Verifiable Credential (VC)

A VC is cryptographically bound to its holder, preventing impersonation and unauthorized use. This is typically achieved through a proof property containing a digital signature generated by the holder's private key.

• Mechanism: The holder presents the VC along with a proof of possession of the private key corresponding to the public key embedded in the credential.
• Example: A digital driver's license VC contains a public key. To prove age, the holder signs a challenge with the corresponding private key, proving they are the legitimate subject.

The origin and integrity of a VC are verifiable through the issuer's digital signature. This allows any third party to confirm the credential was issued by a trusted authority and has not been altered.

• Process: The issuer creates a hash of the credential data and signs it with their private key. Verifiers use the issuer's public DID or public key to validate the signature.
• Benefit: Eliminates reliance on centralized verification APIs; trust is established through cryptographic proof rather than network calls.

VCs leverage Decentralized Identifiers (DIDs) to establish a portable, vendor-independent trust model. DIDs are globally unique identifiers that do not require a centralized registration authority.

• Architecture: A DID is recorded on a distributed ledger or verifiable data registry. The DID Document contains the public keys and service endpoints needed to interact with the subject.
• Advantage: Breaks vendor lock-in. An organization can verify a VC issued by a university DID without needing to integrate with the university's proprietary API.

VCs support privacy-preserving disclosures through Zero-Knowledge Proofs. A holder can prove a statement about their data without revealing the underlying data itself.

• Selective Disclosure: A holder can reveal only specific fields from a credential (e.g., proving age > 21 without revealing birth date).
• Predicate Proofs: Cryptographic proofs that a value satisfies a condition (e.g., age >= 18) without disclosing the actual value.
• Unlinkability: Prevents verifiers from correlating multiple presentations of the same credential, enhancing privacy.

The integrity of a VC is guaranteed through cryptographic hashing and digital signatures. Any modification to the credential data after issuance will invalidate the signature.

• Verification: A verifier hashes the credential data and uses the issuer's public key to check the signature. A mismatch indicates tampering.
• Schema Validation: VCs often reference a schema (e.g., https://schema.org/EducationalOccupationalCredential) to ensure the data structure conforms to expected definitions, preventing structural manipulation.

VCs support native revocation mechanisms that allow issuers to invalidate a credential without requiring direct communication with every verifier.

• Revocation Registry: A cryptographically verifiable data structure (e.g., a bitstring or accumulator) published by the issuer. Verifiers check the registry to confirm a credential has not been revoked.
• Expiration Date: The validUntil property provides a simple, time-based invalidation mechanism.
• Privacy: Modern methods like Status List 2021 allow revocation checking without revealing which specific credential was revoked, preserving holder privacy.