On our March 12, 2020 webinar, Evernym Chief Architect Daniel Hardman provided a great introduction to verifiable credentials and compared them to the physical credentials (passports, driver's licenses, loyalty cards) we use every day. He then identified six lessons we can learn from today's physical credentials and how we're applying each to the world of self-sovereign identity.

1. Evernym
@evernym | info@evernym.com | March 2020
Verifiable Credentials
Lessons from the physical world

2. On the agenda
What are verifiable credentials?
What lessons can we learn from the physical world?
How can we apply these lessons?
Conclusion
Q&A

3. LET’S GO BACK IN TIME
before the Internet...

6. We call these “credentials”

7. They answer the question:
“Says who?”
There is already a global standard for
credentials - paper.

8. But it doesn’t work
online
The digital world had no equivalent
for paper credentials… until now.

9. Introducing digital,
verifiable credentials
They’re a lot like the physical credentials we
know and love, with a few ‘cryptographic
superpowers’ that allows any relying party to
complete four checks:
✔ Who issued the credential?
✔ To whom?
✔ Has it been tampered with?
✔ Has it been revoked?
All without contacting the credential issuer.

10. And in November 2019, the
data model for verifiable
credentials became an
official W3C
recommendation.
https://www.w3.org/TR/2019/REC-vc-data-mod
el-20191119/

11. Lody’s Passport
Wikimedia Commons (public domain) Wikimedia Commons (public domain)

12. So what can we learn?

13. 1. Just holding a credential
isn’t enough
You have to prove that you’re the legitimate
holder.
Maybe you should also have to prove that the
device doing the proving is authorized...
● Link secrets
● Biometrics

14. 2. Revocation is a big deal
The US State Department needed a way to
revoke stolen passport. It needed to be timely,
and the revocation needed to propagate
everywhere, quickly.

15. 3. Abuse by holders isn’t
the only risk
...what about the German Foreign Ministry, who
“verified” Lody’s passport to grant an exit
permit? What about malicious issuers? Etc.
See Aries RFC 0207 — Credential Fraud Threat
Model.

16. 4. Diffuse trust is important
for high stakes
Naval yards shouldn’t have just challenged for
passport, but also for another form of ID.
Like guy wires — having just one is not enough.
Stephen Edmonds, Flickr, CC-BY 2.0

17. 5. Planning and governance
matter
Clarify everbody’s rights and responsibilities.
Identify situations that are tricky.
Codify which proofs are needed in which
circumstances, for which levels of assurance.
Make the basis of reputation explicit.

18. 6. Issuers need to have
robust processes
What does “Real ID” push in the US tell us?
Reputation attaches to more than just the
right to assert a fact (Oxford vs. Podunk U)
Stephen Edmonds, Flickr, CC-BY 2.0
TSA, public domain

19. How are we applying these learnings to
digital credentials?

20. We’re integrating advanced key
management
see http://bit.ly/dkms-v4, http://j.mp/2xvp3Wd, http://j.mp/38EEB6Z

21. Impersonating Alice
outside Sovrin
● Step 1: Steal the wallet (phone)
● Step 2: Hack it → credentials + DID keys
● Step 3: ✅ Use Stolen Identity

22. Impersonating Alice
on Sovrin
● Step 1: Steal the wallet (phone)
● Step 2: Hack it → credentials + DID keys +
(maybe) link secret
● Step 3: ✘ Fail. Go look for a better target.

23. We’re providing process and accountability
with governance frameworks
see http://bit.ly/32LRkD5, http://j.mp/33cA8XK

24. We’re making credentials more secure with
biometrics
see https://doi.org/10.1109/MCOMSTD.001.1900033

25. We’re categorizing fraud through risk scoring
Your feedback encouraged: http://j.mp/2VR09dz

26. We’re exploring proof of unique human, link
secret bonds, and other fraud preventers.
see http://bit.ly/2SQtbag

27. We’re enabling lighter-weight revocation with
Anoncreds 2.0
see http://j.mp/3aOj8di

28. In conclusion…
Verifiable credentials can take the pain out of
proving who we are in the digital world.
But, it’s a young technology and there are many different ways of
architecting a credential and applying these lessons—
some good, some bad.
We’ll address these issues in depth in future webinars.

29. Thank you
Questions? Please drop them in the chat!
Connect with us via Twitter or Email
@evernym
info@evernym.com