The Web3 Identity Stack with Nichanan Kesonpat

sure hey everyone um so I'm going to be talking a little bit about the web 3 identity stack um so first of all uh just a little bit about myself my name is Niche um I'm currently uh doing a head of platform and research work at 1kx and I'm also a contributor at madagamma Delta and in the past I've I was a smart contract Dev at Upstate interactive and mochi Community um so just a little bit about what we'll be covering today we're going to go over the evolution of identity on the internet uh The Core Concepts in decentralized identity and I'll give a layer by layer overview of the decentralized identity stack from blockchains uh and verifiable data Registries to decentralized storage through to wallets authentication authorization and art stations um okay so first like just to Define identity a little bit broadly speaking um identity is a an emergent property that consists of data associated with a person or it can be an uh an entity or an object so in the physical world um we kind of hold these loose associations around as mental associations in our heads but um in the digital world this is formalized into two components which is the identifier which is the unique set of characters or numbers that identifies a subject and then the data associated with that subject so um it could be anything from your passport number which is associated to your travel history your student ID contains your links to your academic achievements your bank account to your financial history Twitter to your tweets and so on so why why are we talking about decentralized identity today and why is this important so for individuals um I uh the the dead stack allows us to Take Back Control of our identity um so we no longer have to depend on centralized Gatekeepers and identity providers like Google Facebook and Twitter and we can selectively disclose uh choose what attributes of our data we want to share instead of just um you know having that be in the the hands of uh uh centralized idps and the credentials are tamper-proof and they're stored on a wallet and in your device where it's portable and shareable so if you're interviewing for a job for example um you can uh you know show your uh University degrees and achievements um right there and it's uh and it's verifiable by the by the person that's consuming that data so for organizations you can verify information without contacting the issuer to verify the authenticity of the information it prevents certificate fraud right because credentials are immediately verifiable using cryptography it reduces the risk of being targeted by attacks by storing less user data and for developers it allows you to build user-centric apps that enhance the user experience um because you're safely requesting data directly from the users while maintaining their privacy um so just going over the different eras of identity on the internet um so in the 90s uh early 2000s the accounts are managed by applications so it's very application-centric in terms of um you know you you log you sign up with your username and password it's very poor ux for the users um because across applications you have to create a new account and there's low security because you end up you know repeating the same password like a memorable guessable password and and it's fractured right so the reputation that you build up on one platform is not easily transferable to another platform you have to keep authenticating yourself with the username and password each time and then we came Federated identity which is kind of the perversing Paradigm that we're in today where you create an account with identity providers like Google and Facebook and then um log into applications with social login oauth so in terms of ux is a big Improvement for the from the previous era and it's semi-portable in in terms of uh if you're storing your data with Google you can share some of your information with the new service that you're signing up for uh but it sends right so your your data is actually um in the control of these of these idps so now we're uh in the decentralized Paradigm where it's managed by P2P relationships with no sort of um special privileges to any one party so in the eyes of the registry um these peers are treated the same uh which allows us to have self-suffered and self-sovereign identity and a user-centric experience for jobs so these are some of the Technologies we'll be um going over in a bit um so just zooming into that um this is generally how um like the the stock kind of comes together you have your verifiable data registry you did and then you're making uh authentication authorization requests uh to the applications um on top um so your your identifiers are typically issued and stored on data Registries like blockchains or decentralized storage infrastructure and then you're making claims about each other or you're either your peer or yourself via other stations um and then the verify verifications are done using cryptographic signatures um so that's the the yellow the yellow arrows there um and then the state the technology that puts all of these pieces together is um decentralized publicly infrastructure so um you hold your keys in your wallet and it's used by uh you identities individuals communities to um authenticate improve ownership of assets and and manage your your um your dids um so there's over a hundred uh did methods that's listed on the the WC3 website and it's often associated with their own blockchains or vdrs so on ethereum there's one where your account is your kind of your pseudo identity um Cosmos represents uh their their inner chain assets um as an identity um and then on bitcoin there's one as well and then there's new um uh or emergented methods like pkh which is uh more Ledger agnostic where it resolves to the chain um uh um in the background so that you can just have one key in multiple identities on each chain um so just a quick anatomy of it did um so the dead scheme uh kind of tells uh systems that you're you're referring to an identity and not something else like an email or a URL or website and then the method is like which which registry you're on and then the identifier is you know your unique identifier within that registry and then it resolves to a dead document which contains all the um the information about you and the authorization you know how you authenticate your your uh yourself um so in terms of decentralized data storage um we have blockchain based uh storage like ethereum and our weave where the data uh so the the intuition here is that each full node has to store the entire chain and users page transaction fees based on demand um but ethereum is unsuitable for most data due to you know high gas costs and lack of privacy because data is immutable by default um our weave is another blockchain based example of um of decentralized storage where you're uploading um onto our weave and you're paying a one-time uh fee and your data is guaranteed to be stored permanently um and then there's a contract-based data storage like ipfs filecoin store J that intuits that data can't be replicated um and store it across all nodes and instead it uses uh contracts um or like service level agreements let's say with multiple nodes who agree to hold your data for a specified period of time um in terms of how you update these data so the examples that we gave before works well with immutable data but most of the applications we interact with today you want to update your profiles and and contributions and things like that right so um the web 3 protocols that are designed to for mutable data enable updates