Difference between revisions of "Verifiable Claim"

Revision as of 10:58, 24 January 2019

Full Title or Meme

A Verifiable Claim is one that can be Validated by a signed statement from some recognized authority as to the nature of a linkage between Attributes and a Subject.

Context

• The Context in which a validation applies should be made clear by a policy statement from the validating authorities.
• The mission of the Verifiable Claims Working Group (VCWG) is to make expressing and exchanging credentials that have been verified by a third party easier and more secure on the Web.

Problem

Granting a benefit requires proof and verification. Some benefits demand a formal process that includes three parties. In this process, the holder asks for the benefit and the inspector-verifier grants or denies the benefit based on verification of the holder’s qualification from a trusted issuer.

False Claims

A Verifiable Claim can be perfectly constructed, totally verifiable, and still be completely false if it is not about a real attribute of the Subject that created the digital Identifier that is bound to the claim. This is a particularly knotty problem for a Decentralized ID that is not known to be bound to any particular human user by its very design. It may be that the Decentralized ID has protected the user against release of User Private Information, but it does not meet the primary meaning of Privacy, namely the right to be let alone. Now any can make a claim about any Identifier and if the Subject does not want to expose more of their User Private Information they cannot avail themselves of the right of Redress to false claims.

There are lots of statistics about claims made on the web today, but the best estimate seems to be that over 50% are false. Based on that it would be prudent to assume that 50% of the Verified Claims would also be false.

The science fiction writers Vernor Vinge^[1] and Stanislaw Lem^[2] have explored the hazards of navigating in the digital and the real worlds with false identities. In Vinge's book the protagonist is exposed and suffers from the hands of the corrupt government. In Lem's actual life he learns to create false papers and escapes from a corrupt government with the help of a false identity. It should be clear that as Identity papers become easier to create, the incidence of false papers will proliferate.

Solution

• A Verifiable Claims Data Model and Representations document is under development by the W3C Verifiable Claims working group on this GitHub site.
• It is hard to determine exactly what a verified claim is. It seems that it might only be verfied at the moment that a revocation check is made and not for one instant later, although that is not stated anywhere.
• There appears to be no way to link a verified claim to a user, or to prevent replay. It is not clear if all the members of the WG agree if that is the correct view.

Taxonomy from the spec

The terms used in the W3C Credential Community Group (CCG) are deliberately human oriented, whereas a claim is device oriented. As a result there is a conflict between the terms used in that group and this wiki.

Note that the term Identifier or Attribute Provider is used in this wiki as the distinction between identifiers and attributes is arbitrary and subject to interpretation.

EXAMPLE - A simple verifiable claim

Note that it is unclear on which date the claim "over 21" is valid. It seems that the issued date applies to the original credential and not this derived credential. If it is the date on which the claim became true, then it is releasing too much information.

{
  "@context": "https://w3id.org/security/v1",
  "id": "http://example.gov/credentials/3732",
  "type": ["Credential", "ProofOfAgeCredential"],
  "issuer": "https://dmv.example.gov",
  "issued": "2010-01-01",
  "claim": {
    "id": "did:example:ebfeb1f712ebc6f1c276e12ec21",
    "ageOver": 21
  },
  "revocation": {
    "id": "http://example.gov/revocations/738",
    "type": "SimpleRevocationList2017"
  },
  "signature": {
    "type": "LinkedDataSignature2015",
    "created": "2016-06-18T21:19:10Z",
    "creator": "https://example.com/jdoe/keys/1",
    "domain": "json-ld.org",
    "nonce": "598c63d6",
    "signatureValue": "BavEll0/I1zpYw8XNi1bgVg/sCneO4Jugez8RwDg/+
    MCRVpjOboDoe4SxxKjkCOvKiCHGDvc4krqi6Z1n0UfqzxGfmatCuFibcC1wps
    PRdW+gGsutPTLzvueMWmFhwYmfIFpbBu95t501+rSLHIEuujM/+PXr9Cky6Ed
    +W3JT24="
  }
}

References

1. ↑ Vernor Vinge, True Names and the Opening of the Cyberspace Frontier. (2001-12-14 original 1981) ISBN 978-0312862077
2. ↑ By Paul Grimstad, The Beautiful Mind Bending of Stanislaw Lem. New Yorker https://www.newyorker.com/culture/culture-desk/the-beautiful-mind-bending-of-stanislaw-lem

• Synonyms include: Assurance Attested Corroborated.