Difference between revisions of "Self-issued Trust"

Revision as of 06:33, 1 July 2021

Full Title or Meme

The core concept of Self-issued Identifiers is that the user can establish a trust relationship with a Relying Party (PR) that does not permit sharing of any part of that relationship with a Trusted Third Party.

Context

Trust as used here is a necessary condition for a party to undertake (or continue) an action.

Participants

1. User
2. Relying Party
3. Trusted Third Party (that is kept ignorant of any association between the user and the RP)
4. User Agent (aka SIOP wallet)
5. Vendor Relationship Manager (aka Self-issued OpenID Picker, only needed if the user has more than one wallet)

Problem

This entire concept is technically difficult (if not impossible) to pull off.

Trust Relationshipts

1. The user trusts the RP to be telling the truth about its intent to honor the user's intentions wrt the user's data.
2. The user trusts the SIOP to be fairly representing the RP.
3. The user trusts the SIOP to protect the user's secrets (private keys and other credentials.)
4. The user trusts the SIOP to faithfully present user intent to the RP.
5. The RP trusts the SIOP to assist in the user authentication process (including user secrets and possibly user liveness.)
6. The users trusts the TTP (aka claims provider) to avoid releasing any information about them.
7. The RP trusts the TTP to validate claims (offline proofs preferred over online verification of current state. Currently a huge debate within mDL/eID efforts.)
8. Once a relationship is established the user trusts the VRM (chooser) to provide "refresh tokens" to quickly re-establish trust.

References