Building Trust in a Digital World: Verified Credentials Demystified

Alyssa Karchmer

6 min read

·

Oct 16, 2023

--

Listen

Share

Press enter or click to view image in full size

In the summer of 2020, I watched retail investors and crypto whales dive wholeheartedly into DeFi while traditional financial institutions essentially sat on the sidelines. These venerable, profit-making machines simply watched as returns skyrocketed to outlandish numbers, with some rates on altcoins hitting ridiculous highs. I mean, 52,000% APY type of ridiculous.

Why were these behemoths sidelined while the retail kids had all the fun? Yes, the space is novel, risky, and prices are volatile, but volatility can be modeled, and strict controls can be put in place to mitigate risk.

One major reason is the identity problem: regulated entities can’t do business with entities or individuals they don’t know — mandated by law and therefore(rightfully) anxious compliance departments. Traditional financial organizations require robust identity verification processes to comply with Know-Your-Customer (KYC) and Anti-Money Laundering (AML) regulations.

This makes working with tokenized assets on public blockchains problematic, particularly when firms try to engage with permissionless DeFi applications. This gets even trickier given that most wallets that participate in DeFi liquidity pools belong to anonymous/pseudonymous owners.

One way to inject trust into this anonymous, permissionless DeFi landscape is by leveraging cryptographically provable identity mapped to claims that can be independently verified. This mechanism enables firms to verifiably track the origin of claims made about a subject and decide whether those claims can be trusted. For example, when I present my passport to airport security, they’ll let me through because they 1) trust the passport came from the government and 2) trust the government. If I showed up with nothing but a promise that I am who I say I am, I’d probably miss my flight.

There are other ways that the “identity problem” is trying to be solved across DeFi (e.g., allowlisting, blocklisting), but many of these solutions don’t scale.

By leveraging digital identity and verifiable claims, firms can create a secure framework that fosters confidence for regulated entities to engage with transactions on public blockchains, and potentially even DeFi.

Introduction to Digital Identifiers (DIDs) and Verified Credentials (VCs)

“The World Wide Web Consortium (W3C) is an international organization that develops and maintains standards for the World Wide Web to ensure its interoperability and accessibility.” -ChatGPT

The W3C has outlined rules to create digital identity cryptographically tagged to provable claims under the Digital Identifiers and Verified Credentials standards.

Digital Identifiers (DIDs):

DIDs are globally unique digital identifiers — you can think of this like your digital name tag. DIDs can digitally represent people, entities, or even objects.

Digital identifiers are not a new concept, but what’s exciting about DIDs is that you can cryptographically prove ownership over them with digital signatures, enabling their integrity to persist without a centralized authority serving as a trusted intermediary.

Here’s an example of what a DID should look like:

Press enter or click to view image in full size

Remember, this unique number is just your digital name tag.

Verified Credentials (VCs):

DIDs enable us to establish ownership and trust around the creation of Verifiable Credentials.

VCs are attestations made by an issuer about a subject. That subject can then put that attestation in their wallet and show it to whoever they want. These credentials are typically issued to a DID, from a DID.

Below is an example of a claim that “Pat is an alumnus of Example University”.

Press enter or click to view image in full size

For those that are newer to digital identity or want a better explanation, the Disco documentation does a great job.

Putting DIDs and VCs together

Now, let’s put DIDs and VCs together to enable self-owned, cryptographically secure identities and facilitate the sharing of trustworthy claims about those identities (e.g., “Alyssa is over 21 years old”). This empowers individuals to privately control their digital identities while providing institutions with accurate, reliable, and tamper-evident attestations from trusted issuing parties.

Example: DIDs and VCs in Practice:

For further understanding, here’s a real-life simple example of how these concepts all come together:

You and your friend walk into a bar. (Yes, really)

The bouncer at the door stops your friend and asks to see some ID to prove they are 21+. Your friend takes out their driver’s license and hands it over to the bouncer, who looks through their name, address, height, eye color, etc. until they finally see the birthdate. Then, the bouncer does some quick math to ascertain your friend is over 21 years old.

You, however, carry in your wallet a VC that contains an attestation from the government with your birth date and a proof that you are over 21 years old. Instead of talking to the bouncer, you scan a QR code on the wall, share the credential, and the door automatically opens for you.

But how does the bar know it can trust the credential? Upon issuance of a VC, the issuer “stamps” the credential with their unique DID by signing it with their private key. Then, when you accept the credential, you sign it with your private key as well. This enables a verifiable presentation of that credential where the bar can decrypt the credential to view the attestation inside.

Now, the bar can be certain that 1) the U.S. government made this attestation, and 2) the credential has not been tampered with.

How can this apply to my business?

Organizations can make claims by issuing VCs in the same way that the U.S. government issued the claim that you meet the age requirements to enter a bar. This might be an identity proof saying you are who you say you are, a proof that you have fulfilled KYC requirements in the last 30 days, or even a dynamic proof confirming you are not on the OFAC sanctions list.

As this ecosystem flourishes, regulated entities can leverage this technology across firms to create circles of trust upheld by verifiable cryptographic proofs.

By leveraging verified credentials to create trust, traditional financial organizations can:

1. Expand customer base across different personas, including Web3 native individuals
2. Create revenue-generating products on public blockchains and expand product/service offerings across these new customers (e.g., tokenized product offerings)
3. Leverage blockchains as infrastructure to engage with robust DeFi ecosystems, while maintaining regulatory compliance (e.g., participate in or offer liquidity pools, engage in DeFi strategies)

Meanwhile, Web3 native organizations can:

1. Become regulated entities with robust risk management and compliance policies
2. Enable interaction with regulated entities (and their customers), spurring an influx of traditional capital to decentralized financial products
3. Facilitate mainstream adoption of Web3

There is dire need to create business standards around KYC, AML, and other intensive identity verification processes to enable a rich ecosystem where traditional capital can leverage decentralized rails and maximize capital efficiency.

Stay tuned for my next article explaining the building blocks firms can use to get started leveraging DIDs and VCs.

The views reflected in this article are those of the authors and do not necessarily reflect the views of Ernst & Young LLP or other members of the global EY organization.