people and organizations together to spur adoption. The Foundation achieves this using a three-pronged approach.

  1. First, we focus on building awareness of and affinity for self-sovereign identity. Sovrin Foundation is a non-profit, open-source project formed to advance the development and adoption of tools, products, and services that are aligned with the Sovrin Governance Framework. We believe having a trusted leader in decentralized identity space sets the Sovrin ecosystem apart from other SSI community efforts.
  2. As many organizations actively contribute and participate in the Sovrin ecosystem, we also channel marketing efforts around the individual projects and their own respective value propositions, bringing awareness to specific features and communities.
  3. Finally, Sovrin Foundation works to highlight, promote and bring awareness to individual use cases and what they are providing their customers. Our aim is to connect all parts of this new evolving ecosystem to grow the adoption, and widespread use of self-sovereign identity and the Sovrin Network.

Our efforts include:

Advocacy: The are numerous organizations, groups, and efforts around the world working on SSI. Some of these are formal standards bodies, policy, and advocacy organizations. Some are community organizations with specific purposes. Sovrin Foundation facilitates the participation of staff and volunteers in these efforts to guide SSI developments in ways that are consistent with the principles that are part of the Governance Framework.

Sovrin Blog: The Sovrin Foundation blog is read by thousands and provides an opportunity to broadcast the latest news and views to a wide audience beyond the core ecosystem participants. Selected content may include summaries of important updates, both Governance and Technical, but it may also include stories about events, use cases, industry insights, and other topics that may be of interest to the community.

Community Events: In 2019, the Sovrin Foundation participated in nearly 60 events around the world. Employees, volunteers, and active members of the Sovrin Ecosystem traveled great distances at great expense to promote, educate, and participate in conferences, workshops, working groups, meetings, and speaking engagements.

Marketing & PR Channels: The monthly Sovrin Newsletter will celebrate its two year anniversary in 2020, never missing an issue. The newsletter provides a regular recap of news, events, profiles, and announcements from around the Sovrin Community. Along with the social media channels, Rocket.chat, and forums, Sovrin works diligently to keep the lines of communication open between the employees, volunteers, and community.

Analyst Relations: Industry reports from third parties is a vital part of the Sovrin Foundation community engagement strategy. In 2019, Sovrin communicated with industry analysts (also known as research analysts) from six of the top independent research and consulting firms. These inquiries resulted in multiple mentions and positive attention in key industry reports on self-sovereign identity, decentralized identity, and blockchain.

Trademark & Brand: Adhering to the strong brand guidelines of the Sovrin Foundation offers an important as a trust signal to people using the Sovrin Network. A strong brand also helps avoid market confusion and serves to align the fast-growing community to reap optimal benefits when discussing association with Sovrin. The Sovrin Foundation has registered Sovrin® as a trademark in the United States and other countries to help with this effort.

Membership: There are many ways to be part of the Sovrin community. As more organizations find their way to Sovrin and self-sovereign identity, Sovrin Foundation makes every effort to onboard these groups to participate in the Sovrin Foundation as members of the Sovrin Alliance, Stewards, volunteers, and as open source contributors. Stay tuned in 2020 for more information spotlighting each of these important groups and how you too can be “Sovrin.”

Conclusion

In the Coherence and Decentralization post I referenced earlier, I talk about the four ways humans build consensus: tribes, institutions, markets, and networks. Sovrin Network's tribal days are past, but we still employ each of the other three methods in bringing people together and building a successful and functioning network.

Over time, the Foundation's role will moderate as more and more of the coherence is created through markets and the network itself. However, we must not underestimate the value of community leadership, guidance, and administration of network governance policies, especially as we bootstrap a thriving community. Without the Foundation as an objective and independent entity, there is much greater potential for mis-use, abuse, and strong-arm tactics that can remove the democratization of the underlying technology. There are no shortage of examples in the recent history of the digital economy that point to the need for objective governance that can ensure access to resources that can truly move self-sovereign identity to the world on a one-to-one basis so that is not controlled by a few large-scale players. There will always be a role for the Foundation that has the mission of ensuring that this technology truly provides “Identity for All” with equal and affordable access and opportunity for everyone.


Notes

  1. By "watermarking", Andy is referring to the verifiable credentials standard and Hyperledger Aries credential exchange protocol.

Photo Credit: The restored Stoa of Attalos in Athens from Adam Carr (CC0)


Recent Revisions to the Sovrin Governance Framework

Yesterday the Sovrin Board of Trustees approved the latest revision to the Sovrin Governance Framework (SGF). This revision has been about a year in the making and gives us a way to satisfy GDPR and other privacy regulation requirements and giving Sovrin Stewards the comfort of knowing that they are not in violation of GDPR because they run a validator node. (I'll just use GDPR in the remainder of this message, but understand it's not just GDPR, but any privacy regulation.)

At present all Sovrin ledger writes are permissioned. If you read the SGF, Transaction Authors (TAs) will still need to work with a Transaction Endorser (TE) to write to the ledger. But the SGF anticipates moving to public writes where a TE is not required. There are two things standing in the way of public writes: (a) having a token on the ledger so that TAs can pay for writes directly to the ledger (payments reduce SPAM) and (b) an understanding of how the ledger can be compliant with GDPR if an individual can write DIDs to the ledger for themselves (these are considered peronally identifying information, or PII, under GDPR).

GDPR Contract
Sovrin Ledger Contractural Roles (click to enlarge)

Others in the blockchain space might wonder why Sovrin spends so much time, energy, and money complying with regulations. It's not just about various actors in the system being risk averse. An identity system that you can't use everywhere is just a different technology implementation of what we have now with Login with Apple (or Amazon or Google or Facebook or...). Credential issuers and credential verifiers of all stripes, including banks, governments, educational institutions, etc, must be comfortable with using Sovrin for it to gain universal adoption as an identity metasystem. These institutions will avoid using any system that is perceived as rogue or otherwise non-compliant.

