🔐 Chapter 4: Self-Sovereign Identity (SSI)

4.1 The Self-Sovereign Identity Model

Self-Sovereign Identity represents a paradigm shift in digital identity. Instead of identity being granted by central authorities (governments, corporations, platforms), SSI returns ownership and control to individuals. You become the sovereign over your own identity data.

4.1.1 Core Principles Revisited

• User Control: You decide what credentials to accept, where to store them, and who to share with
• Portability: Your identity works across any platform, service, or jurisdiction
• Persistence: Your identity lasts as long as you need it
• Transparency: You can audit exactly who has accessed your data and when
• Consent: Nothing happens with your data without explicit permission

4.2 SSI Architecture

A complete SSI system consists of several interconnected components:

4.2.1 Digital Wallets

Your SSI wallet is like a physical wallet, but for digital credentials. It stores your DIDs, private keys, verifiable credentials, and manages presentations to verifiers.

Mobile Wallets: iOS/Android apps (most common). Always with you, use device security features

Web Wallets: Browser-based, accessible from any device

Hardware Wallets: Dedicated devices for maximum security (like crypto hardware wallets)

Cloud Wallets: Hosted by providers with encrypted backup

4.2.2 Agents

Agents are software that acts on your behalf to manage identity operations:

• Receive credential offers from issuers
• Respond to presentation requests from verifiers
• Manage DID operations (creation, updates, revocation)
• Handle encrypted messaging and secure communication

4.2.3 Trust Framework

SSI doesn't eliminate trust—it makes it explicit and transparent. Trust frameworks define:

• Who can be a trusted issuer (governance)
• What credential schemas are accepted
• Technical requirements and standards
• Liability and dispute resolution

4.3 The DIDComm Protocol

DIDComm enables secure, private communication between DIDs. It's like encrypted email, but using DIDs instead of email addresses:

{
  "type": "https://didcomm.org/credentials/1.0/offer",
  "id": "12345",
  "from": "did:example:university",
  "to": ["did:example:alice"],
  "body": {
    "credential_type": "UniversityDegree",
    "comment": "Your degree is ready!"
  }
}

4.3.1 DIDComm Features

• End-to-end encryption
• Perfect forward secrecy
• Works offline (messages queued until online)
• Multi-transport (HTTP, Bluetooth, NFC, email)
• Supports attachments (credentials, presentations)

4.4 Credential Exchange Protocols

Standard protocols govern how credentials are issued and presented:

4.4.1 Issuance Flow

1. Offer: Issuer sends credential offer to holder
2. Request: Holder requests the credential
3. Issue: Issuer creates and signs credential
4. Store: Holder receives and stores in wallet

4.4.2 Presentation Flow

1. Request: Verifier sends presentation request
2. Select: Holder chooses which credentials to share
3. Present: Holder creates and signs presentation
4. Verify: Verifier validates presentation and credentials

4.5 Governance and Trust Registries

While SSI is decentralized, some coordination is needed. Trust registries list authorized issuers for specific credential types:

• List of accredited universities (for degree credentials)
• Licensed medical practitioners (for health credentials)
• Authorized government agencies (for official documents)

4.6 User Experience in SSI

Good SSI systems make complex cryptography invisible to users:

4.6.1 Onboarding

• Install wallet app
• Create backup (seed phrase)
• Optionally create biometric authentication
• Start receiving credentials

4.6.2 Daily Use

• Scan QR code to receive credential
• Tap notification to approve sharing
• View credential history and audit logs
• Manage credential lifecycle

4.7 Enterprise SSI Deployment

Organizations implementing SSI need:

• Issuer Infrastructure: Systems to issue credentials at scale
• Verifier Integration: Add VC verification to existing systems
• Governance Framework: Policies for credential types and usage
• Training: Staff education on SSI concepts