ERC-1056: Ethereum Lightweight Identity

Metadata
Status: StagnantStandards Track: ERCCreated: 2018-05-03
Authors
Pelle Braendgaard (pelle.braendgaard@consensys.net), Joel Torstensson (oed@consensys.net)
Links
GitHub pageDiscussion on Ethereum Magicians

Simple Summary

A registry for key and attribute management of lightweight blockchain identities.

Abstract

This ERC describes a standard for creating and updating identities with a limited use of blockchain resources. An identity can have an unlimited number of delegates and attributes associated with it. Identity creation is as simple as creating a regular key pair ethereum account, which means that it's free (no gas costs) and all ethereum accounts are valid identities. Furthermore this ERC is fully DID compliant.

Motivation

As we have been developing identity systems for the last couple of years at uPort it has become apparent that the cost of identity creation is a large issue. The previous Identity proposal ERC-725 faces this exact issue. Our requirements when creating this ERC is that identity creation should be free, and should be possible to do in an offline environment (e.g. refugee scenario). However it must also be possible to rotate keys without changing the primary identifier of the identity. The identity system should be fit to use off-chain as well as on-chain.

Definitions

  • Identifier: a piece of data that uniquely identifies the identity, an ethereum address

  • delegate: an address that is delegated for a specific time to perform some sort of function on behalf of an identity

  • delegateType: the type of a delegate, is determined by a protocol or application higher up Examples:

    • did-jwt
    • raiden

  • attribute: a piece of data associated with the identity

Specification

This ERC specifies a contract called EthereumDIDRegistry that is deployed once and can then be commonly used by everyone.

Identity ownership

By default an identity is owned by itself, meaning whoever controls the ethereum account with that address. The owner can be updated to a new key pair account or to a multisig account etc.

identityOwner

Returns the owner of the given identity.



changeOwner


Sets the owner of the given identity to another ethereum account.




changeOwnerSigned


Same as above but with raw signature.




Delegate management


Delegates can be used both on- and off-chain. They all have a delegateType which can be used to specify the purpose of the delegate.


validDelegate


Returns true if the given delegate is a delegate with type delegateType of identity.




addDelegate


Adds a new delegate with the given type. validity indicates the number of seconds that the delegate will be valid for, after which it will no longer be a delegate of identity.




addDelegateSigned


Same as above but with raw signature.




revokeDelegate


Revokes the given delegate for the given identity.




revokeDelegateSigned


Same as above but with raw signature.




Attribute management


Attributes contain simple data about the identity. They can be managed only by the owner of the identity.


setAttribute


Sets an attribute with the given name and value, valid for validity seconds.




setAttributeSigned


Same as above but with raw signature.




revokeAttrubte


Revokes an attribute.




revokeAttributeSigned


Same as above but with raw signature.




Events


DIDOwnerChanged


MUST be triggered when changeOwner or changeOwnerSigned was successfully called.




DIDDelegateChanged


MUST be triggered when a change to a delegate was successfully made.




DIDAttritueChanged


MUST be triggered when a change to an attribute was successfully made.




Efficient lookup of events through linked identity events


Contract Events are a useful feature for storing data from smart contracts exclusively for off-chain use.  Unfortunately current ethereum implementations provide a very inefficient lookup mechanism. By using linked events that always link to the previous block with a change for the identity, we can solve this problem with much improved performance. Each identity has its previously changed block stored in the changed mapping.


    

  1. 

    Lookup previousChange block for identity
    

    2. 

  2. 

    Lookup all events for given identity address using web3, but only for the previousChange block
    

    3. 

  3. 

    Do something with the event
    

    4. 

  4. 

    Find previousChange from the event  and repeat
    

    5. 



Example code:




Building a DID document for an identity


The primary owner key should be looked up using identityOwner(identity).  This should be the first of the publicKeys listed. Iterate through the DIDDelegateChanged events to build a list of additional keys and authentication sections as needed. The list of delegateTypes to include is still to be determined. Iterate through DIDAttributeChanged events for service entries, encryption public keys and other public names. The attribute names are still to be determined.


Rationale


For on-chain interactions Ethereum has a built in account abstraction that can be used regardless of whether the account is a smart contract or a key pair. Any transaction has a msg.sender as the verified send of the transaction.


Since each Ethereum transaction has to be funded, there is a growing trend of on-chain transactions that are authenticated via an externally created signature and not by the actual transaction originator. This allows 3rd party funding services or receiver pays without any fundamental changes to the underlying Ethereum architecture. These kinds of transactions have to be signed by an actual key pair and thus can not be used to represent smart contract based Ethereum accounts.


We propose a way of a Smart Contract or regular key pair delegating signing for various purposes to externally managed key pairs. This allows a smart contract to be represented both on-chain as well as off-chain or in payment channels through temporary or permanent delegates.


Backwards Compatibility


All ethereum accounts are valid identities (and DID compatible) using this standard. This means that any wallet provider that uses key pair accounts already supports the bare minimum of this standard, and can implement delegate and attribute functionality by simply using the ethr-did referenced below. As the DID Auth standard solidifies it also means that all of these wallets will be compatible with the DID decentralized login system.


Implementation


ethr-did-registry (EthereumDIDRegistry contract implementation)


ethr-did-resolver (DID compatible resolver)


ethr-did (javascript library for using the identity)


Deployment


The address for the EthereumDIDRegistry is 0xdca7ef03e98e0dc2b855be647c39abe984fcf21b on Mainnet, Ropsten, Rinkeby and Kovan.


Copyright


Copyright and related rights waived via CC0.