Being compliant with regulation of all sorts, while being true to the principles of Sovrin (PDF) and protecting against censorship, is a fine line. The SGF is a critical tool in staying on that line because it's a clear statement by everyone in the Sovrin ecosystem of what they believe, what principles they follow, and how they operate. The SGF is a public statement of how the Sovrin network functions. This is the key to global adoption of the identity metasystem that provides a universal trust framework for the Internet.

In addition to the revisions to the SGF, we've promoted the Guardianship Task Force to an indepedent working group. You've probably noticed that Sovrin's tagline is "identity for all". But it's more than a tagline, it's our vision. The community volunteers in the Guardianship WG are working to ensure that Sovrin can serve people who don't have digital access or legal capacity. These people might be refugees, but the group also includes minors, the infirm, people using a power of attorney, and others.

Recently the Guardianship WG published a white paper that I think is the state of the art in understanding guardianship in digial identity systems. You can find the whitepaper and more information about the working group on their homepage.

I'm very grateful for the many volunteers who make up the SGF Working Group. They do this important work because they care about an internet that respects human autonomy and dignity and are willing to sacrifice their time and effort to bring it into being.


Fidelity, Provenance, and Trust

In a recent thread on Twitter, Steve Wilson, Tim Bouma, Josh Geno, and I had a nice discussion about the use of the word "trust" to describe credential exchange.

Steve suggested the words "fidelity" and "provenance". I like those. I wrote the following to use them in describing credential exchange in the SSI Stack. Note that I didn't get rid of the word "trust" completely, but it moved from being a catch-all descriptor to a result.

The SSI Stack
The SSI Stack (click to enlarge)

Verifiable credentials contain claims about attributes. Credential issuers provide credentials containing claims to credential holders who use them to prove things about themselves to credential verifiers. For example, my employer may provide me with an employment credential that I hold and present to my bank when applying for a loan to prove to them that I've been employed three years and have a salary greater than a certain amount.

The identity metasystem (orange box) provides assurances about the fidelity of the credential: the identifier of the issuer and that the credential was issued to the holder who is presenting it, hasn't been tampered with, and hasn't been revoked.

The verifier is also concerned with the credential's provenance: who issued it (not just their identifier) and on what authority they issued it under? Provenance depends on the design of the context-specific identity system (blue box). The verifier may ascertain the provenance of the credential in any way that satisfies them. In some cases, they may know about the issuer directly (e.g. many banks would know about local employers). In other cases, they may rely on things the business can prove about itself (e.g. I can determine if a business is a legally registered entity and other information from credentials they can present such as a business registration credential). Still further, the business may be part of a larger, formal organization that governs how they operate (e.g. an accredited university or a regulated bank).

The fidelity provided by the identity metasystem, combined with the credential provenance provided by the context-specific identity system operating on top of it, provides the basis for trusting the information that the holder has conveyed through credential exchange.


Self Sovereign is Not Self Asserted

passport validation

From time to time, I run across the idea that self-sovereign identity (SSI) systems like Sovrin are necessarily self-asserted. This is the myth: that SSI means that the person gets to say anything they want and the relying party just has to accept it. This is NOT what SSI means.

Sovrin is an identity metsystem based on the exchange of verifiable credentials. The verifiable credential pattern is shown in the figure below.

Verifiable Credential Exchange
Verifiable Credential Exchange (click to enlarge)

There are three parties: the credential issuer, the credential holder (identity owner), and the credential verifier. So, imagine that a company (issuer) has given Alice (holder) an employment credential. Alice can then present information from that credential to her bank (verifier). In this example, the information Alice is presenting to the bank is not self-asserted. Rather, Alice's employer is asserting it.

Why does the bank trust it? They might not. The verifier is free to determine whether or not to trust the credential. In making that determination, there are two kinds of evidence the bank needs. First, the bank needs to trust that the exchange process is secure. Specifically, they are interested in determining that the credential was issued to the presenter, that is hasn't been tampered with, and that it hasn't been revoked. These properties can be validated cryptographically.

Second, they are interested in who issued the credential and whether they trust the issuer. The issuer can be identified in a trustworthy way in the credential. But whether the bank trusts that it's a real employer is not a crypotographic question. They might know the employer through other means or they might need to have the employer prove things about themselves. But either way, they have to have a process for determining whether or not to trust the issuer.

In Sovrin, people hold numerous credentials from a variety of issuers, just like we do in the physical world. They use those credentials to prove things about themselves to relying parties. They may, as part of the interaction, self assert information when that's acceptable to the relying party. But they also have the means of bringing trustworthy evidence from other parties to the interaction. This is not easy to do online using current identity systems. But that changes when when people can use credentials from multiple issuers to prove things about themselves.


Photo Credit: Passport Stamp from Max Pixel (CC0)


Life-Like Identity: Why the Internet Needs an Identity Metasystem

Friends Eating

Imagine you are planning to meet a friend for lunch. You arrive at the restaurant on time and she’s nowhere to be found. You go to the hostess to inquire about the reservation. She tells you that your reservation is correct, and your friend is already there. She escorts you to the table where you greet your friend. You are seated and the hostess leaves you with a menu. Within a few moments, the waitress arrives to take your order. You ask a few questions about different dishes. You both settle on your order and the waitress leaves to communicate with the kitchen. You happily settle in to chat with your friend, while your food is being prepared.

In this scenario, you, your friend, the host, and waitstaff recognized, remembered, and interacted with people, places, and things countless times--that is “identity”. And this happened without anyone being aware that there was an identity system in play.

In the physical world, we effortlessly use identity to enable countless daily interactions. These interactions might be trivial or profound, temporary or permanent. We do this without any intervening administrator, without permission, without significant effort, and usually without much thought.

Identity just works--until you go online. Imagine this same scenario, helpfully curated by digital assistants.

