Verifiable Credentials

VCs use Decentralized Identifiers—globally unique, persistent identifiers that require no centralized registration authority. DIDs enable cryptographically verifiable, self-sovereign identity for content signers.

• Resolve to DID Documents containing public keys and service endpoints
• Support multiple cryptographic key types (Ed25519, secp256k1)
• Eliminate reliance on certificate authorities or identity providers
• Enable non-repudiation of content authorship claims

VCs employ digital signature schemes to create tamper-evident assertions. A credential's proof section contains the cryptographic material needed to verify its integrity and origin.

• Linked Data Proofs: Embed signatures directly in the credential using JSON-LD normalization
• JSON Web Tokens (JWTs): Compact, URL-safe tokens for bearer credentials
• BBS+ Signatures: Enable selective disclosure—reveal only specific claims without exposing the entire credential
• Verification confirms the credential hasn't been altered since issuance

VCs are designed for minimal disclosure and selective revelation. Holders control exactly which claims to share with verifiers.

• Zero-Knowledge Proofs (ZKPs): Prove a claim is true without revealing the underlying data (e.g., prove age > 18 without sharing birthdate)
• Selective Disclosure: Share only the required fields from a multi-claim credential
• Predicate Proofs: Prove relationships (greater than, less than, set membership) without raw data exposure
• Prevents correlation across different verification contexts

VCs operate on a decentralized trust model where verifiers decide which issuers they trust, rather than relying on a global authority.

• Issuer: Entity that asserts claims and signs credentials (e.g., a news organization asserting authorship)
• Holder: Entity that receives and controls the credential (e.g., a content creator)
• Verifier: Entity that checks the credential's authenticity and issuer trustworthiness
• Verifiable Data Registry: Distributed ledger or database where DIDs and schemas are published (e.g., blockchain, DNS, or decentralized web nodes)

VCs rely on machine-readable schemas to define the structure and semantics of credential types, ensuring interoperability across systems.

• Credential Schema: Defines the fields, data types, and constraints for a specific credential type (e.g., ContentAttributionCredential)
• JSON-LD Contexts: Map terms to globally unambiguous IRIs, enabling semantic interoperability
• Credential Definitions: Bind a schema to a specific issuer's public key, creating a unique credential template
• Enables automated validation of credential structure before cryptographic verification

VCs include mechanisms for revocation and expiration to manage credential lifecycle without compromising the decentralized architecture.

• Revocation Registries: Cryptographically verifiable lists (often on distributed ledgers) that track revoked credentials without revealing which ones
• Accumulator-based Revocation: Privacy-preserving method where holders prove non-revocation without the verifier checking a full list
• Expiration Dates: Credentials can include validFrom and validUntil timestamps
• Suspension: Temporary revocation that can be reversed, distinct from permanent revocation

A cryptographic process that confirms a piece of content was created by a known entity and has not been altered since it was signed. This ensures non-repudiation of origin for every asset in a pipeline.

• Uses asymmetric cryptography where the issuer signs with a private key
• Verifiers use the public key from the issuer's DID Document to validate
• Any modification to the credential or asset invalidates the signature
• Provides the mathematical trust foundation for automated provenance chains

A privacy-preserving mechanism that allows a holder to reveal only specific claims from a verifiable credential without exposing the entire document. Essential for data minimization in enterprise content pipelines.

• Leverages BBS+ signatures or zero-knowledge proofs
• A content creator can prove organizational affiliation without revealing their full identity
• Supports compliance with GDPR and data sovereignty requirements
• Prevents unnecessary exposure of sensitive provenance metadata during verification

The process of securely proving that a specific piece of data existed at a particular moment in time. When combined with verifiable credentials, it anchors a provenance record to an immutable temporal reference.

• Often issued by a trusted third-party authority or a distributed ledger
• Uses RFC 3161 compliant timestamp protocols
• Prevents backdating of content creation claims
• Critical for establishing priority of authorship in intellectual property disputes