Next Generation SSI Standards

---

Impacts :

Impact 1: Enhanced EU – US cooperation in Next Generation Internet, including policy cooperation.
We have identified the OpenID Foundation and the W3C as areas for enhanced EU-US cooperation, and Spruce and Crossword are working together to input changes to the draft standards for the W3C Verifiable Credentials Data Model v2 and the OIDC4VCs protocol suite, in order to ensure their practical implementability and use.

Increasing trustworthiness is a vitally important aspect of EU-US cooperation. We have identified the OIDF Global Assured Identity Network (GAIN) Proof of Concept project as another area for enhanced cooperation. GAIN wants to establish a global trust infrastructure for identity management. Fraunhofer has presented TRAIN to the group, describing how TRAIN operates as a trust infrastructure, so that it can eventually be integrated into the GAIN PoC. Crossword is attending the weekly meetings and has produced an outline design document that describes how the TRAIN trust infrastructure can be integrated into the GAIN technical solution. Crossword is feeding the results back into the GAIN project.

Impact 2: Reinforced collaboration and increased synergies between the Next Generation Internet and the US Internet programmes.
Spruce did not apply for an NSF grant and therefore did not receive any NSF funding. Consequently we are not familiar with the US NSF Internet program. However, we are familiar with the US Silicon Valley Innovation Program (SVIP) which is funding a number of W3C Verifiable Credentials related projects. These funded organisations are invariably participating in the W3C VC WG, and we are collaborating with them. Indeed, the W3C Postman tests that we are using have come from the SVIP funded supply chain project being run by Transmute. We fully expect the results of our project to be fed back into the SVIP.

Impact 3: Developing interoperable solutions and joint demonstrators, contributions to standards.
The project is having a large impact on developing interoperable solutions and contributing to standards. We believe that we are making a significant contribution to the OpenID4VCs protocol suite. Results below details the 17 contributions that we have made to OIDC during the project. The experiments will increase the precision of the standards by removing any ambiguities that currently exist. One example in the W3C VCDMv1.1 is whether the VC properties that are converted into JWT claims should be replaced or duplicated. Both have been implemented. A new draft standard has been created, specifically describing how JWT credentials are to be produced and the project partners are collaborating in the writing of this new standard. Organisations that are cooperating in this new standard include: Crossword, Spruce, Microsoft, Transmute and Mesur.io.

We know that our OpenID4VC profiles that we developed for our NGI interworking tests are having a significant impact elsewhere as within one week of publication, 6 JFF participants expressed an interest in joining us in the interworking tests, and in the end, by 14 November, 11 other organisations had joined us and successfully performed credential issuing tests.

In a Pilot for the UNDP GCCN, interworking experiments within Europe on the basis of TRAIN are being performed (United Nations Development Programme Contract HHD/UNPD1/0000043524.). TRAIN is also currently being evaluated for inclusion into the GAIA-X Federation Services specification, and also for the German Showcase Secure Digital Identities Project ONCE.

Impact 4: An EU - US ecosystem of top researchers, hi-tech start-ups / SMEs and Internet-related communities collaborating on the evolution of the Internet

The project is contributing to an EU-US ecosystem of top researchers who are focussed on SSI/Verifiable Credential solutions. The project partners have reached out to the lead developers of the W3C VC API test suite and OIDC conformance testing infrastructure, and they are now cooperating with us in extending the scope of these testing systems. We are involving more SMEs and high tech companies as the test suites are developed. We have already made our profiles available to the 30 organisations involved in the JFF Plugfest and 11 of them have already joined us and participated in successful interworking tests. The partners have increased their own collaboration as a result of this project both at a practical level, by providing each partner with more intimate knowledge of the other’s products, and
how fine nuances in the interpretation of the standards may adversely affect interworking, and at the strategic level, by proving to prospective customers that not only do their products interwork in theory by conforming to the standards, but also in practice due to these experiments. This will help each partner when talking to their prospective customers, by highlighting the international applicability of their products, and allowing each company to reference the other collaborating partner in sales meetings. This project should increase the market reach of the participants in their respective regions.