You arrive at the restaurant after installing the FoodFinder app this restaurant uses to allow itself to be located. Of course, you have to create an account and log in. Once you find the place, you don’t see your friend, but then you recall you’re in the Alpha system and she’s Bravo, so you have to install the MeetWithFriends app that works in both. Once you open that app and log in, she is now visible, and you exchange greetings. After several minutes of explanation of the steps that she took to get to the table, you realize that you need to interact with what used to be the hostess station. It’s now a kiosk with a digital tablet. You attempt to sign in, but they’ve recently updated to HappyHostess from their previous system. Unfortunately, HappyHostess doesn’t have the data from the old system, so after you install the app, you are a new customer again and all your dining points have vanished. Oh well. The app gives you on screen directions to your table. After several wrong turns, due to unfamiliarity with the new app, you finally see your friend and can be seated. But you still can’t order or even talk to your friend at the table without logging into the restaurant’s LunchForYou app!

Unfortunately, we aren’t too far from this scenario now. In Alistair MacTaggart’s testimony before the Senate Commerce Committee in October, 2018, he described his experience at the local Super Cuts which required that he register with his email address and cell phone number at a kiosk in order to get a haircut. Frequent air travelers now encounter iPads at the restaurant tables in airports, so their order can go directly to the kitchen without human intervention. Unfortunately, it’s almost impossible to ask questions or have some special request. Your payment details go into the main system to correlate with whatever other information they have about you in order to “serve you better.”

Unfortunately, we are making identification in the offline world more like the complicated and messy digital world. Rather we should be building digital systems that mimic the natural and seamless interactions we have in the physical world.

The Problems with Digital Identity

Digital identity is broken because the Internet was built without an identity layer.

We say this so often it’s become cliché. The idea was made famous by a New Yorker cartoon that says, “On the Internet, nobody knows you’re a dog.”

But the reality is far from funny. The missing identity layer has resulted in a mishmash of one-off identity systems because every web site, service provider, and application has solved the problem in a unique way. As a result, people and organizations who use the Internet are subject to cognitive overload, friction, increased costs, loss of privacy, and even outright fraud.

Fixing the Internet’s identity problem is hard. There have been numerous systems, protocols, and standards proposed over the past 20 years. While most of them have provided improvements and fixed specific problems, none have offered a holistic solution.

To see why digital identity is so hard, let’s explore some specific problems that the online world presents that make identity different from the physical world1.

Proximity - Because we're not interacting with people physically, our traditional means of knowing who we're dealing with are useless. None of the familiar signals of the physical world are present. Consequently, it is difficult to reliably recognize and remember people and organizations online. Organizations have built so-called “administrative” identity systems to serve their own needs in recognizing and remembering their customers, but people don’t have the same capabilities. Consequently, we’re mired in myriad, incompatible systems built for narrow purposes.

Autonomy — Each of these administrative systems is built for the convenience of the organization who controls it. Design choices for these systems are made to maximize the legibility of people to the organization for its purposes. The balance of power is severely skewed toward one party over the other. Consequently, people have very few natural rights and little leverage online. Current online identity systems significatly reduce individual freedom and autonomy.

Privacy — No one will be surprised to learn that computers are very good at pattern matching. But a consequence of this is that online identity has very different implications for privacy than physical-world interactions. When you hand your driver’s license to the bartender to establish your legal age, you would be surprised if she could remember all the detailed information it contains, like your address, and do that for every patron she encountered. Computers, on the other hand retain a perfect memory of all the information they are presented with until they are told to forget.

Anonymity — Anonymity is closely related to privacy. In real life, we do without identity systems for most things. You don't have to identify yourself to the movie theater to watch a movie or log into some system to sit in a restaurant and have a private conversation with friends. Our interactions in the physical world are naturally anonymous. The ticket taker at a movie theater does “identify” you momentarily for purposes and checking your ticket, but that connection is ephemeral and thus anonymous for most purposes. Many online interactions could make use of ephemeral relationships as well in support of better privacy.

Flexibility — Closely related to the autonomy problem is one of flexibility. Current online identity systems are built for very narrow purposes. But real life is messy with billions of use cases. People are innovative and infinitely diverse. None of us presents the same picture of ourselves to everyone and everything—how we recognize, remember, and interact is highly dependent on the context.

Interoperability — A consequence of myriad identity silos is that we are unable to carry context from system to system. Your friend in one system might have a different identifier in another. The means you have for recognizing and remembering varies from system to system.

Scale — There are billions of people online. Each of them has dozens, even hundreds of relationships. The Internet of things promises to increase that by several orders of magnitude. Consequently, a general-purpose identity system needs to account for trillions of relationships between the many billions of people, organizations, and things that make up the online world.

An Identity Metasystem

Solving these problems requires building something more abstract and general than the one-off, context-specific identity systems of the past. The Internet is a monument to abstraction and generality. Rather than being a communications system like the telephone, the Internet is a communications metasystem. That is, the Internet is a system for building communications systems. Every new protocol changes the kinds of messages that the Internet can communicate and thus changes its nature.

Similarly, an identity layer for the Internet must be a metasystem that provides the building blocks and protocols necessary for others to build identity systems that meet the needs of any specific context or domain. An identity metasystem is a prerequisite for an online world where identity is as natural as it is in the physical world. An identity metasystem can remove the friction, decrease cognitive overload, and make online interactions more private and secure.

In 2005, Kim Cameron, Microsoft’s Chief Identity Architect, published the Laws of Identity (PDF), a paper that laid out seven important principles for how digital identity should work. In that paper, Kim describes an identity metasystem—a collection of interoperable identity systems—that can provide the missing identity layer:

...different identity systems must exist in a metasystem. It implies we need a simple encapsulating protocol (a way of agreeing on and transporting things). We also need a way to surface information through a unified user experience that allows individuals and organizations to select appropriate identity providers and features as they go about their daily activities. The universal identity metasystem must not be another monolith. It must be polycentric (federation implies this) and also polymorphic (existing in different forms). This will allow the identity ecology to emerge, evolve and self-organize.