whilst leveraging the decentralized storage layers underneath so for example ceramic takes immutable files that are stored in ipfs and builds a mutable layer on top of it where you can update your profile and it gives like a like a snapshot or a data stream and then when applications read from the ceramic stream it gives the latest updated data um table lines is another example where you're essentially minting databases as nfts um okay so the wallets so the wallets here um are essentially broadly speaking an interface where you're where you're doing all these actions um so it's an interface and all the underlying infrastructure for Key Management um Communications how these issuers holders verifiers are making claims about each other um and so there's uh yeah so it's worth it's worth making a distinction here between crypto wallets like metamask and identity wallets um so crypto wallets right now aren't really designed to um like make make claims about another identity they're designed to hold your assets um and and sign transactions and they're typically specific to a blockchain network so you use metamask for evm chains and phantom for for Solana for example on the other hand identity wallets store identities and they and and they're more kind of compatible with the with the diagram we have here so it allows users to create and present claims so that they can present uh their identity data across apps and services um so these are some examples of identity wallets um polygon ID has a wallet where you can store your credentials like membership and your proof of personhood if you've done you know kyc or use something like a gay corn passport um yeah and so typically uh these these wallets hold your your is where you keep your verifiable credentials um in terms of Authentication um authentication essentially is the process where you're confirming your identity based on more authentication factors so these can be a digital signature your ID card a security token or in the kind of web one Paradigm where you're putting in a password um so in in uh in web 3 the wallets just use the key that they store to produce a a signature that serves as a proof that um that the holder owns the private key that's associated with uh with the account that you're signing in with um so this is a nice little like graphic to show like kind of the the evolution here so you're in what one you're kind of with your username and password right now most people are using social logins and then what web3 is going to be um you know log in with your wallet um so authorization typically comes with the flow of authentication but it's a separate process so while authentication you're proving your that you are you authentication tells the um application what um what data and what resources pertaining to you that they can interact with um so in Federated identity you're you're allowing Google to authorize third-party applications to view and update your your data stored with them um but in in decentralized identity it achieves the same thing but um your wallet like you're you're making um a a permission with your wallet to Grant the right to each third party without centralized middlemen um so these are examples of authorization prompts that we've seen in web 2. um then attestations credentials some terminology here attestations are just claims that certify that a claim and signatures are valid um and then credentials are any document or information detailing a piece of information about the identity um they're tamper-proof and verifiable uh they're held in a wallet and then verifiable credential is just a data model and standard defined by the w3c for for verifiable credentials um so here like the names of the of the parties like issuers holders and verifiers are are relative here so you you can be a holder in one scenario and like a like a verifier or an issue or a scenario so um you know an example scenario is a university issues credentials and you hold it and then you and then when you're going to a potential employer they can verify that the um that your degree is is valid um at the point of uh our verification so verifiable presentations is just a process to to share data with third parties um okay so in terms of privacy um there's uh emerging Tech like uh zero knowledge proof technology that allows you to um issue privacy preserving credentials to achieve things like anti-correlation so if you think about you know if if you think about if a an issuer issues credentials to a given wallet and their and their signature is um kind of the same in each scenario then if they collude then they can take these individual pieces of information about you and start building like a more comprehensive picture of you without your permission so um here you're just creating a unique proof each time without sharing the signature itself um and then selection of disclosure is just sharing only the necessary attributes and hiding the rest um compound proofs combining attributes from multiple credentials um and then generating uh and then combining it into one proof without going to another part uh back to the issuer and then predicates allows you to do things like prove that you're uh over 21 without sharing your birthday um so this kind of uh where these examples fit in uh so in vanilla verifiable credentials right if you you have all your information um uh kind of available for the for for everything to be seen on there but with zero knowledge proofs you can do things like selective disclosure if I want to verify that I'm vaccinated I can just show that I'm that my uh that my vaccination is still valid um and only share the vaccination date and not my name or birthday or anything um and yeah and then a proof of the signature for anti-correlation um so this is kind of a like a uh an overview of what we've just been through so you at the bottom you have your blockchains and verifiable data Registries which maintain your identifiers um and then the technology is involved here are like decentralized storage peer-to-peer networks then you have your dids which are you know your kind of identifier within that registry uh and then wallets help you manage your dids and and permissions and log into applications authentication confirms your identity authorization defines um what resources and application uh can read about you and then attestations is the claim that you're making about yourself or about another party um so putting this all together um yeah it's just a like an overview graphic of of uh of the web3 identity stack um cool so this is just some of the uh projects that is working in this space today tackling each of the layers um so you have your blockchains at the bottom decentralized storage um we didn't get to cover all of the all of the uh of the categories here but um yeah so this is just a snapshot of where we are it's it's grown a lot over the past a couple years and it's still um kind of fiercely debated how we approach or right um come up with uh different standards on how protocols can communicate with each other privacy is still a big hot topic of a debate and um and uh zero knowledge technology is is um yeah is still uh being you know uh under an active area of development so here uh there's some uh yeah so identity reputation is is a very big uh use case for applied ckp here um I think that's it cool so um so this presentation came from a much longer more comprehensive article that um that I've written on on the Webster identity stack so feel free to scan and um kind of give a give it a read if you want to learn further or I'll be around the conference um if you have any questions um thank you