J1 RF 07 Andres Junge uPort approach to Ethereum Identity

hello how you doing I'm Andres unit and from you port I'm gonna talk a little bit about you port this is not the classical you port talk is more about what we think it should be the theorem identity what we think I identity theorem should be we've been working in you port since three years now and when we tried to approach the identity problem we have seen a lot of different use case and not of different definitions of identity for example for government it's all about taxes they want to have a number for you so you can identify you if you pay taxes or not I'm from Chile and in my country the identity number it's called tax identity number so it's basically for that corporations basically want to identify their customers and their employees to give them different access to different parts of their system and to track how they pay or they buy things classical web tool companies they use email Facebook Connect logging with Google that's what they think identity is about for vinter companies it's all about kyc everything the company here is facing in almost all jurisdiction all these anti money laundering laws and terrorist financing laws so it's basically all about knowing who is working with us or with them for it lyrium depth its money theorem address they only need to know that sometimes they need to know more about who is behind that III mattress or who is in control of that address and for NGOs it's a form of verification a valid form of verification and use mostly identity NGOs are more focused on refugees because it's hard to track who someone is if they don't have any kind of identity when we try to approach uper we always think about standards we try to build something that can be used by anyone that is standardized and you have a lot of different words that the problem we find out it means different things to different people so you find that some people of think claims are one thing some people think registries are one thing at the stations identified credentials you will find all these different words sometimes it's the same meaning for different audience but sometimes it's completely or they're subtle difference for them identity standards the first identity standards was made by the ITU it's International Telecommunication Union it's very old one it's it's crappy one in my opinion the only thing that survives from that is the x.509 standard it's the thing we use for us HTTPS SSL certificates all the thing lucky for us the web 2.0 2.0 world came out with open ID and wealth basically for identification our authentication and authorization and basically all the solutions right now are built on top of that Facebook Connect and Google logging with Google and all the other stuff are built on top of that oh and right now we're working with something called the decentralized side identity foundation well the the URL is there it's an identity dot foundation so it's pretty simple I'm going to talk a little later about that okay there's some key concept we want to we want to address here first is identifiers what identifies someone or something because identity is not only for people it's sometimes we want to have identifies for other things like IOT devices or contracts smart contracts or pieces of land right so in our model on or in the gif model identifiers are called deeds decentralize it the IDS also an important concept is the claims claims are things that someone says about somebody or something about something but it's a source make a claim about a target people also call this reputation statement and the claim always have a source and always have also has a target we make a difference between claims and facts because facts means that someone verifies that or the source is verified somehow I can claim that this audience is great but it's not verified at all or well probably yeah so if you trust me on do not trust me that depends that makes the claim more valuable or less valuable right another concept we will run we with think it's important and we find out it's important it's a way for asking for identities the problem right now we're facing is that we have identities but it like the normal identity or government based identities it's hard to us to present to some to up to a software to support our service so the flow of how the identity flows from the owner of the identity to the consumer of the identity is something we need to address too and also how to ask or verify for a claim so we build you port you port we build it as an open identity platform we want to be very open and make it useful for a lot of people and we build on top of easy room that's why we're in this conference and not in an hour [Music] okay these are the key concepts for the you pour platform first for us identity is on em need em need is a concept we refine which means multi network ID at first we thought okay identities can be material matrices but then we find out that the same material address can live in different networks in different block chains we have now four block chains maynot and the three test nets but also we find out that people have private blockchains which makes more difficult for everything so m-net it's a small encoding standard or missing our Thunderbird it's something we put it put it to the to a community which encodes the network ID and the address so it makes it easier to understand if an address it's from from from which network it belongs it can be used for public key / public private key combinations but also for addresses of contracts we also build something a proxy contract it's it's optional but it's a contract that allows people to manage their keys in a better way we find out that people it first they used their a theorem address as an identity identifier but then if he lost his key then he lost all his identity and all the claims for that identity so we thought okay let's build a proxy contract that is actually the identity of the user and then the keys can manage that contract but it's an optional thing you if you decide to use another contract or another way to manage keys you can still use the you port also we build registry something we think it's a shared space where people can share public information or public claims for other people and we propose a standard for that this is the ERC summon 780 I'm going to talk a little more about that later the other thing is that we want to use claims we want to claims to be sign it by users and verified by other users so we need to have