From Kim’s description, we can identify several important features of an identity metasystem:

Encapsulating protocol—Protocols describe the rules for a set of interactions. An encapsulating protocol, then, describes the kinds of interactions that can happen without being overly prescriptive about the nature or content of those interactions. Thus, the encapsulating protocol enables a flexible set of interactions that can be adapted for specific contexts and needs. Protocols are the foundation of interoperability and allow for scale.

Unified user experience—Part of the beauty of natural identity systems is that we don’t have to switch apps or learn an entirely new way of interacting for each context. A unified user experience doesn’t mean a single user interface. Rather the focus is on the experience. As an example, consider an automobile. My grandfather, who died in 1955, could get in a modern car and, with only a little instruction, successfully drive it. Unified user experiences let people know what to expect and so they can intuitively understand how to interact in any given situation regardless of context.

User choice—By allowing people to select appropriate service providers and features, a metasystem allows for autonomy and flexibility. No single system can anticipate all the scenarios that come up as people live their lives. A metasystem allows for context-specific scenarios to be built and even supports ad hoc interactions that no one anticipated.

Modular—An identity metasystem can’t be a single, centralized system with limited pieces and parts. Rather, the metasystem will have interchangeable parts, built and operated by various parties. Protocols and standards enable this. Modularity supports substitutability, a key factor in autonomy and flexibility.

Polycentric—An identity metasystem is decentralized to enable autonomy and flexibility. No single system can anticipate all the various use cases. And no single actor should be allowed to determine who uses the system or for what purposes.

Polymorphic—The information we need to recognize, remember, and interact with various people, organizations, places, and things is context dependent and varies widely with the situation. The content that an identity metasystem carries must be flexible to support these.

The Laws of Identity

Kim follows this description of the metasystem with seven laws of identity that are designed to ensure that the metasystem is sufficiently respectful of autonomy, privacy, and security.

User Control and Consent—Technical identity systems must only reveal information identifying a user with the user’s consent.

Minimal Disclosure for a Constrained Use—The solution which discloses the least amount of identifying information and best limits its use is the most stable long-term solution.

Justifiable Parties—Digital identity systems must be designed so the disclosure of identifying information is limited to parties having a necessary and justifiable place in a given identity relationship.

Directed Identity—A universal identity system must support both “omni-directional” identifiers for use by public entities and “unidirectional” identifiers for use by private entities, thus facilitating discovery while preventing unnecessary release of correlation handles.

Pluralism of Operators and Technologies—A universal identity system must channel and enable the inter-working of multiple identity technologies run by multiple identity providers.

Human Integration—The universal identity metasystem must define the human user to be a component of the distributed system integrated through unambiguous human-machine communication mechanisms offering protection against identity attacks.

Consistent Experience Across Contexts—The unifying identity metasystem must guarantee its users a simple, consistent experience while enabling separation of contexts through multiple operators and technologies.

These laws describe outcomes without prescribing implementation. But they constrain architectural choices to ensure that the universal identity metasystem is not just usable, but also safe and secure.

Architecting a Universal Identity Metasystem

A universal identity metasystem must allow people to not only self-assert information but also bring to bear information that other parties know about them in any identity transaction.

The metasystem architecture has three primary features that allow it to be used as the basis for any context-specific identity system that is needed:

  1. Relationships—the architecture must allow people, organizations, and things to have relationships with each other.

  2. Messaging—the architecture must support messaging between the parties to those relationships.

  3. Trustworthy Attribute Exchange—parties to relationships must be able to reliably exchange information about attributes (often called claims by identity professionals).

The architecture for the identity metasystem supplies these features using layers that build on each other as depicted in Figure 1.

The Sovrin SSI Stack
Figure 1: The Sovrin SSI Stack (click to enlarge)

Relationships are created using a system of peer-to-peer agents in Layer 2. These agents exchange decentralized identifiers (DIDs) to create a relationship2. Because DIDs are cryptographic artifacts tied to public-private key pairs, this exchange provides the agents with the means to perform mutual authentication and create an encrypted channel. Agents use a messaging protocol called DIDComm to exchange messages.

DIDs exist in two forms, public and peer, which correspond to Cameron’s “omnidirectional” and “unidirectional” identifiers in the law on Directed Identity. Public DIDs can be universally resolved to reveal the public key and service endpoint of the owner. Peer DIDs are exchanged between parties to create relationships.

Agents exchange attributes over the channel created in Layer 2 using a flexible, decentralized system of credential exchange illustrated at Layer 3 in Figure 1. In credential exchange there are three parties: the credential issuer, the credential holder (sometimes called the identity owner), and the credential verifier (also known as the relying party).

A credential is a collection of claims (i.e. attributes) that is signed by the issuer and held by the identity owner. Credentials conform to the Verifiable Credential specification. While the word “credential” conjures images of formal documents, almost anything that can be represented in JSON can be attested using a credential. So, while things like passports and driver’s licenses fit this bill, so do things like membership cards, boarding passes, school report cards, invoices, purchase orders, and store receipts.

To see how credential exchange works, suppose Alice (the identity owner) is applying for a loan at her local bank (the credential verifier). The bank requires proof that Alice is employed and makes at least $70,000 per year. As shown in Figure 2, Alice’s employer (the credential issuer) has issued an employment credential that includes her employment status and her current salary. It might also include many other attributes related to Alice’s job. Alice holds the employment credential and can present it to prove to the bank that she is employed and makes more than $70,000.

Verifiable Credential Flow
Figure 2: Verifiable Credential Flow (click to enlarge)

When Alice proves her employment status to the bank, she doesn’t present the entire credential since doing so would reveal more information than is necessary. Instead, Alice presents just the information the bank needs using a cryptographic technique known as “zero knowledge proof.” The ability to limit the information presented from a credential is important to maintain privacy through the principle of minimal disclosure.

