Note 1: Inspiration for this blog post was taken from a conversation I had with Tim Bouma about the role of digital wallets

Note 2: I made some edits on 5/26 and removed mentions of voltage, as they were not suited for the analogy.

An Analogy for better understanding interoperability requirements for Issuers, Verifiers and Holder Wallets

As I prepare for an upcoming trip from Canada to Europe, I’m reminded of the different power standards between continents. As usual, I will be carrying my laptop and phone, with their chargers, along with an essential universal travel adapter to keep them powered up while I’m there.

This is how it will all work so that I can seamlessly use my devices while I’m abroad:

The European electrical socket, my source of power while abroad, varies in shape, and frequency compared to what I’m used to back home in Canada. It’s the origin of the electrical energy I need to charge my devices.

Various electrical sockets

My universal travel adapter is the unsung hero of my tech travel kit. It’s designed to connect with the European electrical socket, which differs from Canadian standards (European outlets often have two round pins, while Canadian plugs typically have two flat parallel pins with a grounding pin). 

But I don’t have to worry! My universal travel adapter will allow my devices to consume electricity from the power sockets.

Switching gears for a minute..

At Northern Block, we’ve been recently experimenting with various credential profiles and credential exchange protocols. We’ve come to understand that different use cases necessitate distinct standards and technological choices. This work has led us to think deeply about the interoperability between different parties involved in credential exchanges.

As a company, we have a strong background in the Hyperledger Aries and AnonCreds world, a topic on which we’ve shared some writings (here and here). We have also contributed towards multiple open source Aries RFCs. 

Recently, through collaboration with some partners of ours in the digital identity community, we’ve been broadening our scope of support. This includes exchanging various credential profiles by supporting new specifications like OpenID4VC, both for issuances and presentations. We are at varying stages in our implementations of both these protocols. Further in collaboration with our partner, Canadian Bank Note, we’ve been recently working on demonstrating interoperability between DIDComm-based RFCs and the Mobile Driver’s Licence standard. We’ve written about the motivation and reasoning behind our mDL interoperability work with them here.

Now..

Keeping all this in mind, let’s use the example of electrical sockets, my devices, and universal travel adapter as a comparison to understand how different parts interact in digital credential exchanges. This comparison also helps us understand what interoperability means for everyone involved.

Issuers

In this analogy, the European electrical socket is akin to an issuer of digital credentials. 

Issuers generate and provide signed data that they’re authorized to issue, which can come in various formats.

Issuers will issue credentials in their chosen format without being forced to adhere to a specific standard, similar to the electrical socket in a specific country, which provides power according to its local standards without needing to conform to the formats used elsewhere. One issuer may pick AnonCreds and another may pick JSON-LD to issue a similar credential.

Each issuer’s specific use case plays a significant role in the choice of technology. For instance, a transportation ministry issuing mobile driving licences would have different needs and considerations than an issuer of organizational-related claims. Each issuer’s primary intended use case shapes their unique needs (e.g., importance of authenticity, confidentiality, privacy, security) and requirements, and thus, they select the technology and format that best aligns with these needs. Similar to the way my electrical socket in Canada follows its own standard, issuers will issue credentials in their chosen format, based on their main use case, without being forced to conform to a uniform standard.

The issuer’s role is considered more streamlined because they can maintain a consistent issuance method and format that doesn’t need to adapt to the formats used by other issuers. This is much like how an electrical socket in a specific country, such as Canada, maintains its own consistent standard, without needing to adapt to the differing standards of sockets in other countries, like those in Europe.

Verifiers

Next, my devices – my laptop and phone – represent the verifier in the digital credentialing scenario. They need the credentials in a form that they can understand and accept, much like how they need power through a specific power adapter.

The verifier, based on its business and other requirements, decides what type credential format the holder needs to provide to them – they place restrictions. 

Restrictions are independent from how the issuer issued a credential. Similar to how devices like laptops or phones require specific types of electrical input from a power socket. The power source or the power socket doesn’t determine the power requirements of the device. Rather, the device itself dictates what kind of power it needs, independent of the supply available from the socket.

When the wallet can provide the credential that fits the verifier’s requirements, it’s like my devices perfectly fitting into an electrical socket with a universal adapter. Everything works seamlessly.

However, if the wallet can’t meet the restrictions, the verifier must decide if it should adjust its requirements. This is similar to the scenario where my phone or laptop plug doesn’t fit the socket. Here, I would need to adjust or use a different adapter.

