From 5ab8eb74d41ab84516c4de3e44449805f2e09756 Mon Sep 17 00:00:00 2001 From: Dima Krasner Date: Sun, 7 Dec 2025 21:01:06 +0100 Subject: [PATCH] FEP-ef61: require use of base58-btc when constructing DIDs (#736) The alternative is decoding base64url and re-encoding in base58 (or the other way around) when canonicalizing, at the cost of extra complexity in implementations that handle the edge case of a portable actor registered on two gateways with the same key, when one uses base58 and the other one uses base64url. (EDIT: the second option of base64url is a recent change in the spec, https://github.com/w3c-ccg/did-key-spec/commit/2cc490c38c5aacf58497a87fc0cf8794668bf716) Reviewed-on: https://codeberg.org/fediverse/fep/pulls/736 Co-authored-by: Dima Krasner Co-committed-by: Dima Krasner --- fep/ef61/fep-ef61.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fep/ef61/fep-ef61.md b/fep/ef61/fep-ef61.md index f348211..3e05153 100644 --- a/fep/ef61/fep-ef61.md +++ b/fep/ef61/fep-ef61.md @@ -84,6 +84,8 @@ Implementers MUST support the [did:key] method. Other DID methods SHOULD NOT be >[!NOTE] >The following additional DID methods are being considered: [did:web](https://w3c-ccg.github.io/did-method-web/), [did:dns](https://danubetech.github.io/did-method-dns/), [did:webvh](https://identity.foundation/didwebvh/) (formerly `did:tdw`) and [did:fedi](https://arcanican.is/excerpts/did-method-fedi.html). +To maintain backward compatibility with existing [ActivityPub][ActivityPub] implementations that rely on an origin-based security model and do not canonicalize IDs before comparison, implementers MUST generate DIDs using the base58-btc alphabet, even though the specification [allows both base58-btc and base64url][did:key-syntax]. Using both alphabets in practice could prevent such servers from recognizing that a post whose `attributedTo` value is `https://base64url.example/.well-known/apgateway/did:key:u7QGwDY2Tjn93PVFWWq02piP1NE9_XRlg-c8-jhJiDqKBDw/actor` belongs to `https://base58.example/.well-known/apgateway/did:key:z6MkrJVnaZkeFzdQyMZu1cgjg7k1pZZ6pvBQ7XJPt4swbTQ2/actor`. + DID documents SHOULD contain Ed25519 public keys represented as verification methods with `Multikey` type (as defined in the [Controlled Identifiers][Multikey] specification). Any [DID URL][DID-URL] capabilities of a DID method MUST be ignored when working with 'ap' URIs. @@ -371,6 +373,7 @@ The following alternatives to gateway-based compatible IDs are being considered: [DID]: https://www.w3.org/TR/did-core/ [DID-Subject]: https://www.w3.org/TR/did-1.0/#did-subject [did:key]: https://w3c-ccg.github.io/did-key-spec/ +[did:key-syntax]: https://w3c-ccg.github.io/did-key-spec/#did-key-identifier-syntax [DID-URL]: https://www.w3.org/TR/did-core/#did-url-syntax [DID-Services]: https://www.w3.org/TR/did-1.0/#services [ControlledIdentifiers]: https://www.w3.org/TR/cid/