Re: Funded Deployments of Verifiable Credentials - framework for meta-credentials

How do you authorise a verifier?

Surely the whole point of a VC is that the holder owns the data and is free to choose who to present it it to.  So the act of presentation is the authority to verify.  

Who controls who can verify in this eIDAS requirement? Even if there was a use case where verification is authorised by some party, how would it be enforced?  If an issuer gives me a credential then I can present it to anyone I choose.  If there’s information I don’t want to disclose then I redact it.  All this is beyond the control of the issuer 

Steven Capell
Mob: 0410 437854

> On 5 Sep 2022, at 8:05 pm, Deventer, M.O. (Oskar) van <oskar.vandeventer@tno.nl> wrote:
> 
> 
> Hi Manu, all,
>  
> Is there already ongoing work on “meta-credentials”, or should there be in W3C-CCG?
>  
> Verifiable credentials are always associated with some assurances.
> The issuer is trusted to issue this type of credential (https://github.com/hyperledger/aries-rfcs/tree/main/concepts/0289-toip-stack#discovery-and-verification-of-authoritative-issuers)
> The verifier is authorized to verify this type of credential (https://github.com/hyperledger/aries-rfcs/tree/main/concepts/0289-toip-stack#discovery-and-verification-of-authoritative-verifiers)
> The former is the regular decision of a verifier to trust an issuer. The latter relates e.g. to the European eIDAS requirement that a verifier needs to be authorized to verify certain sensitive government-issued credentials.
>  
> Internet-reachable trust lists are the default solution to check whether an issuer or verifier is accredited to issue/verifier a certain type of credential, for example the EBSI Trusted Issuers Registry or other (Fraunhofer-TRAIN). However, internet-reachable trust lists have some major disadvantages.
> They don’t work in offline scenarios
> The “phone-home” interaction leaks information (=privacy)
>  
> An obvious alternative is meta-credentials, i.e. credentials about being authorized to issue/verify a certain type of credential. This alternative had already been highlighted in the aforementioned TOIP RFC 0289. There are many credential types, and potentially equally many of these meta-credentials. Nevertheless, it may be useful to develop a framework that enables automated verification of meta-credentials. At least it should be automatically verifiable whether a presented meta-credential is applicable to the type of credential that is requested or presented. Perhaps W3C could develop a generic solution for this?
>  
> Any thoughts?
>  
> Best regards,
>  
> Oskar
>  
>  
> -----Original Message-----
> From: Manu Sporny <msporny@digitalbazaar.com> 
> Sent: zaterdag 27 augustus 2022 20:48
> To: W3C Credentials CG <public-credentials@w3.org>
> Subject: Funded Deployments of Verifiable Credentials
>  
> Hi everyone (VCWG BCC'd),
>  
> I've been asked to do a presentation around funded deployments of Verifiable Credentials at multiple upcoming conferences (W3C TPAC, RWoT, etc.) and don't feel like I have a firm grasp of every publicly funded Verifiable Credential deployment happening around the world.
>  
> If you are funded to pilot or productionize a system that uses DIDs or Verifiable Credentials, and you are comfortable with talking about the program publicly, please add details to this slide deck:
>  
> https://docs.google.com/presentation/d/1JjfDbeXfE7aO7uYDNqNQ8ixVr9tXUQL7mhwudwxZN38/edit
>  
> I know I'm missing publicly announced projects from MATTR, Mesur.io, Mavennet, Transmute, and possibly Avast, ESSIF, the German government, and others. If you know of someone that's not on these lists, but is deploying VCs and DIDs, please send this request to them.
>  
> The first presentation is in two weeks, so please add your projects into the deck before then.
>  
> -- manu
>  
> --
> Manu Sporny - https://www.linkedin.com/in/manusporny/
> Founder/CEO - Digital Bazaar, Inc.
> News: Digital Bazaar Announces New Case Studies (2021) https://www.digitalbazaar.com/
>  
>  
> This message may contain information that is not intended for you. If you are not the addressee or if this message was sent to you by mistake, you are requested to inform the sender and delete the message. TNO accepts no liability for the content of this e-mail, for the manner in which you use it and for damage of any kind resulting from the risks inherent to the electronic transmission of messages.
>