all the public key infrastructure the same way we used to the old one but without the certificate authority certifying something we decided to build a public infrastructure in a decentralized way so we proposed a way for doing that in a standard way also for requesting clangs or for issuing claims or for sending planes to the user and all that stuff we find out that there's no single easy way to do it so we define it a messaging system which is JWT based which can be signed by identity so all this all this JW tees are signed by the identities which key which publicly store on the registry which is which allow anybody to check if the yeah if the ID is the one actually that is signing the JW team also we made a way for requesting standard private data that way allows users to select which information the one they want to share so if I'm a DAB or a service and I decided okay I want to ask the name or the birthday from a user and then the user received that and he can choose to disclose their information or not that's what we call a selective disclosure we need to have a really cool flow that allows the the user to check who is actually requesting this information and a way for giving that information back to the requester all these claims we also find out that not everything should be on the blockchain for privacy reasons and for speed reasons there's a lot of use cases where people don't want to use the blockchain at all they don't want to sank transactions they just order or the contract there are no contracts involved who wants to check claims or something they're just users that needs to have an identity that's permanent somewhere and all the information should flow in and off chain way so we built a format which we call attestations or credentials or badges we we haven't decided cool name but still it's a JWT standard which which aspects which claims are which is the format for it for a claim and also we are working with the decentralized identity foundation and that if they define it standard for the D IDs for the centralized identities and we build a compliant implementation for that okay how okay the DES centralized identity foundation say define it something the D ID did the centralized identifier which looks like that it's the ID method and the method specific identifier this is basically because the the the di f it's it's a foundation that is their members are from everywhere people from IBM Microsoft sovereign we are the people from a burning also so not all the all the solutions are blockchain based so and this understand that the DAF standard should support all the methods so basically that's the format for it so our our D IDs the u / deities are the ID viewport and the M need this is how an indemnity looks is encoded in serum address with the network and this also I think called resolver the resolver basically given a D ID can resolve at D ID document or a document for a identify identification attributes for someone of course this resolvers should only provide public public information in case we are asking for private information then we should do a selective disclosure request so the D ID document contains public claims public keys and points for other for more identities in case some storing my information in a secure Enclave or secure hub then I can point my user or the consumer of my information to that to the point and of course there's the resolver who resolves from the 80s to the IDS documents well can you see that this is our our proposal of the registry this is our version of the of the Year C 780 implementation which is basically a registry it's hard to read but it's not that complicated it's just a mapping of my pink of mappings yeah but you basically store information for the user which is we just think it's only public information our resolver if you want to resolve the the Eid that's that it's written down there basically you go to the registry get what we call the you profile ipfs which is basically return me the ipfs hash where the d ID document lives so basically you give that and it looks up in the pupil registry for the ipfs hash based on the emanate of the user and returns back but this same registry can be used to store claims from somebody else like if the claim is door an NTFS hash or if the hash itself of the claim can live there so it's up main it's a multi-purpose registry for storing everything we find that should be public at all ok we always thought that we shouldn't build anything that it's too monolithic that it's a single thing which we always thought that we should build something layer that we can change or you can up in to use some things so on the bottom is a theorem we can build an optional access control layer and also as i as i said before we can build the we can run the you poor proxy contract as optional to then we have this m'not which mainly the d ID which is the identity read identify fire and then if you want to store public information for the for that identity you can use the unchained registry if you don't you don't and if the public infrastructure relies on this so if you want to use another way of doing public infrastructure you can use another way of doing it even and not even and not decentralized or a centralized public infrastructure then we use ipfs for the document the ID document storage because well my PFS is so cool kudos to them then we have build a deed resolver and the public infrastructure on top of that and the off chain claims which is basically JW G's there are sign it of chain and flows in this system and we have the selective disclosure flow and all the other messaging flows yeah there's we have open everything except for one thing which is the mobile app not because we don't want to because it's not ready to be open source but it's gonna be open source soon but all the layers are we have specified in documents we have demo apps we have different kinds of JavaScript libraries that allows you to read from the registry right on the registry deploy contracts and all that stuff the main endpoint or entry point for this is developers the you bored of me our proposal for the theorem registries on on well on the AP 780 and mostly all of the repo information based on your project on github and of course if you want to send us an email just send us to team that you poured on me or if you want to talk to me later of course I'm gonna be here there's also Paul Paul raise your hand Paul sees our partner manager so he can well he speaks English better than me anyways okay okay well