Trust and Accountability

For the identity metasystem to be useful, it has to trustworthy. Privacy can't come at the expense of accountability. For the metasystem to be trustworthy, Alice’s bank needs two levels of trust: first it needs to trust the mechanism of credential exchange provided by the metasystem. Specifically, the bank wants to know:

  1. Who issued the credential,

  2. That the credential was issued to Alice,

  3. That the credential hasn’t been tampered with, and

  4. That the credential hasn’t been revoked.

Trust in the metasystem is dependent on the ledger shown in Layer 1 in Figure 1. Alice’s bank can verify these four properties by looking at the credential definition on the ledger, retrieving the public DID and associated DID Document of the issuer from the ledger, and using the public key in the DID Document to check the signature of the credential to ensure it hasn’t been tampered with. The bank can also cryptographically verify that it was issued to Alice. As part of making her proof from the credential, Alice also proves that it has not been revoked by referencing the revocation registry, which is also available on the ledger. And, thanks to the ledger, the bank can do all of this without contacting the employer helping preserve Alice’s privacy.

The second level of trust depends on whether the bank can trust employer. The metasystem cannot supply this second level of trust. The bank wants to know that the identifier in the credential is associated with a legitimate business, the details of that business, and whether Alice really works there. The bank has several options for making these determinations depending on their internal policies. They could use an out of band method to validate the identifier of the issuer by, say, looking up the public DID of the issuer on their web site.

But in many cases, something more formal is required. This level of trust is provided by Layer 4 in Figure 1, context-specific governance and trust frameworks. Businesses, for example, are subject to regulation by the state they are located in. The regulatory framework for how businesses are registered constitutes the governance for a specific trust framework for legal businesses in that context. Figure 3 shows the credential flow from Figure 2 augmented with a governance framework.

Context-specific trust frameworks are numerous and varied. In most cases, they already exist because different domains have already established them for their own purposes. Defining credential schema and use cases, along with creating associated trust frameworks, is how identity systems are created on top of the identity metasystem.

Governance Frameworks in a Credential Flow
Figure 3: Governance Frameworks in a Credential Flow (click to enlarge)

A Universal Trust Framework

Relationships and interactions require trust. All new relationships have a "trust gap" that separates a place of certainty from something that is unknown. Some force has to help us "make the leap" from certainty to uncertainty and that force is trust3.

Traditionally, we've relied on local trust that is based on knowing someone—acquired knowledge or reputation. In a village, I know the participants and can rely on personal knowledge to determine who to trust. As society got larger, we began to rely on institutions to broker trust. Banks, for example, provide institutional trust by brokering transactions—we rely on the bank to transfer trust. For example, I don't need to trust you to take your credit card.

But institutional trust is problematic in the digital age. Trying to use ever-larger institutions to create trusted online interactions is what has gotten us into the current privacy mess, exemplified by security breaches and surveillance capitalism.

The identity metasystem represents a third way—a universal trust framework. A trust framework provides the structure necessary to overcome the trust gap and make the leap from the known to the unknown. Trust frameworks are all around us, but they are one-offs, too specialized to be universally applicable. For example, AirBnB is a trust framework, but the platform can only be used by AirBnB for trust transactions between hosts and guests. We can easily imagine AirBnB (or the next sharing platform) engineering their system to use the identity metasystem instead4.

The identity metasystem represents a universal trust framework because its trust model has five important characteristics:

  1. Credentials are decentralized and contextual—There is no central authority for all credentials. Every party can be an issuer, a holder (identity owner), or a verifier. Verifiable credentials can be adapted to any country, any industry, any community, or any set of trust relationships.

  2. Credential issuers decide on what data is contained in their credentials—Anyone can write credential schemas to the ledger. Anyone can create a credential definition based on any of these schemas.

  3. Verifiers make their own trust decisions about which credentials to accept—There's no central authority who determines what credentials are important or which are used for what purpose. The metasystem supplies the technical underpinnings for cryptographic trust, upon which context-specific trust frameworks can operate.

  4. Credential verifiers don't need to have any specific technical, contractual, or commercial relationship with credential issuers—Verifiers do not need to contact issuers to perform verification.

  5. Credential holders are free to choose which credentials to carry and what information to disclose—People and organizations are in control of the credentials they hold (just as they are with physical credentials) and determine what to share with whom. This is sometimes referred to as self-sovereign identity (SSI).

These characteristics mirror how credentials work in the offline world. Rather than imagining a single identity or a single overarching institution—two models that represent the way digital identity has been done previously—the metasystem flexibly supports autonomy by allowing for as many interoperable trust frameworks as are needed to meet the myriad contexts in which humans find themselves.

Too much of our online (and physical world) interactions have come to rely on what Yuliya Panfil and Christopher Mellon call “monument credentials.” Monument credentials are the foundational documents upon which most of us build our formal identity, things like birth certificates, property titles, and passports. Monument credentials suffer from two primary challenges: access and accuracy.

An identity metasystem can provide an alternative to monument credentials in many situations. Panfil and Mellon call these “tapestry credentials.” Tapestry credentials are built from the data trails that we all leave as we navigate the digital world. these many credentials can provide a tapestry of new evidence that can be trusted for things we’ve relied on monument credentials for in the past. Taken together, they can be more accurate than a single monument credential. And because their based on many small interactions, they are more immediately available to many, especially under-documented populations.

Metasystems accelerate innovation and reduce engineering complexity by providing standard ways of doing things. Thus, universal solutions solve previously intractable problems and make new applications more broadly available. A trust framework with the characteristics listed above changes how we live our digital lives. The Internet changed the world because it provided a universal means of communicating. An identity metasystem changes the world by providing a universal means of trusting.

The real world is messy and unpredictable. Creating an identity system that is flexible enough to support the various ad hoc scenarios that the world presents us with can only be done using a general purpose metasystem. An automobile accident is one such complicated, real-life scenario. Dealing with an automobile accident entails multiple, independent credentials in a complex situation that involves a number of parties and plays out over several days or even weeks. I wrote about the power of an identity metasystem in these kinds of situations in an earlier post.

Solving the Problems

The identity metasystem solves the problems of digital identity discussed earlier. Let's see how:

Proximity—The metasystem solves the proximity problem through two primary mechanisms:

  1. First, DIDs provide the means of reliably identifying the party you are interacting with and the cryptographic means to trust those relationships.

