From 966ad4450c17edb501ff1e413175c4f3dc84d722 Mon Sep 17 00:00:00 2001 From: Philipp Bolte Date: Tue, 7 May 2024 12:38:28 +0200 Subject: [PATCH] docs: reflect new version of trusted issuer registry (#94) * docs: reflect new version of trusted issuer registry * chore: wording * minor text edits * docs: reflect new contract addresses and governance clarifications * fix: typo * updates to TIR edits main edits: - removed section that relates to governance. will need to amend OCI Governance doc instead. - removed some SHALLs that concern OCI, not wallets. for wallets these are a given that OCI must deliver. --------- Co-authored-by: Chris <34170038+bluesteens@users.noreply.github.com> --- content/DRAFT/index.html | 140 ++++++++++++++++++++++++++++----------- 1 file changed, 103 insertions(+), 37 deletions(-) diff --git a/content/DRAFT/index.html b/content/DRAFT/index.html index 0f1db7d..1a8c216 100644 --- a/content/DRAFT/index.html +++ b/content/DRAFT/index.html @@ -646,36 +646,101 @@

DID Resolution

Trusted Credential Issuer Registry

- To enable Digital Wallet Providers to accept credentials issued from a vetted Credential Issuer only, OCI - maintains a Trusted Credential Issuer registry. Digital Wallet Providers SHALL be able to process and verify credentials issued by any vetted - Credential Issuer that is endorsed via the OCI registry. + To enable Digital Wallet Providers to accept credentials issued from vetted Credential Issuers only, OCI + maintains a Trusted Credential Issuer registry. Digital Wallet Providers SHALL be able to process and verify + credentials issued by any vetted Credential Issuer that is endorsed via the OCI registry.

- The trust placed in Credential Issuers is a key aspect of the OCI ecosystem. In order to - ensure that this key role is not exploited, the trust is anchored - in a decentralized and cryptographically verifiable way. The crucial information of which issuers, who have satisfied OCI’s Credential Issuer Conformance Criteria, are to be trusted is stored in the Trusted Issuer Registry, which is managed through Ethereum Smart Contracts. + The trust placed in Credential Issuers is a key aspect of the OCI ecosystem. To ensure that this critical + role is not exploited, trust is anchored in a decentralized and cryptographically verifiable manner. The + crucial information about which issuers have met OCI’s + + Credential Issuer Conformance Criteria + + and are therefore trusted is stored in the Trusted Issuer Registry. This registry, managed through + Ethereum Smart Contracts in accordance with ERC-7506, + serves as the single source of truth for determining the trust status of credential issuers during credential + verifications.

- OCI maintains multiple versions of the Trusted Issuer Registry for production and demo/testing purposes. - You can find the deployed contracts at these addresses: + OCI maintains multiple versions of the Trusted Issuer Registry for production and testing purposes. + Available environments, their respective network, contract address, and namespace are listed in the table below.

- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
EnvironmentNetworkContract AddressNamespace
PRDMainnet (Ethereum Testnet) + + 0x962646c54ba9C53aA16f662F50175407681B26f3 + + + + 0xdB2b5db56B34d1455E52E135f01989EFC13E8Cb3 + +
STK-INTSepolia (Ethereum Testnet) + + 0x6F68c931d785eee932d29A4419B6e28081bbb597 + + + + 0xb229AC3bC15bacCe74A721a722d8098178c22353 + +
WLT-INTSepolia (Ethereum Testnet) + + 0x9497Bb14906aa6D4241Adf83708891fAe6ba171C + + + + 0x6c151A6139c40966029B9ce8e7b24a4D61215921 + +
PBL-INTSepolia (Ethereum Testnet) + + 0x949AEe13C99Ffd7250DaC5865659DB17744352B9 + + + Developer's wallet address +

- The development environments are deployed on an Ethereum test network. STK-INT mirrors the production - environment and should only be used for testing purposes by approved OCI statekeepers. WLT-INT should be used - only by OCI digital wallets for testing purposes without voting processes. PBL-INT is generally open without - any restrictions to make quick testing easy. + Trusted Credential Issuers are systematically organized into distinct lists within a namespace, each + corresponding to a specific credential type and version. Each list is uniquely identified by the keccak256 + hash of its JSON-LD schema IRI.

+

+ The Trusted Issuer Registry is deployed by OCI on the Ethereum mainnet for use in production (PRD). Versions for + testing purposes are deployed on an Ethereum test network. PRD represents the current state of + OCI-conformant Trusted Issuers that SHALL be used by Digital Wallets during verification of Verifiable Credentials in productive environments. + STK-INT mirrors the production environment and SHOULD only be used for testing purposes by approved OCI + Statekeepers. WLT-INT SHOULD be used only by OCI Digital Wallets for testing purposes. PBL-INT is generally + open without any restrictions as a general-purpose playground for developers. +

In addition to readily deployed versions of the contracts, OCI has also published the source code as well as implementation guidelines on GitHub: Trusted Issuer Registry.

@@ -688,44 +753,45 @@

Verifying the Credential Issuer

- A Digital Wallet MAY also subscribe to changes on the Trusted Issuer Registry by listening to events emitted - by the contract. This way, the wallet can be notified of changes to the Trusted Issuer Registry and update - its local state accordingly. + A Digital Wallet MAY also subscribe to changes on the Trusted Issuer Registry by listening to + HintValueChanged events emitted by the contract. This way, the wallet can be notified of + changes to the Trusted Issuer Registry and update its local state accordingly.

By deriving this information from the contract, the Digital Wallet SHALL check that the issuer stated within the claims of the respective