Verifiable Credentials Overview (W3C Editor’s Draft, May 2025)

Summary of Verifiable Credentials Overview (W3C Editor’s Draft, May 2025)

Introduction

This document provides a non-normative overview of Verifiable Credentials (VCs)—cryptographically secure, privacy-respecting digital credentials (e.g., diplomas, licenses). It is an Editor’s Draft (not W3C-endorsed) and subject to change. The summary covers core specifications, roles, concepts, and standards progress, emphasizing modularity, privacy, and interoperability.

Main Sections

Section 1: Core Concepts and Specifications

• Purpose: VCs enable secure digital assertions with cryptographic proofs.
• Core Specs:
  • VC Data Model v2.0: Abstract model with JSON serialization.
  • Security: Supports enveloping (e.g., VC-JOSE-COSE) or embedded proofs (e.g., EdDSA via VC-DATA-INTEGRITY).
  • Bitstring Status List: Tracks credential status (e.g., revocation).
  • Controlled Identifiers: Reusable terms (e.g., DIDs).
• Roles: Issuer (creates), Holder (possesses), Verifier (validates).
• Concepts: Claims (subject assertions), VCs/Presentations (secured data subsets).

Section 2: Data Model and Security

• Claims & Credentials:
  • Claims form a graph, grouped into credentials with metadata (issuer, validity).
  • Verifiable Credentials add cryptographic proof for authenticity.
• Verifiable Presentations (VPs): Enable selective disclosure (e.g., professional vs. personal personas).
• JSON-LD Serialization: Standard format supporting custom vocabularies.
• Validation & Workflow: JSON Schemas ensure structural consistency; examples illustrate VC → VP flow.

Section 3: Cryptographic Proofs and Verification

• Enveloping Proofs:
  • JOSE: Encodes/signs credentials as JWTs.
  • COSE: Uses CBOR for compact size (ideal for QR codes).
  • SD-JWT: Enables selective disclosure.
• Embedded Proofs: Generated via canonicalization, hashing, and signing.
• Cryptosuites:
  • EdDSA/ECDSA/BBS: Differ in canonicalization and disclosure features.
  • Supports selective disclosure via reveal documents.

Section 4: Revocation and Status Management

• Bitstring Status List: Compresses revocation statuses (e.g., 131K entries into ~16 KB via GZIP).
• Example Implementation: Credentials reference status lists for efficient revocation checks.

Section 5: Example Verifiable Credential

• Structure: Includes metadata (issuer DID, issuance date), subject data (e.g., alumni status), schema validation, and revocation checks.
• Cryptography: Supports multiple proof formats (e.g., COSE, JWT, data integrity proofs).
• Purpose: Demonstrates interoperability, privacy, and compliance with W3C standards.

Section 6: Lifecycle and Scope

• Roles & Workflow: Issuance → Presentation → Verification → Validation → Application.
• Holder Considerations: Examines subject-holder relationships and usage restrictions.
• Limitations: No defined transfer protocols; verifiers apply custom business logic.

Conclusion

Verifiable Credentials offer a robust framework for secure, privacy-preserving digital attestations. Key features include modularity, selective disclosure, and scalable revocation. While core specs are W3C Recommendations, some components (e.g., BBS cryptosuites) await finalization. The document underscores the importance of standardized vocabularies, cryptographic flexibility, and real-world applicability, as illustrated in the example credential. Further guidance is available in referenced implementation documents and use cases.