This specification defines a mechanism that can be used with the [[[VC-DATA-MODEL-2.0]]] to increase a [=verifier|verifier's=] confidence about a particular [=subject=] identified in a [=verifiable credential=].
This is an experimental specification and is undergoing regular revisions. It is not fit for production deployment.
When a [=verifier=] performs the process of [=validate|validating=] a [=verifiable credential=], it is useful to be able to raise the confidence level that the [=subjects=] identified in a [=verifiable credential=] are the same ones that interacted with the [=issuer=] when it performed its vetting process to issue the [=verifiable credential=]. For example, when an employer (the [=issuer=]) issues a corporate identification card to an employee (the [=subject=]), it might require that the employee bind a particular cryptographic key (verification method) to the [=verifiable credential=] during the issuing process. In that case, the [=issuer=] can use this specification to convey to the [=verifier=] which cryptographic key was bound during the initial identity assurance process.
In other words, an [=issuer=] can use this specification to convey which provable mechanisms it used to bind [=claims=] in a [=verifiable credential=] so that a [=verifier=] can increase their confidence in the truth of a variety of things, including the following:
Terminology used throughout this document is defined in the Terminology section of the [[[VC-DATA-MODEL-2.0]]] and the [[[VC-DATA-INTEGRITY]]] specification.
A conforming document is any concrete expression of the data model that follows the relevant normative requirements in Section .
A conforming processor is any algorithm realized as software and/or hardware that generates and/or consumes a [=conforming document=]. Conforming processors MUST produce errors when non-conforming documents are consumed.
This specification defines the `confidenceMethod` property for expressing confidence method information in a `credentialSubject` in a [=verifiable credential=].
If present, the value of the `confidenceMethod` property is one or more confidence methods. Each confidence method is bound to one or more [=subjects=] in the [=verifiable credential=], and provides enough information for a [=verifier=] to determine whether the [=holder=] can generate a [=verifiable presentation=] to increase the [=verifier's=] confidence that they are the same entity referenced by the confidence method. This is referred to as satisfying the confidence method. It is required that the [=issuer=] verifies that the [=holder=] can satisfy each `confidenceMethod` the [=issuer=] includes in the [=claims=] of the [=verifiable credential=]s they issue.
Each confidence method MUST specify its `type` and MAY specify an `id`. The precise properties and semantics of each confidence method are determined by the specific `confidenceMethod` type definition.
A [=verifier=] can decide to accept [=claims=] in a [=verifiable credential=] without requiring use of the confidence method, or use a different mechanism to increase their confidence about whether, for example, the [=holder=] is the same entity the issuer made [=claims=] about in the [=verifiable credential=]. Such a decision can impact the [=verifier=]'s liability when accepting [=verifiable credentials=] during certain use cases.
A [=verifier=] can validate that the [=holder=] controls, or has been designated the ability to use, a confidence method by verifying the [=data integrity proof|proof=] of the verifiable presentation using the information in the confidence method. The confidence method can include the verification key, or the type of the confidence method can define that the verification key is to be inferred from other properties in the [=verifiable credential=], such as the `credentialSubject.id`.
The following example demonstrates the various types of confidence methods that can be used, including public cryptographic keys, verification methods, and Decentralized Identifier Documents.
{
"@context": [
"https://www.w3.org/ns/credentials/v2",
"https://www.w3.org/ns/credentials/examples/v2"
],
"id": "http://example.edu/credentials/3732",
"type": ["VerifiableCredential", "UniversityDegreeCredential"],
"issuer": "https://example.edu/issuers/14",
"validFrom": "2010-01-01T19:23:24Z",
"credentialSubject": {
"confidenceMethod": [{
"type": "BiometricPortraitImage",
"image": "data:image/jpeg;base64,/9j/4AAQSkZJRgABAgAAZABkAAD",
}, {
"id": "urn:uuid:818d5ca0-3978-11f0-8658-4f17a1afd652#key-abc",
"type": "JsonWebKey",
"controller": "urn:uuid:818d5ca0-3978-11f0-8658-4f17a1afd652",
"publicKeyJwk": {
"crv": "Ed25519",
"x": "VCpo2LMLhn6iWku8MKvSLg2ZAoC-nlOyPVQaO3FxVeQ",
"kty": "OKP",
"kid": "_Qq0UL2Fq651Q0Fjd6TvnYE-faHiOpRlPVQcY_-tA4A"
}
}, {
"id": "did:example:123#key-567",
"type": "Multikey",
"controller": "did:example:123",
"publicKeyMultibase": "zH3C2AVvLMv6gmMNam3uVAjZpfkcJCwDwnZn6z3wXmqPV"
}, {
"id": "did:example:1234",
"type": "DecentralizedIdentifierDocument"
}],
"degree": {
"type": "BachelorDegree",
"name": "Bachelor of Science and Arts"
}
},
"proof": { ... }
}
A confidence method can express various metadata such as the [=issuer=]'s level of confidence that the [=holder=] is the [=subject=] of the [=verifiable credential=], specific form factors or mechanisms of authenticators, and/or references to other [=verifiable credentials=] or versioned trust frameworks. For example, an [=issuer=] can make a [=claim=] about a confidence method that is based on a cryptographic key pair, but to produce a signature using that key, the [=holder=] has to unlock a device using multi-factor authentication.