ERC Identity

[Music] quick quickly about me you just heard it but I built these things and recently also initiated the ESC 20 tokens standard work italic and it became a lot bigger than expected yeah so one wee thing about identity and this talk is about identity and it's also an EOC what is identity right so if you think about identity today mine doesn't work like it could be for example your physical attributions right like it could be how you look or your biometric data and some kind of like physical properties attached to your physical person and your body for example right but an identity could also be the group you belong to like the country you belong to or even the history over time like the reputation over time or the things you experience or your ancestors experience and so on and this is all what we kind of aggregate to our identity today obviously identity mostly like some kind of like forms and certifications we get from our government or we get from like all kind of other places for example we have Social Security numbers we have plastic cards we have passports and so on this kind of like is what we think our identity is today and this is what we use in the world to represent ourselves so when we think about the passport for example what is it really right what is a passport it's basically the fact that there was a government agency bureaucrat sitting somewhere and I came along with a birth certificate and a photo and maybe dementia of my biometric data and they figured out yet makes sense it's all matching I give you a passport so basically it's a collection of things and what it is is actually collection of claims because what I'm having here is I have a claim the birth certificate which somebody gave me when I was born right it's already claimed but that person who was there maybe the doctor or maybe was the hospital that I was born there then I take a physical claim which is basically a photocopy or maybe it's some biometric data scanned and then it creates a new claim now done by this guy here there's no laser pointer yeah and this creates now this new claim a passport so basically almost everything it's just a lot of like attestation we get from each other and we give to each other right for something we could look at here this use case I have passports or I get driver's licenses here or for example I have a university degree and this is in the first place issued by a government to a person who can issue that degrees to in universities itself and they don't issue a degree and this is really hot here to do another person right so it's a lot of claims on the end it's all claims it's a humongous network of claims and we came up with a lot of different type of claims secrete certificates and whatnot and we collect them over time and it's kind of like how we represent ourselves in the world maybe not necessarily with our friends with our friends we might use social networks which is also kind of like a collection of claims but if we go to any kind of like company corporation we make it interview or whatever we just take all of these claims you know we show them here look at all of these titles and it isn't this and that and this basically tells the other person a yeah trust this university it's a big one looks like a real thing here what he has here I might just hire him for example right the problem with the current systems is that we have these huge institutions which issue claims and I'm the tiny little guy and I will receive these claims and I kind of like the power sits in these institutions and it sits in the humungous data walls right so identity claims today is basically not necessarily with me I mean it's it with the papers I carry around but it's kind of more like monopolized ecosystem whatever could be centralized all the things we could just take that and distribute that power and an ability to claim things about each other and why do I have to point have to point this way so for example when we think about standards right so what our standards good for and I initiated together with Vitalik basically I proposed it centered and it was a huge debate and on the end everybody started like using this standard it really helped foster few things for example if we look at the token example right the token standard and how it kind of came to be is we had already things like Bitcoin and then people came with this idea hey mate let's make colored coins and then there was this project master coin out of it later split it off counterparty and what's the idea is that we came basically create coins on top of Bitcoin we have the same security like like the Bitcoin network but we can create new coins and then company suddenly can issue their own coins and that was all really nice and neat and it was kind of used but not really big then the theme came along and also people started issuing tokens inventing their own ideas of how a token can look like and we had things like big eggs the gold token which was kind of like the first at least I know of rather bigger custom token but what really actually made this very interesting and very powerful is when you come up with a standard like if you say hey a simple set of rules you basically say hey let's make these three four or five functions let's all use this function as the operator the interface towards the token and suddenly we can have wallets exchanges other contracts interacting with those tokens and suddenly you have a complete mess yeah yeah and this is actually what spurred all this this craziness let's say because suddenly we have a rather simple standard which doesn't really even determine much but it allows so much flexibility still inside that all of this experimentation all of this crazy new ways of how using it became possible and that's why it took off so big and it's still like obviously in the rocket ship flying whatever so it's actually all about standards if we have standards it allows us to basically interoperate and be compatible and especially in a platform like aetherium where you have an endless amount of