Principles of Self-Sovereign Identity

Principles of Self-Sovereign Identity

Tuesday 5G

Convener: Joe Andrieu

Notes-taker(s): Garrett Schlesinger

Tags for the session - technology discussed/ideas considered:

Discussion notes, key understandings, outstanding questions, observations, and, if

appropriate to this discussion: action items, next steps:

Chris Allen's writeup here:

https://github.com/weboftrustinfo/self-sovereign- identity

Security

1. Protection

2. Minimization

Controllability

1. Existence

2. Control

3. Persistence

4. Consent

Portability

1. Interoperability

2. Transparency

3. Access

4. Portability

In Europe, there is the possibility of adopting these principles into privacy frameworks.

Goal: at least make this a pledge to define self-sovereign identity.

Joe Adrien: important aspects are: Control, Acceptance, and Cost/Access

Control: Self-generating, opt-in, non-participation, opt-out (remove my data or tell me why you

can't), recoverable,

Acceptance: standard, simple, technology free, public ledger (alternatively: trust anchor/non-

reputable), reliable, substantially equivalent ("at least as good as what's already there")

Cost/Access: license + use, financial, cognitive (masses need to be able to understand why this is

secure)

Question: what problem does self-sovereign identity solves? 1) administrative-issued identity (ex-

employee disappears, refugee coming into a new country, no abstract representation of self in a lot

of these instances), 2) Credentials can be held by an outside agent with no recourse to recovery.

The most important thing: who is the authority/who controls our history and everything that we

have done? Non-correlated identities: you should be able to not have links between your identities

in different contexts unless you want them.

Can transparency sometimes be a bad thing?

Correlatable identities: multiple parties correlating partial identities. Non-correlatable is

challenging if not impossible, but it is desirable. Best we can do right now is minimization.

Want to cross international borders without losing control.

Resilience

Stewardship/Custodianship

Non-correlatable identifiers

Purpose bindings

Contractual obligations

A big point: right now, the scales are so tipped in the direction that compromises user privacy that

it is much better, in crafting an ideal identity management system, to err on the side of more user

privacy.

Perfection can also be the enemy of the good. Can we make incremental steps toward identity

sovereignty? Can we at least make this an expression of our goals and make the intentions clear?

Where is the business model? Really in the tooling that accretes identity information and handles

identity claims.

What are the practical applications?

What is it, really? How does it fit? Reputation? How does it filter bullshit?

The simplest version is: if you control your private key, you can use that in other contexts and link it

as you choose.