How does an SSI protocol work end to end, and what are DIDs and the verifiable data registry for?
Every party has a decentralised identifier (DID) whose public key is anchored in a verifiable data registry; the issuer issues credentials to the holder's wallet, the holder sends the verifier a presentation, and the verifier uses the registry to check the issuer, validity, authenticity and integrity.
* The verifier checks a credential against the registry, without ever contacting the issuer. *
A DID (decentralised identifier) is an identifier such as did:example:123 that the owner creates and controls without a central registration authority. Resolving it returns a DID document listing the public keys and service endpoints that belong to it. The verifiable data registry (VDR) is where these DIDs are anchored so that anyone can resolve them. It can be a blockchain or a state-run register.
The flow:
- Issue: the issuer signs a verifiable credential and delivers it to the holder's wallet.
- Present: the holder sends the verifier a presentation built from that credential, possibly with zero-knowledge proofs instead of the raw data.
- Resolve: the verifier looks up the issuer's DID in the registry to get its public key.
- Verify: with that key it checks who issued the credential, that it is still valid (not expired or revoked), and that it is authentic and unmodified.
The link secret in the wallet is a secret value known only to the holder that is blinded into each credential at issuance. When presenting, the holder proves knowledge of it, which shows that all the presented credentials belong to the same holder, without revealing a correlatable identifier.
Go deeper:
W3C: Decentralized Identifiers (DIDs) v1.0 — the DID syntax, DID documents and how resolution works.- Decentralized identifier (Wikipedia) — a compact overview of DIDs and DID methods.