  2. Second, credentials allow trusted third parties to attest to facts about the parties you interact with.

These enable trust to be built up over time and not be lost, the same way it is in the physical world.

Autonomy—Autonomy is at the heart of the metasystem’s architecture. Every party in credential exchange makes their own decisions. Every person and organization controls their relationships (i.e. private keys) and makes independent decisions about who to trust. Furthermore, the underlying protocols and standards allow for choice in tools and platforms.

Privacy—Privacy is the complement of autonomy: there is no privacy without autonomy and no autonomy without privacy. The metasystem incorporates privacy into its architecture through the support of peer DIDs, zero knowledge proofs, and many other features designed to protect people and organizations from unwanted correlations.

Anonymity—The metasystem allows people to retain their anonymity in online interactions. In many relationships, they can remain “nameless” by limiting the data that is disclosed. The metasystem removes the need for a centralized administrative system that can surveil activity. The metasystem also supports ephemeral relationships for short-lived interactions (e.g. with the ticket taker at the movie theater or bartender at the bar).

Flexibility—The metasystem can be used to construct identity systems for any purpose by designing a credential system to address the context-specific issues. The metasystem can be flexibly employed in ad hoc situations to bring credentials to bear from multiple contexts.

Interoperability—The underlying standards and protocols of the metasystem ensure that credential exchange is interoperable across contexts and between independent identity systems. The open-source nature of the reference code base for the metasystem ensures that multiple parties can bring interoperable solutions to market.

Scale—The metasystem scales for individuals through a consistent user experience which reduces cognitive load for people managing digital relationships. The peer-to-peer nature of the agent layer of the metasystem, combined with the widespread use of peer DIDs and decentralized nature of credential exchange, ensures that the metasystem can scale to support the trillions of relationships and credential exchanges necessary to provide an identity layer for the world’s economy.

While Obeying the Law

Simultaneously with solving the problems, the metasystem architecture must obey the laws of identity.

User Control and Consent—People are at the center of credential exchange and make independent choices about what relationships to create and what information to share.

Minimal Disclosure for a Constrained Use—The identity metasystem is designed to support minimal disclosure through zero-knowledge proof so that information is not shared unnecessarily.

Justifiable Parties—Only the credential issuer, holder, and verifier are part of any credential exchange. No third parties, intermediaries, or system administrators have access to the data in the credential or information about how it is shared.

Directed Identity—The metasystem uses public and peer DIDs to provide appropriate direction for identifiers.

Pluralism of Operators and Technologies—The flexibility of credential definitions, the layered architecture, open-source code base, and interoperable protocols make the metasystem flexible and open ensuring multiple solutions from many technology providers can be used.

Human Integration—The metasystem places the human in the loop for determining what relationships to create, how they are maintained, and what credentials to share with who.

Consistent Experience Across Contexts—The primary artifacts of the metasystem are relationships and credentials. Regardless of what specific design is used for the user interface, the experience is consistent because it rests on these artifacts.

Life-Like Digital Identity

We use identity in the physical world without thinking about it. And when we do, there are patterns that are so ingrained in our ways of interacting that we don’t give them a second thought. If we are to move more and more of our lives to the digital realm while also preserving agency and autonomy, we must create a digital world that allows us to jump the trust gap we inevitably have with people, organizations, and things when our interaction is digital.

An identity metasystem provides the long-missing identity layer for the Internet that will allow this to happen. The metasystem can be incorporated into every digital tool and system providing a consistent, trustworthy experience that feels as frictionless and natural as identity in the physical world.

Decentralized, self-sovereign identity depends on an identity metasystem and is the foundation for a decentralized Web—a Web that flexibly supports the kind of ad hoc interactions people have with each other all the time in real life. We'll never get an online world that mirrors real life and feels frictionless and life-like until we do.

Consequently, the arguments for creating the identity metasystem provided by the Sovrin Network are not narrow or technical issues. We are not building it simply for perceived technical benefits. Rather, the identity metasystem is vital for personal autonomy and ultimately human rights. Computers are coming to intermediate every aspect of our lives. Our autonomy and freedom as humans depend on how we architect this digital world. Unless we put digital systems under the control of the individuals they serve without intervening administrative authorities, the Internet will undermine the quality of life it's meant to bolster. The identity metasystem is the foundation for doing that.


End Notes

  1. I wrote about Fixing the Five Problems of Internet Identity in 2017. I've updated the list. Specifically, I think "autonomy" is a superset of "consent" and much more important overall.
  2. Decentralized identifiers are defined in specifications created by the W3C Decentralized Identifier Working Group. More details on decentralized identifiers and how they work can be found in Decentralized Identifiers.
  3. See We've Stopped Trusting Institutions and Started Trusting Strangers by Rachel Botsman
  4. I believe that a universal trust framework will lead to explosion of new sharing economy businesses because the identity metasystem will significantly reduce the plaform costs associated with building them.

Thanks to Joyce Searls, Doc Searls, and Drummond Reed for feedback on an earlier draft of this article.

Photo Credit: Friends Celebration Dinner Table from Pixabay (CC0)


It's the Autonomy, Stupid!

Handcuffs

In If you’re not Breaking Rules you’re Doing it Wrong, Simon Morris argues that the primary value proposition of decentralization is enabling the breaking of rules. He says:

The one value proposition that everyone seems to agree on for blockchain technologies is that they are ‘censor-proof’. And this matters only if you have something that someone wants to censor. To my mind the most interesting blockchain projects out there are the ones that enable the breaking of rules.

This article fascinated me and I spent a long time thinking about how this applies to Sovrin.

What bothered me is that Sovrin has made a point of having a strong governance framework that allows organizations around the world to comfortably use Sovrin without having to break rules or go rogue. Indeed, one of the reasons for Sovrin's success has been that we spotlight active governance as one of the important features of using Sovrin and the core reason the Sovrin Foundation exists.

Some might say that's evidence that Sovrin isn't sufficiently decentralized. I've argued strongly that Sovrin is decentralized and that that is one of it's core strengths. We talk a lot about censorship resistance. But we don't talk about breaking rules.

