VC Issuance¶
Did-endpoint performs the issuer function for issuing the holder’s VC (Verifiable Credential). Hereinafter, did-endpoint is referred to as an issuer.
The VC (Verifiable Credential) issuance is a function in which a holder issues a VC through an issuer.
In VC issuance, the holder receives an identity certificate from the issuer to prove the holder’s ID attribute, and the identity proof corresponds to a resident registration card, graduation certificate, employment certificate, and certificate.
VC Elements¶
VC consists of the following elements. - Credential metadata: Defines the VC issuer, VC expiration period, VC disposal method, and the object specified by the VC. - Claim(s) : Information about the identity property of the credential subject is stored in the subject-property-value method. For example, holder name (subject) - major (property) - computer (value), which includes information about which property for a given subject and what the value of that property is. - Proof(s): Contains the value required to verify the authenticity of the VC. Various cryptographic techniques for verification, such as RSA and biometrics, can be used.
VC Issuance Procedure¶
The VC issuance procedure is as follows.
Credential Schema Aquirement¶
First, for VC issuance, the holder must obtain Credential Schema information required for VC issuance from the issuer, and collect data necessary for VC creation request from the block chain based on the data. This process requires the holder to know the publisher’s information online or offline. (Example: Visiting government agencies to issue a resident registration card, visiting a school or online school website to issue a graduation certificate, etc.)
In this project, it is assumed that the holder and the issuer are connected to each other online. The issuer registers the VC’s Credential Schema in the blockchain through the DID Platform in advance. (Post Schema)
To inquire credential schema information (stored in the block chain) required for VC issuance, the holder requests credential schema’s location information from the issuer before requesting a VC issuance. The issuer sends the credential schema location information and the URL information of the service endpoint (Issuer) to request the issuance of the VC together to the holder.
The holder sends the received credential schema location information to the DID Platform, and the DID Platform inquires the credential schema on the block chain through the location information and sends the credential schema to the holder. Holder’s App displays the claim information required for VC issuance based on credential schema information and allows claim information in credential schema input from actual user.
DID Document Retrieval¶
After that, the holder requests the issuer to issue a VC along with DID and Claim information. Then, in order to prove the ownership of the DID of the holder, the issuer needs the operation of inquiring the DID Document of the holder’s DID from the block chain. The issuer requests the holder’s DID Document inquiry to the DID Platform through the DID received from the holder. The DID Platform checks the location where the holder’s DID Document is stored, obtains the DID Document from the blockchain, and sends it to the issuer.
DID Authentication¶
After that, the issuer performs the DID Authentication procedure to verify that the DID owner is the holder. The issuer sends a challenge (eg, generating a random payload) to authenticate that the DID is a DID generated by the holder, and sends a token (JWT) together in the header. JWT consists of public key, challenge, and UUID. The holder sends a response (eg, encrypting a random payload with a private key) for authentication. The issuer that has received the response verifies the holder’s response by acquiring the public key included in the holder’s DID Document. When the verification is completed, the issuer sends the DID Authentication result (true/false) to the holder.
Qualification verification¶
The issuer performs qualification verification (eg, verifying the authenticity of a driver’s license, etc.) as to whether it is acceptable to issue VC to the holder.
The holder inquires whether the VC is issued to the issuer. (REST API Get method with JWT)
If the issuer has completed DID Authentication and qualification verification, it issues a VC and sends the VC with a true response to the holder. If DID authentication and credential verification fail, issuer sends the fail response to the holder, and if DID authentication or credential verification is in progress, issuer sends the wait response.
When the holder receives the issued VC, it validates the VC, stores it in the holder’s DID Wallet, and displays the VC issuance status on the App screen.