Re: DID Web, OpenSSL and Certificate Authorities

Or, create did-x509 and keep both:
https://github.com/spruceid/ssi/issues/117

DIDs could help with lower setup/discovery costs when picking trust models
and common CAs.

REGARDS

On Thu, Feb 17, 2022 at 9:41 AM David Chadwick <
d.w.chadwick@verifiablecredentials.info> wrote:

> On 17/02/2022 14:33, Orie Steele wrote:
>
> Hey Folks,
>
> What is the best way to combine DIDs with Certificate Authorities?
>
> Get rid of DIDs and let the issuer use DV X.509 PKCs :-)
>
> Kind regards
>
> David
>
>
> The use case is simple: As a verifier, I want to know that a credential
> was issued from a public key that is in a certificate chain I trust.
>
> When I verify this credential, I not only check its signature, but I can
> also check the CA chain from the key that signed in back to the root.
>
> @Mike Prorock <mprorock@mesur.io> and I have been working on a
> simple example of this using DID Web, but I think it generalizes to any DID
> Method that supports `publicKeyJwk` and `x5c`.
>
> https://github.com/transmute-industries/openssl-did-web-tutorial
>
> In this example, we generate a root ca, an intermediate ca, and 3
> child ca's all using P-384 and OpenSSL.
>
> We then generate a DID Web DID Document from the public keys for the 3
> children, and encode the ca chain from them back to the root using `x5c`.
>
> We then issue a JWT from the private key for 1 of them.
>
> We then verify the JWT signature using the public key.
>
> We then check the x5c using open seel to confirm the certificate chain.
>
> My questions are:
>
> 1. Is it possible to use JOSE to automate this further?
> 2. Is there a better way of accomplishing this?
> 3. Should the CA chain be pushed into the JWT?
>
> Regards,
>
> OS
>
> --
> *ORIE STEELE*
> Chief Technical Officer
> www.transmute.industries
>
> <https://www.transmute.industries>
> ᐧ
>
>
>