Which roles make up the SSI model, and how do they interact?
Issuer, holder and verifier form a triangle: the issuer gives a signed credential to the holder, the holder presents proof of it to the verifier, and the verifier checks it against a verifiable data registry instead of asking the issuer.
* Issuer, holder and verifier: the issuer and verifier never talk directly, and the registry holds keys and status, never personal data. *
- Issuer: digitally signs attestations about a subject, packages them as a verifiable credential and gives it to the holder.
- Holder: keeps credentials in a wallet and uses them to build presentations (proofs) for verifiers.
- Verifier: requests proof and checks that the issuer's attestations satisfy its requirements.
- Verifiable data registry: the shared, trusted lookup place. The issuer writes what is needed for verification (its identifier and public key, revocation information); the verifier reads it.
The important line is the one that is missing: there is no direct link between issuer and verifier. The verifier trusts the credential because it can check the issuer's signature with a key it found in the registry, not because it phoned the issuer. That is what keeps the issuer from learning where and when the holder uses the credential.
Go deeper:
W3C: Verifiable Credentials Overview — the standards family behind issuer, holder, verifier and registry.- W3C VC Data Model 2.0: Ecosystem overview — the normative description of the roles and the registry.
- Verifiable credentials (Wikipedia) — a short general introduction to issuers, holders and verifiers.