The value of DIDs

[samuelmr]

In the Feb 11 call, there was a discussion on whether we should choose between DIDs and X.509-based identification methods (for issuers and verifiers.

Why use DIDS

• The DIIP profile has its roots in DIDs.
• There is sympathy towards DIDs in the DIIP community.
• DIDs enable DIDComm, so they serve a clear benefit in messaging-based use cases
  • maybe not the main case for DIIP but could be a DIIP extension...
• The Swiss profile uses did:webvh.
• DIDs are a modern identification method created for a purpose. If X.509 was perfect, there would be no need for DIDs.
• While it's easy to get SSL certificates for your website or self-issue X.509 certificates, it might not be straightforward to set up a new domain-specific ecosystem where trusted authorities would be certificate issuers (CAs).
• Many issuer/verifier solutions take care of the complexity of DID document management etc. making it easy for companies to adopt DIDs

Why not use DIDs

• Managing DIDs (creating and publishing DID documents, rotating keys, etc.) is difficult
• Many issuer/verifier solutions take care of the complexity of DID document management etc. making it easy for companies to adopt DIDs – thus the companies are not really managing their identities but offloading that to their software provider
  • This is more of a problem in cases where the software is used as a service from the provider's cloud
• The European qualified trust service providers know the traditional PKI world well

Please add your pros and cons to this discussion.

[k00ij]

One important feature that seems to be missing in this overview if the capability of DID (DID documents) to include service end points and LinkedVP's. This means for instance that organizations can use their public DID to publish certifications/accreditations/identifiers/memberships issued to them by trusted 3rd parties as LinkedVPs' in their DID doc (ISO certificates, sustainability credentials, VAT numbers, business registration, GS1 GTN, LEI etc etc). The DID doc can also links to all kinds of self issued credentials/data (company profile, website, products etc etc) or service end points like datahub, supported einvoicing methods/endpoints, oid4vci issuing urls etc etc