DIDComm Messaging

DIDComm is designed for a store-and-forward model, decoupling the sender from the receiver's availability. Messages are encrypted and routed through mediator agents or message queues, ensuring delivery even when the recipient is offline. This is critical for mobile identity wallets and IoT devices that operate intermittently.

• Uses DID Document service endpoints to discover routing paths
• Supports Message Pickup Protocol 3.0 for retrieving queued messages
• Enables communication without persistent connections or centralized brokers

Every DIDComm message is encrypted using Authenticated Encryption with Associated Data (AEAD). The protocol mandates AuthCrypt for authenticated encryption or AnonCrypt for anonymous communication. Encryption keys are derived directly from the DID Documents of the participants, eliminating the need for out-of-band key exchange.

• Leverages X25519 key agreement and A256CBC-HS512 or XC20P ciphersuites
• Supports perfect forward secrecy (PFS) through ephemeral key generation
• Prevents metadata leakage via envelope-based message wrapping

DIDComm operates as a Layer 2 protocol independent of any specific transport layer. Messages are structured as JSON-based DIDComm Envelopes that can be transmitted over HTTP, WebSockets, Bluetooth Low Energy, NFC, or even QR codes. This allows the same secure messaging layer to function across web, mobile, and proximity-based interactions.

• Defined in DIDComm Messaging v2.0 specification
• Supports multiple transport bindings without changing the message payload
• Enables peer-to-peer connections without reliance on TCP/IP infrastructure

DIDComm messages carry a type header referencing a specific protocol URI, enabling structured multi-step interactions. Agents co-execute these protocols to achieve complex workflows like credential issuance, proof requests, or negotiation. Messages can be routed through multiple intermediaries using forward secrecy at each hop.

• Uses DIDComm Protocols as standardized interaction patterns (e.g., https://didcomm.org/issue-credential/3.0)
• Supports nested routing with forward messages for onion-like pathing
• Enables machine-to-machine agent choreography without human intervention

Every message is cryptographically signed by the sender's private key associated with their DID. This provides mathematical proof of origin and ensures message integrity. Verifiers can resolve the sender's DID Document from a Verifiable Data Registry to validate the signature, establishing a chain of trust without centralized certificate authorities.

• Uses Ed25519 or P-256 signature schemes
• Prevents spoofing and tampering through detached signatures
• Enables auditable communication logs for compliance and forensics

DIDComm supports anonymous communication where the sender's identity is hidden from the recipient using AnonCrypt mode. Additionally, routing protocols allow messages to traverse multiple mediators, obscuring the sender's network location. This architecture prevents metadata correlation and protects against traffic analysis.

• Implements sender anonymity through sealed sender techniques
• Uses mediator agents as privacy-preserving relays
• Prevents correlation attacks by decoupling transport from identity