Of course, the reason we worry about censorship resistance is because we don't want any third party to be able to deprive a person or organization of their ability to use Sovrin. We don't talk about who might do that and why. We just work to create a system where they will have to work very hard to do so—hopefully harder than they'd be willing for whatever benefit they'd gain.

But, contrary to what Simon says above, I think that there is another overarching reason for decentralization: autonomy1. Centralized systems reduce individual freedom and autonomy. Craig Burton said

It's about choice: freedom of choice vs. prescribed options.

Leadership shifts. Policies expire. Companies fail. Systems decay.

Give me the freedom of choice to minimize these hazards.

The real value proposition of decentralization is autonomy—not being inside someone else’s administrative system where they make the rules in a one sided way2. Decentralization is closely linked to substitutability, the ability to substitute software and services without loss of functionality. Email is an example of a system that is substitutable. Facebook and Twitter are not. Substitutablity is a key feature of decentralized systems because it enables choice.

Speaking of the Internet of Things, I wrote:

Our autonomy and freedom as humans depends on how we build the Internet of Things. Unless we put these connected things under the control of the individuals they serve without an intervening administrative authority, we will end up building something that undermines the quality of life it's meant to bolster.

This is just as true about identity as it is about the Internet of Things. That's why we call it self-sovereign identity. Decentralization, in the form of an decentralized identity metasystem like Sovrin, allows us to build identity systems without intervening administrative authorities who can arbitrarily and at their sole discretion change the rules. Instead of breaking the rules, autonomy is about avoiding unnecessary rules altogether.


End notes

  1. The title of this post isn't meant to call Simon stupid or insult him. But the play on Bill Clinton's famous line from the 1992 presidential campaign was too good to pass up. Hopefully he'll forgive me.
  2. I think you can make the argument that autonomy and the ability to break rules are related. But like most things in life, there are degrees at play here. I feel like I'm relatively autonomous, but obviously I'm subject to the laws of the country I live in. There's a connection to John Locke's grand bargain here.
Photo Credit: Handcuffs from pxhere (CC0)


Answering Questions about Self-Sovereign Identity

Traverse Ridge

In Self-sovereign identity: 3 key questions (registration required), Susan Morrow asks some questions about the viability of self-sovereign identity (SSI). I actually found more than three. Here's some answers to Susan's questions.

After referencing Kim Cameron's Seven Laws of Identity (PDF), Susan states:

SSI is user-centric, but you don’t need to have a Self Sovereign ID system for it to be user-centric.

That's true. In fact, when we started Internet Identity Workshop, the mission was to explore user-centric identity. But, here's what I've found over the years: being about the user (user centric) doesn't necessarily mean that the user is structurally part of the flow, something Kim made central to his seven laws. I know there are plenty of people who hate the term, but "self sovereign" implies user control in a way that "user centric" does not.

Commercial Use

Susan's first question concerns commercial use cases. She says:

I want to understand how we can fit an identity framework, that is based on presenting verifiable claims, to a service. Who will pay for the verification? If one organization pays, will they be happy if that data is then shared with a competitor to build up a trusted relationship with them?

The simple answer is "the same people who pay for it now." The world is full of things that can be represented as verifiable credentials. A passport, drivers license, and membership cards are all examples of verifiable credentials. Who pays for them now? The person who wants it. An employee ID is another example. Who pays for it now? The employer (who also pays for the I-9 verification, in the US at least, that could also be part of the employee ID). You have a bank statement that could be represented as a verifiable credential. It's backed by an expensive KYC check. Who paid for that? The bank (and ultimately the customer). I could go on, but you get the point. Most of the use cases for verifiable credentials are just digital forms of credentials that have long existed and making them digital doesn't change the business model.

A subtle point that Susan alludes to is that when these credentials become digital, they can be used more widely and the issuer might want a piece of the action. For example, if I use my bank-statement-as-verifiable-credential to prove that I'm real (since only real people get personal bank accounts because of KYC requirements), will the bank want to charge the verifier1? Will banks and others be able to rely on and re-use expensive KYC checks? Rather than seeing this as a problem, I see it as an opportunity. The Sovrin network anticipates use cases where one party in the credential exchange pays another. Sovrin is designed to support them. There are organizations in the Sovrin ecosystem working on these kinds of use cases now.

Bottom line: Sovrin hasn't seen lack of commercial use cases or business models as a problem over the last three years. In fact, just the opposite. There are dozens of commercial use cases and many pilots. One of the reasons I got involved in Sovrin 3.5 years ago was because of the enthusiastic support from the credit union industry. That has not waned. In fact it's gotten stronger. Why? Because SSI solves real problems that credit unions and other businesses have. For the first time since the Internet was invented, we now have a general-purpose protocol for proving things about ourselves based on credentials from third parties.

In kind of a throw-away comment at the end of the section on commercial use, Susan says:

And a last point before I move on. This was brought up by a government official in the UK—the data ownership—is a government verified identity document like a passport actually your data to own?

There's nothing about SSI that implies that people own their passport or other credentials. SSI implies that people hold them and control their use. Just like they do with their physical passport. SSI isn't about ownership and we need to dispel the myth that it is. In On Sovereignty, I say:

The key to sovereignty is that all entities are peers. I have the same rights you do. The beauty of sovereignty isn't complete and total control, but rather balance of power that leads to negotiations about the nature of the relationships between various entities in the system.

Sovereignty implies interactions between peers. Neither party is part of the other's administrative system. Instead, the parties form a relationship (via the exchange of decentralized identifiers) and interact using a common protocol.

Governance and Stewards

Susan labels her next question "This Governance Thing?" but the question is really about the Steward model that Sovrin uses to perform validation on the blockchain. She says:

I can see the positive aspect of [Stewards]. It extends the notion of decentralization to another layer. Good. I do, however, wonder if the steward will become a weak point in the system. Will cybercriminals target stewards to gain control of the nodes?