this one last thing before I go to the questions it's um we also we started this kind of thing in Inadi theory conference when we have a QR code and people scan this QR code and they receive an attestation that they were there that's actually not true because it's not really a proof of a presence but it's a cool thing and people like it so if you have your super app installed you can scan the QR code and you will get a an attestation an automatic attestation that you have seen the cure code because people in the streaming and also seen this QR code how this works well basically the the cure car is a selective disclosure request so you won't get their requests that someone is requesting an attestation that someone is requesting information from you basically what we are requesting is your atheneum address or you REM need or your D ID and also we are requesting a push notification tokens so it allows allows us to send the token or the attestation back to your phone so yeah I hope it works if you don't just let me know and that's it I'm gonna leave it through the questions so you don't need to rush for the photo scanning do we have temporal questions cool thank you I'm just wondering with the SI 780 claim registry how you store IP fierce hashes when they're traditionally multi hash which is more than 32 bytes long I'm also wondering why that QR code is so enormous well we encode the ipfs hash we just we don't store the ASCII code with just two base 58 I guess encoding so we can store in 30 bytes 30 32 bytes selfishly by its but then they also have a multi hash prefix which tells you which hash algorithm to use and so on um well I need to check the code how it's done but well we can store in the yeah and why the cure code is so big because they're the JWT that we are putting in there is first sign there's the signature of it and it's also requesting well the it has the callback URL and also everything else that is requested thank you yes thank you very very much for your presentation was very nice I also read your C 780 and I commented also on it and I I was wondering you if I read it correctly you want one contract for every chain one year C 780 contracts for every chain not really okay we are using one for our implementation but people can use their own well yes because how I see it is it it would be nice if there would be one per use case perhaps or yeah yeah if you're an a tester and you want for example the question that they ask that the later talk about how to revoke things you can use the registry to revoke things and probably if you a D a tester and you and you want to have your artists stations there and your revocations also in your own yeah and with different logic probably yes okay thank you very much yeah sure thank you ilex mode from Remy and during difficult you mentioned that users don't like to create first their accounts using u ports so do you think it is better to start implementation from the business side or service side for example a trip to exchange will implement your port and after that offer users to use that system I don't think I get the question so you're basically asking if I think the adoption will go from services asking people to use you / or people with you / asking businesses to say i i have you port why yes because as far I know you already during a few years developing new port yeah and now user should create account we have we are seeing more people / mean businesses companies or institutions building their solutions on you port and telling their users use you port we don't have a big U port user base right now to come to that is relevant to to an app so people build their you perf integration first and then ask their users to use you port that's a and problem we have like my mother for example it's tell you princess okay what do I do now nothing really if you don't have a site that you can use there's nothing to use for it so but for example took it's they built all older station system with you / and then they ask their users okay it's tell this app because well they need to store their claims and they're these somewhere but they are also building their own app based on this standard specs and what about potential customers from traditional economy not from trip to space are you going to work with such companies yes of course there's a lot of companies that have show interest interested in this not from if they're mattress but for a theory micro system but most from other from web 2.0 places they only want to use libraries they don't want to know where the identity store or where the claims are it's just like okay as long as I can provide an easy way for people to log in and not managing all the users myself great and one more question I usual making authentication with do you need transaction for each authentication no one thing we we decided is that we thought that doing a transaction for every signing a claim or revoking a claim or well repo can claim no but signing claims or showing claims or presenting claims to user doing a transaction for each one of those operations it should be very costly so that's why we decided to move everything off chain all that all the artist stations are off chain or the selective disclosure flow is soft chain right now for example you are not if you scan this pure code you'll receive an attestation and that is there's nothing on chain on there there's no transaction involved still if you want to load the or store the your attestations or some public at the stations in the blockchain you can still use the registry to store there and there will transaction be involved okay I think we have two minutes more I don't know or that you need to have them Mike because this sorry it's not my rules my name is not Iike great work at you port firstly I was just thinking that do we have a cave I see a complete cave I see module coming up on you port or are you waiting for developers to develop that and then you integrate with them good question we are experimented with some kyc solutions in app that allows you to basically send your information like your passport or whatever along with your d ID to a provider that will do a kyc for you and issue an attestation back to you we are still experimenting with that we don't know if we're gonna put it in the app at the end but everybody or everyone that wants to build such case like talk or friends connect or everything else they can do it on their own there's no need to do it on the app thank you you're welcome that's it okay thank you very much [Applause]