When credential proofs are presented by the holder, the verifier checks if they conform to its restrictions. If not, they won’t work properly and could even get damaged. Similarly, a verifier ensures the presented credentials meet their criteria for a secure and valid transaction.

Holders/Wallets

If we assume issuers will typically pick one issuance method for their credentials, and verifiers may place restrictions for what they deem acceptable to be presented based on their context, then there needs to be something that facilitates this interoperability, or conversion.

The role of my universal travel adapter mirrors that of the digital identity wallet in this scenario. Just as the adapter transforms any incoming power into a form my devices can use, the digital wallet receives these varying credentials from the issuer, manages them, and converts into acceptable formats when requested, ensuring that none of the original credential’s attributes or values are lost in the conversion process.

The holder’s wallet has the most complex role in this ecosystem. It needs to be able to receive, store, and manage credentials from multiple issuers, each potentially using a different credential format, likened to the role of my universal travel adapter, converting ‘power’ from various formats into a form that the device can use.

This allows the holder to present these credentials to verifiers in a format they can understand and accept, much like how my universal travel adapter enables me to plug my Canadian devices into European sockets, converting the European power standards into a format my devices can safely use and accept. The adapter ensures compatibility between different power grids and devices without the user needing to know the specifics. This is similar to how a wallet operates.

The wallet is essential for maintaining the separation between the issuer and the verifier. It eliminates the need for coordination between every issuer and verifier, even if they use different technologies or standards. The issuer might use any format, and the verifier may require any format, but the wallet provides the interoperability that allows the verifier to distance itself from the issuer, thus preserving privacy.

If The Analogy Is True, Then What?

I do think the analogy of a universal plug adapter aptly depicts the role of the holder’s wallet in the exchange of digital credentials. Much like the adapter, which ensures compatibility between diverse power grids and devices, a wallet manages credentials of varying formats, serving as a vital bridge between the issuer and the verifier.

Just like a plug adapter’s role, the wallet allows for seamless interoperability, shielding the verifier from the specifics of the issuer’s credential format. This operational separation, facilitated by wallets, grants scalability to the system, removing the need for direct coordination between all issuers and verifiers, regardless of the technologies or standards they employ.

However, such conversion isn’t a straightforward process..

Research is required to understand and safeguard the credential’s attributes and values during the transformation. For example, if a credential loses its privacy-preserving features during conversion, we need to clearly communicate this potential loss to the user.

Moreover, the complexity of transformation depends on the credential format. Some formats, like AnonCreds, Selective Disclosure JSON Web Tokens (SD-JWT), and MSO (ISO/IEC 18013-5), offer more enriched data structures than others such as JSON-LD.

For instance, AnonCreds and SD-JWT are rich formats where every element can be individually signed, facilitating selective disclosures. However, this feature also makes them heavier to process. In contrast, converting a rich format into a simpler one like JSON-LD doesn’t pose an issue, as there’s no loss of information. But a reverse conversion is more difficult because not every claim is signed by the issuer in JSON-LD format.

I hope this further underscores the need for in-depth research to understand the dynamics of different credential formats and to develop robust interoperability frameworks.

While we allow the standards to evolve naturally, we must focus on ensuring these frameworks can accommodate and seamlessly convert between all these formats without compromising the credential’s integrity or the issuer’s integrity.

Interoperability is the key here, and that’s where the research should be directed. We should let the standards evolve as they are, but there must be an effort to develop interoperability frameworks.

We can take inspiration from the hardware industry, where plug and play really works. We need to make our systems truly interoperable, just like hardware devices.

Proposed Call to Actions

1. Advance Interoperability Research: Interoperability, or the ability of different systems or components to work together, is a key concern in the realm of digital credentials. Currently, there are multiple protocols and formats, such as DIDComm, OpenID4VC protocols, and MDL formats. The need for research in this area is to understand how these different formats can interact and be converted without loss of integrity, information or functionality. This would allow for smoother interactions between holders and verifiers, regardless of their chosen credential format.
2. Improve Wallet Versatility: Digital wallets play a crucial role as they need to support and manage credentials in multiple formats. Just as a universal travel adapter can accept plugs from different countries and convert the power into a usable form, the digital wallet needs to be versatile enough to accept, convert, and manage various credential formats. This is a challenging aspect that requires ongoing research and development.
3. Analyze Credential Format Conversion: As different credential formats might prioritize different aspects (e.g., privacy, security, usability), it’s essential to understand what might be lost or gained during the conversion process. This involves deep technical analysis and understanding of the different credential protocols.