possibilities of what you can do and how you can interact and what you can create standards are really the key to make a viable ecosystem flourish so I thought about like a few years about two years about like kind of like how I then it could look like was working back then with a client and thinking about this idea and it kind of like had this idea okay should be a smart contract and should work sent you and lalala and I thought about it and really until now I didn't came up with any way different solution and the one I had back then and actually almost expecting to somebody else would came up with a standard and Meaghan DRC which didn't happen so I did it so I created this standard how I initiated it you know in the end it will only become a standard if everybody participates and everybody agrees but that's the whole point of a standard and it now has the number seven to five and I graded this standard which basically defines a smart contract which represents you right I represents not even a person it could also represent a machine or even could represent a item an object or a company so this identity is standard basically consists out of three components so it itself is a smart contract which is representing you and it has these three components it has keys which are your operators either can execute so you can actually act on the blockchain su and it has claims so I will explain these three pieces here and then show some examples of how this can work the idea is basically that you have these keys and this is how you act in the world right so for example you can make transactions obviously on the blockchain you can send money around and then you can prove with that that if this is one of your keys in your identity that it obviously must be done by you I can also assign any kind of documents or I can send assign any kind of proofs or messages in the real world proving that it was me doing that as long as I attach my identity to it the person seeing the signature can verify the signature and can assume very high likelihood that it was me so actually the list is like unlimited because what could do with these kind of things it's like not very limited in this sense the idea is and it's the beauty of public private key cryptography is that we can have this kind of control over we can basically like validate ourselves in in the real world and others can probably validate this this as well they can check that this is correct without ever I ever have to reveal my password or my secrets or whatever and I think we are just getting started into the h of key signing right so what we do this in all the time for basically everything and a really simple use case for this for example would be logins right I can simply sign a message I want to go into your website and they can prove that maybe even check my identity and do some kind of verification process and they can let me in and I never send my password over the wire or anything and I could even use a third party to fact education device the other part is and because it's a smart contract I can execute so this standard has a execute function which allows you to act as yourself on the blockchain so you could either use the keys to do actions on the blockchain and then somehow like point the people you interact with to your identity so they can check things about you or you can actually act directly through your contract and the important thing is that you can add other claims to other identities although other people objects or even other smart contracts which might just be code and you can claim that for example you verified them or maybe you're an issuer about claims maybe a government and you can attach claims and it's very probably coming from that identity and the third part and that's actually the important part which is its own ERC after some discussion we decided moving it out in ESC seven three five and basically making it substandard after seven to five and the idea is really to have a way to attach claims to a smart contract and now we have all to debate exactly how this can look like and I have an initial craft up their hardest can look like and how it can work the benefit of claims in your own identity it can be added by anyone but I always have to prove it right if it's my identity I want to need to know I want to be able to approve it because I don't want that things are attached to my identity which I don't really agree to this is especially important if I'm a person if I'm a smart contract maybe an approval is not even needed maybe a smartphone you can just like get a bunch of claims and randomly people can do that and it can't be changed without my permission now I can be changed without my permission so basically the person who issued to claim about me on my identity once I approved it they are technically in control because they issued it right but if I don't focus I have to change something about the claim and I'm not agreeing I could always remove it because it's on my identity so I can allow it to add but I can also take it off any time if I disagree with a change or for example if the change the data hash and I never really was in their office again or whatever and the important thing about the claim structure in this standard is that the claim itself contains an actual signature and the beauty about having it in the smart Condor and having a signature that this could be any kind of signature the difference here for example if you would make a registry of claims then it's always they always have to be an aetherium signature it's and theorem transaction and this month conduct registry will determine how these claims are added but this is a really open container because it can be all kind of different type of signatures in the future doesn't need to be in a theorem 1 it could be anything and it obviously contains the actual claim reference or claim data it really depends on what kind of claim it is most of the cases you don't want to store any kind of actual data on the blockchain you don't want to store an extra claim like