Decentralized Identifier (DID)

DIDs fundamentally operate without a centralized registration authority. Unlike traditional identifiers (email addresses, domain names) that rely on a single organization like ICANN or Google, DIDs are registered on a Verifiable Data Registry (VDR) , which is often a distributed ledger or decentralized network.

• No Single Point of Failure: The identifier persists independently of any corporate entity.
• Censorship Resistance: No central party can revoke or freeze the identifier.
• Infrastructure Independence: The DID remains valid even if the original issuer's infrastructure goes offline.

A DID is a URI that resolves to a DID Document. This document is a machine-readable JSON-LD file containing the cryptographic material, service endpoints, and metadata necessary to interact with the DID subject.

• Standardized Resolution: The W3C DID Resolution specification defines how a DID resolves to a document.
• Service Endpoints: The document can list URLs for interacting with the subject (e.g., a credential repository).
• Discoverability: Any party can resolve the DID to find the current public keys and communication channels.

A W3C standard for a tamper-evident, cryptographically verifiable digital credential that uses a DID as its subject identifier. A VC contains claims about an entity (e.g., a university degree or professional certification) and is digitally signed by an issuer. The holder can present the credential to a verifier, who cryptographically validates the issuer's signature and the credential's integrity without needing to contact the issuer directly. This forms the basis of self-sovereign identity architectures, decoupling proof of attributes from centralized identity providers.

A JSON-LD document that is returned when a DID is resolved. It contains the cryptographic material and service endpoints associated with the identifier. Key components include:

• verificationMethod: Public keys used to authenticate the DID subject or verify signatures
• service: Endpoints for interacting with the DID subject (e.g., credential repositories, messaging)
• authentication: Specifies which verification methods are used for authenticating as the DID subject The document is stored on a Verifiable Data Registry (e.g., a blockchain or distributed ledger) and is the mechanism by which a DID becomes actionable.

A specification that defines how a particular DID scheme is created, read, updated, and deactivated on a specific Verifiable Data Registry. Each method (e.g., did:web, did:ethr, did:indy) implements the generic DID Core specification for a particular underlying system. The method determines:

• The syntax of the method-specific identifier
• The CRUD operations for DID documents
• The security and privacy considerations unique to that registry Choosing a method involves trade-offs between decentralization, performance, cost, and governance.

The underlying storage system that mediates the creation, verification, and retrieval of DID Documents. A VDR can be a distributed ledger (e.g., a blockchain), a decentralized file system, or any network that provides consensus on the state of identifiers. Examples include the Ethereum blockchain for did:ethr, the Sovrin ledger for did:sov, and standard web servers for did:web. The trust model of the entire DID ecosystem depends on the immutability and availability guarantees of the chosen VDR.

The process of taking a DID as input and returning its corresponding DID Document and associated metadata. This is performed by a DID Resolver, which implements the logic for one or more DID methods. Resolution is the critical runtime operation that enables a verifier to obtain the public keys needed to authenticate a credential or message. The process may involve dereferencing a URL to retrieve a specific resource within the DID document, such as a single public key.

A model of digital identity where individuals or organizations have sole ownership and control over their identifiers and credentials, without reliance on centralized administrative authorities. DIDs are the foundational identifier layer of SSI, enabling entities to create and manage identifiers independently. Combined with Verifiable Credentials and secure wallets, SSI enables peer-to-peer trust establishment where the subject decides which credentials to disclose and to whom, minimizing unnecessary data exposure.