📜 Chapter 3: Verifiable Credentials

3.1 What Are Verifiable Credentials?

Imagine your entire life's credentials—university degree, driver's license, professional certifications, employment history, even proof you're over 18—all digital, instantly shareable, cryptographically verifiable, and under your complete control. This is the promise of Verifiable Credentials.

A Verifiable Credential (VC) is a tamper-evident credential with authorship that can be cryptographically verified. Unlike traditional credentials (physical diplomas, plastic ID cards, paper certificates), VCs combine the trust of traditional credentials with the efficiency and verifiability of digital signatures.

3.2 The Three Roles in Verifiable Credentials

Every VC interaction involves three parties:

• Issuer: Creates and cryptographically signs the credential (university, government, employer)
• Holder: Receives and stores the credential (you, in your digital wallet)
• Verifier: Checks the credential's authenticity and validity (employer, website, government agency)

3.3 Anatomy of a Verifiable Credential

A VC is a JSON or JSON-LD document with specific properties defined by the W3C Verifiable Credentials Data Model:

{
  "@context": [
    "https://www.w3.org/2018/credentials/v1",
    "https://www.w3.org/2018/credentials/examples/v1"
  ],
  "id": "http://example.edu/credentials/3732",
  "type": ["VerifiableCredential", "UniversityDegreeCredential"],
  "issuer": "did:example:university123",
  "issuanceDate": "2023-05-15T00:00:00Z",
  "expirationDate": "2028-05-14T23:59:59Z",
  "credentialSubject": {
    "id": "did:example:alice456",
    "degree": {
      "type": "BachelorDegree",
      "name": "Bachelor of Science in Computer Science",
      "college": "College of Engineering"
    },
    "gpa": 3.85,
    "graduationDate": "2023-05-15"
  },
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2023-05-15T12:00:00Z",
    "verificationMethod": "did:example:university123#key-1",
    "proofPurpose": "assertionMethod",
    "proofValue": "z3FXQjecWh...long_signature_value...gZpfkcJCwDw"
  }
}

3.3.1 Core Properties

• @context: JSON-LD context defining vocabularies and terms
• id: Unique identifier for this specific credential instance
• type: Array of credential types (always includes VerifiableCredential)
• issuer: DID of the entity that issued the credential
• issuanceDate: When the credential was issued
• expirationDate: (Optional) When the credential expires
• credentialSubject: The claims being made (the actual credential data)
• proof: Cryptographic proof of authenticity

3.4 Credential Schemas and Types

VCs can represent any type of credential. Common schemas include:

3.5 Cryptographic Proofs

The proof object contains the cryptographic signature that makes the credential verifiable:

3.5.1 Proof Types

• Ed25519Signature2020: Most common, fast and secure
• EcdsaSecp256k1Signature2019: Compatible with Ethereum/Bitcoin
• RsaSignature2018: Traditional RSA signatures
• BbsBlsSignature2020: Enables selective disclosure (reveal only some claims)
• JsonWebSignature2020: Uses JWT/JWS standards

3.5.2 Verification Process

When a verifier receives a VC, they:

1. Resolve the issuer's DID to get their public key
2. Verify the signature matches the credential data
3. Check the credential hasn't expired
4. Verify the credential hasn't been revoked
5. Validate the credential structure and required fields

3.6 Verifiable Presentations

A Verifiable Presentation (VP) is how holders share one or more VCs with verifiers. It's essentially a wrapper around credentials that adds holder authentication:

{
  "@context": ["https://www.w3.org/2018/credentials/v1"],
  "type": "VerifiablePresentation",
  "verifiableCredential": [
    {...university_degree_credential...},
    {...employment_credential...}
  ],
  "proof": {
    "type": "Ed25519Signature2020",
    "created": "2024-12-25T10:30:00Z",
    "verificationMethod": "did:example:alice456#key-1",
    "proofPurpose": "authentication",
    "challenge": "random_nonce_from_verifier",
    "proofValue": "z58DAdFfa9Sk...alice_signature...2sDe2"
  }
}

The VP includes a challenge (nonce) from the verifier to prevent replay attacks. Alice signs the entire presentation, proving she controls the DIDs in the credentials and consents to sharing them.

3.7 Selective Disclosure

One of VCs' most powerful features is selective disclosure—revealing only specific claims while hiding others. Instead of showing your entire driver's license to prove you're over 21, you can share just the age verification claim.

3.7.1 BBS+ Signatures

BBS+ signatures enable cryptographic selective disclosure. The issuer signs the credential with BBS+, allowing the holder to derive proofs of specific claims without revealing others:

• Prove age > 21 without revealing birthdate
• Prove degree in Computer Science without revealing GPA
• Prove employed without revealing salary

3.8 Credential Revocation

Sometimes credentials need to be revoked (employee fired, degree rescinded, license suspended). Several revocation mechanisms exist:

3.8.1 Revocation List

Issuer maintains a public list of revoked credential IDs. Verifiers check this list during validation.

3.8.2 Status List 2021

Efficient privacy-preserving method using bitstrings. Each credential has an index in a compressed bitstring. If the bit at that index is 1, credential is revoked.

3.8.3 Blockchain-Based

Record revocations on blockchain for tamper-proof, decentralized revocation registry.

3.9 Privacy Considerations

VCs must balance verifiability with privacy:

• Avoid correlation: Use different DIDs for different contexts
• Minimize disclosure: Share only necessary claims
• Zero-knowledge proofs: Prove properties without revealing data
• Holder binding: Ensure VCs can't be shared with others