mirror of
https://codeberg.org/fediverse/fep.git
synced 2026-08-05 11:46:04 +00:00
FEP-c390: Change property names (#72)
- Renamed "id" to "subject" - Renamed "Identity" to "VerifiableIdentityStatement" - Changed FEP context in the example - Added potential applications Co-authored-by: silverpill <silverpill@firemail.cc> Reviewed-on: https://codeberg.org/fediverse/fep/pulls/72 Co-authored-by: silverpill <silverpill@noreply.codeberg.org> Co-committed-by: silverpill <silverpill@noreply.codeberg.org>
This commit is contained in:
+11
-10
@@ -11,6 +11,8 @@ discussionsTo: https://codeberg.org/fediverse/fep/issues/34
|
||||
|
||||
This proposal describes a mechanism of linking cryptographic keys to [ActivityPub](https://www.w3.org/TR/activitypub/) actor profiles.
|
||||
|
||||
Potential applications include: identity verification, end-to-end encryption and account migrations.
|
||||
|
||||
## History
|
||||
|
||||
- Mastodon implemented [identity proofs](https://github.com/mastodon/mastodon/pull/10414) in 2019. Keybase platform was used as an identity provider, but the integration was later [removed](https://github.com/mastodon/mastodon/pull/17045).
|
||||
@@ -22,8 +24,8 @@ Identity proof is a JSON document that represents a verifiable bi-directional li
|
||||
|
||||
It MUST contain the following properties:
|
||||
|
||||
- `type` (REQUIRED): the `type` property MUST contain the string `Identity`.
|
||||
- `id` (REQUIRED): the decentralized identifier (DID) that represents a cryptographic key belonging to an actor.
|
||||
- `type` (REQUIRED): the `type` property MUST contain the string `VerifiableIdentityStatement`.
|
||||
- `subject` (REQUIRED): the decentralized identifier (DID) that represents a cryptographic key belonging to an actor.
|
||||
- `alsoKnownAs` (REQUIRED): the value of this property MUST match the actor ID.
|
||||
- `proof` (REQUIRED): the data integrity proof, as defined by [Data Integrity](https://w3c.github.io/vc-data-integrity/) specification.
|
||||
|
||||
@@ -31,8 +33,6 @@ The document MAY contain additional properties.
|
||||
|
||||
Identity proofs SHOULD be attached to an actor object, under the `attachment` property.
|
||||
|
||||
WARNING: This proposal is not final yet and property names are subject to change. In particular, `id` will likely be replaced with `issuer` in order to make identity proofs forward compatible with [Verifiable Credentials Data Model v1.1](https://www.w3.org/TR/vc-data-model/) specification.
|
||||
|
||||
### Proof generation
|
||||
|
||||
The identity proof document MUST contain a data integrity proof, which includes a cryptographic proof and parameters required to verify it. It MUST be created according to the *Data Integrity* specification, section [4.1 Generate Proof](https://w3c.github.io/vc-data-integrity/#generate-proof). The value of `verificationMethod` property of the data integrity proof MUST match the value of `id` property of the identity proof document.
|
||||
@@ -48,8 +48,9 @@ Example:
|
||||
"https://www.w3.org/ns/did/v1",
|
||||
"https://w3id.org/security/data-integrity/v1",
|
||||
{
|
||||
"fep": "https://codeberg.org/fediverse/fep#",
|
||||
"Identity": "fep:Identity"
|
||||
"fep": "https://w3id.org/fep#"
|
||||
"VerifiableIdentityStatement": "fep:VerifiableIdentityStatement",
|
||||
"subject": "fep:subject"
|
||||
}
|
||||
],
|
||||
"type": "Person",
|
||||
@@ -57,8 +58,8 @@ Example:
|
||||
"inbox": "https://example.com/users/alice/inbox",
|
||||
"attachment": [
|
||||
{
|
||||
"type": "Identity",
|
||||
"id": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
|
||||
"type": "VerifiableIdentityStatement",
|
||||
"subject": "did:key:z6MkhaXgBZDvotDkL5257faiztiGiC2QtKLGpbnnEGta2doK",
|
||||
"alsoKnownAs": "https://example.com/users/alice",
|
||||
"proof": {
|
||||
"type": "JcsEd25519Signature2022",
|
||||
@@ -74,11 +75,11 @@ Example:
|
||||
|
||||
### Proof verification
|
||||
|
||||
The receiving server MUST check the authenticity of identity proof document by verifying its data integrity proof. If the server can't verify the proof, or if the value of `verificationMethod` property of the data integrity proof doesn't match the value of `id` property of the identity proof, or if the value of `alsoKnownAs` property of the identity proof doesn't match the actor ID, the identity proof MUST be discarded.
|
||||
The receiving server MUST check the authenticity of identity proof document by verifying its data integrity proof. If the server can't verify the proof, or if the value of `verificationMethod` property of the data integrity proof doesn't match the value of `subject` property of the identity proof, or if the value of `alsoKnownAs` property of the identity proof doesn't match the actor ID, the identity proof MUST be discarded.
|
||||
|
||||
Verification process MUST follow the *Data Integrity* specification, section [4.2 Verify Proof](https://w3c.github.io/vc-data-integrity/#verify-proof).
|
||||
|
||||
The receiving server SHOULD treat identities denoted by `id` and `alsoKnownAs` properties of identity proof as belonging to the same entity.
|
||||
The receiving server SHOULD treat identities denoted by `subject` and `alsoKnownAs` properties of identity proof as belonging to the same entity.
|
||||
|
||||
## References
|
||||
|
||||
|
||||
Reference in New Issue
Block a user