The Sovrin ledger is operated by known validators who are called Stewards. There are currently over 60 Sovrin Stewards who are located on six continents around the world. The Sovrin Governance Framework contains the requirements for operating a node and the agreements that the Stewards sign.

The ledger is an instance of Indy Plenum which implements a Redundant Byzantine Fault Tolerance (RBFT) algorithm. The details are important because they contain the answers to Susan's question. Plenum is a 3f+1 RBFT system. The implication of this is that an attacker would have to compromise f+1 nodes to stop consensus and write progress and 2f+1 nodes to change what constitutes valid transactions.

So, making the math easy, assume there are 22 Stewards validating transactions on the mainnet. That makes f equal to 7. To stop writes to the ledger, you would have to compromise 8 Stewards. To change a valid transaction, you'd need to compromise 15 Stewards. That means you can't just hack one Steward to successfully attack the ledger as a whole.

Still, if a hacker took over one node, they could potentially send back bad answers to queries that are different from what's on the ledger. Clients have several defenses against that. First, clients can send a ledger query to more than one node. Second, and better, clients can ask for a state proof of ledger state. State proofs can be used to check the answers from a node and are signed by 2f+1 nodes. Consequently, answers can have RBFT built in, allowing clients to easily check the validity of the answer.

In any computer system, there are opportunities for security issues. Sovrin employs algorithms, code, and governance to make the ledger as secure as possible.

Privacy

Susan's third question involves the reality of the privacy claims of Sovrin. She says:

It is all well and good having minimal disclosure. But what if you want to buy a pair of shoes online. You have to allow the online vendor to know your address to send the shoes to. They will likely also want your name and other demographic data if they can get consent, for marketing purposes. Your data is then outside the SSI and held in a more traditional manner. And...it is now outside of your control too.

Susan is right. Minimal disclosure and zero knowledge proof can't keep companies from asking for too much information or storing that data in their systems. That's a human problem, not a technical one. Fortunately things like GDPR are starting to change the conversation on this.

Frankly, I'm not sure what point Susan is trying to make on this. Should we just give up? It's hopeless? I don't think so. What Sovrin's minimal disclosure does do is show that it's possible to limit information. Sovrin gives companies the means to ask for and use less data. I don't have to share my entire bank statement to prove that I have a bank account. And companies who don't want to handle my entire bank statement don't have to. Companies can no longer claim there's no choice. There is a choice and we can demonstrate that it works.

Zero knowledge proofs also allow credentials to be richer without compromising too much data. Here's an example: my employee ID credential could have lots of information (attributes) in it about not only my current role, but also all my past positions, salary history, and benefits. But I can choose to share only part of it to answer a specific request. I may prove to the bank that I've been employed greater than 3 years for a loan and then prove to the change control system that I'm authorized to deploy updates to the HR system—all from one credential. This makes it more flexible for the identity owner and easier to produce for the issuer since they don't have to create multiple credentials for the same person.

One more point: Sovrin's privacy stance is based on more than zero-knowledge proofs. It also relies on peer-to-peer relationships without correlating identifiers. This makes it harder for third parties to correlate information about me without my consent. Again, it doesn't make it impossible, but making it harder and showing that we can make working identity systems without a universal ID is a big improvement over where we've been, even with systems like social login.

As an aside, the ecommerce vendor doesn't actually have to have your address. They have to know what sales tax jurisdiction you live in (at least in the US) and they have to have a unique handle that the shipping company can turn into an address for delivery. You can imagine an ecommerce company that keeps no payment or address information on customers, but is still able to process their orders and send the merchandise. A universal protocol for exchanging verifiable credentials would be a foundation for this.

An Air of PGP to It

Finally, Susan says:

I get the same ‘techie’ feel of PGP within the SSI movement. I know that folks in SSI are working hard to get neat apps together to help with usability, but still, there is an air of PGP about it.

The best answer to this concern is to invite you to use a Sovrin wallet. Download Evernym's Connect.me from the app store and visit their demo site2. You won't see any keys. You won't see cryptocurrency addresses. You'll see relationships and credentials. Those are pretty common artifacts that almost any adult will have no problem understanding. Nothing could be further from the PGP user experience.

If you're an identity professional and trying to understand how it all works underneath the covers, you're going to see DIDs, credentials, public keys, zero-knowledge proofs, and all other kinds of technology. But none of that need be exposed to identity owners and it isn't.

A consistent user experience is, in Kim Cameron's view, a fundamental feature of an identity metasystem. That doesn't mean a single user interface—there will be multiple wallets. But the experience will be similar no matter which wallet you use.

Conclusion

Susan concludes:

SSI is not the only way to skin a cat. My own view is that a mix of technologies will, at least for the foreseeable future, be needed to accommodate the vast array of needs across the identity ecosystem. I can see use cases for SSI. But will it become the overarching way that humans resolve themselves in a digital realm?

While it may not be the only way to skin a cat, it's the only way that is universal. Other identity systems and protocols will continue to exist and interface to the identity metasystem. In an analogy, the Internet didn't do away with local area networks, but it connected them up and provided a universal protocol for exchanging messages between those networks. Sovrin will similarly impact and change existing, disconnected identity systems.

But it's bigger than just connecting systems that already exist. My argument is that Sovrin is an identity metasystem that serves as a foundation to support building any domain-specific identity system. Untold numbers of physical credentials can now be made digital—something that goes well beyond just connecting existing identity systems. The Sovrin identity metasystem gives rise to a universal trust framework that will impact almost every aspect of digital life. Yeah, I'm that bullish.


End notes

  1. See my recent blog post for a primer on verifiable credentials that defines terms and describes how they work.
  2. By the way, I point to Evernym's wallet simply because it has a nice credential demo they've created for it and it's the first to be commercially available. I'm aware of at least three other wallets in beta, including the StreetCred.id wallet I wrote about in DID Messaging: A Batphone for Everyone. For more on the continually developing ecosystem of Sovrin, see Self-Sovereign Identity at IIW: We Have Liftoff.