it may be here your the bytes of your photo or maybe your actually address you only want to claim at the claim with the reference to the actual data so the actual data will still sit somewhere else and this is to be debated this could be sitting in swarm ipfs or this could be sitting with the company directly still but in some cases even maybe you want to have a bit mask or something which actually says something about you right in the bytes of the claim where there's more detailed claim details so to say in it so basically how this could look like in detail how it's currently in the in the standard and because it's a smart context and up it's obviously code we have a claim type and the claim type for example says maybe it's a claim type 0 1 2 3 4 5 maybe we say 0 is the claim for biometric data and 1 could be the claim for an address so if I see you on your smart conduct you have a claim type 0 and a claim type 1 and both issued by an issue I trust is the German government and maybe it's the Deutsche Post which knows your address and I trust them then the only thing I have to check is the signature actually contains contains actually holder address which issue at the address of the of me in this case it contains this number here the claim type and it contains this little data and it comes out to an address which is still owned by the Deutsche Post or the German state didn't know that claim was actually issued by the Deutsche Post or the German state and as long as any external party trust that issue oh he can be completely confident that you have an address and that you are human or maybe some kind of flesh thing right if you have primary data and that might be fully enough to allow you access to something to issue credit or to issue an account or whatever you want to do in an automated process so it's all about basically trusting the claim issuers and it's obviously that depends on what kind of like issues this could be and in the beginning this probably will be big institutions but in the future this could also be peer-to-peer networks or other kind of reputation systems or whatever the claim can be it's completely open right so how would the process look like and I have three minutes so I have to go faster for example like a off chain example could be here I'm walking around with my smartphone simple use case I want to get into a disco and the guy has to prove that I'm over 18 or whatever so he would basically send me from his phone a random string and this random string is something I can sign and I would sign this random string plus my identity address and send it back to him he would be able to verify ok this was signed by this key and he signed my random string so obviously he could he had to private key he could sign it properly and yes the address is identity so he goes check on the blockchain gets the claim he needs or whatever claim that is right maybe it's the age whatever or an age certificate that's over 18 says that's over Tina zone he basically checks the claim and this means he checks the signature and goes and checks on the SmartConnect of the issue that actually the key he's designed what was still there so this would be the power for the issue to remove the claim even though that I might not agree to so as long as the signature is correct and returns a address still owned by the issuer this person here the bouncer can be confident that this person is whatever the claim sensitive does and it might be a very abstract information maybe just over 18 it doesn't even mean he's 20 30 or 50 or 110 it just says it's over 18 or he's allowed to just go in for whatever reason right so you could do this in the off ten world basically by going around in signing messages all the time and then people can always go to your block 10 identity and check hey who is that person does he have to write requirements and you can verify these kind of requirements if I do this on the blockchain I basically can act through my identity I can call a function on another smart contract and this could be their super important who a smart contract and I really want to use that function but this function requires to check some identity stuff otherwise it can't be used so the smart content will automatically you realize okay an identity is calling me so I get the claim from this identity smart conduct back I will verify the signature right in the smart contract go to the issues smart corner and check that key is still there I know the key still there so it's a valid claim still attached here I trust the issuer I don't even need to know the actually data most of the time we don't care about the extra data I don't know care how what your name is or how you look like until as long as I know that you are a person and that you have maybe a residence somewhere where it's where maybe it's the country or whatever or maybe it's just enough to know that you have been residents at all and that's it I can continue with the execution of the super cool function in this case so you can't do this you can use this on chain and you can use it off chain and my time is off and you can basically do this really simple steps of actually two three steps to completely verify the claim and it's attached to my identity so I'm full and control and this allows basically all of these interesting things and it combines these these two little rather simple standards and it gives enough flexibility that all kind of experimentation can happen so we can figure out what kind of claims we trust how these claims can look like in detail where they are stored how could you even verify the claims actually Conda maybe in SEK snark proof outside of the blockchain people can come up with all kind of systems they want to claim about each other and as long as we follow the simple standard we have that interoperability which can create all of this network effect we see with USC 20 for example so it's all about discussing and coming to an agreement what makes sense start playing around and making a huge experimentation around it [Applause] [Music]