Spruce is an open source software company with the mission of empowering users to control their identity and data across all digital interactions. The maturation of the Spruce libraries developed for this project and the opportunities for interoperability among partners are already bearing fruit. In particular, the Credible wallet is now positioned to become a central product in the Spruce offering. Because of the successful outcome of this project, Spruce is planning to continue the work on the developed NGI issuer and verification services. The project has increased cohesion across collaborations by defining how digital credentials are handled using open standards with the user in control.

Results :

The experiment provided 21 results (see deliverable for details).   However, areas in which we exceeded KPI expectations are:

1. We created a web site (ngiatlantic.info) where we published our OpenID4VCs profiles and preliminary results, along with the endpoints of our prototype implementations for others to test against.

2. Our issuing profile of OpenID4VCI was adopted by participants in the JFF Plugfest, and nearly half of the participants added their endpoints to our table so that much wider interoperability testing could take place.

3. Consequently we performed a large number of issuing interworking tests with participants in the JFF Plugfest, and demonstrated 19 interworking exchanges between products independently developed by 6 organisations, as the table below shows.

   Group 1 JWT	Issuer ⇒	Spruce	Crossword	walt.id	Danube Tech	Velocity Network	Greenlight
   Wallet ⇓	Spruce		done	done	Done
   	Crossword	done		done	TBD
   	IQ4	done	done	TBD	TBD	Done	Done
   	Sphereon	Done	Done	Done	Done	Done	Done
   	ValidatedID	done	TBD	done	done	done	TBD

    

4. Other participants in the JFF plugfest took our issuing profile, and with only minor adjustments to it (they changed JWT proofs to JSON-LD proofs, along with the corresponding cryptographic algorithms) performed an additional set of 25 interworking exchanges between products independently developed by 7 organisations as the table below shows.

   Group 2 LDP	Issuer ⇒	Spruce	Mattr	Diwala	Entrustient	walt.id	Danube Tech
   Wallet ⇓	Spruce		done	TBD	Done	Done	Done
   	Mattr	Done*		Done	Done	Done*	Done
   	Diwala	Done	Done		Done	Done	Done
   	Entrustient	Done	Done	Done		Done	Done
   	Sphereon	Done	Done	Done	Done	Done	Done

   * Signature used is incompatible (but is not validated by the wallet)

5. We have written an initial design for how the TRAIN trust infrastructure can be integrated into the OpenID GAIN project (https://openid.net/gainpoc/).

6. We participated in the weekly W3C VC Edu and CCG meetings, and publicised our project’s ongoing results there. As a result our OpenID4VCI profile was adopted by the JFF Plugfest, whose members mostly attend the W3C VC Edu meetings.

The results of the JFF plugfest validate our hypothesis c), because the JFF participants were free to choose their own issuing protocol from three candidates that were available: OpenID4VCI, VC-API and DIDComm. Very few participants chose DIDComm and none of them that did were able to pass the plugfest due to the immaturity of the protocol and the number of technical issues that they had to solve before they could demonstrate interoperability. Just under half of the participants chose OpenIDVCI and just over half chose the VC-API. However the results of the plugfest showed that there were more independent implementations of OpenIDVCI than the VC-API, as the majority of the latter only implemented the digital signing functionality of credential issuing, rather than the full functionality, as they used a common broker to communicate with the wallet.

Our tests with ETSI trust lists, as implemented by the TRAIN infrastructure, indicated that this trust infrastructure is scalable to the proportions needed by SSI. We built two trust lists, one for the US and one for Europe and demonstrated interoperability between them. The OpenID GAIN project is now attempting to connect different trust infrastructures together, using the OIDC Federation protocol as the common management protocol. None of these trust infrastructures are believed to be blockchain based to the best of our knowledge. We have performed some initial design work to show how TRAIN can be integrated into GAIN, but due to lack of time and resources have not been able to validate this yet. This will be a valuable follow on project, which we will submit to NGI Assure.

Future Plan :

This has been a really valuable project to both the participants and the global SSI community. For the participants, it allowed Spruce and Crossword to develop prototype implementations of the draft OpenID4VCs suite of protocols, and to show that their independently developed implementations were capable of interworking together. For Fraunhofer it allowed it to add trust in verifiers to its existing TRAIN infrastructure, and to have two independent implementations (from Spruce and Crossword) show how TRAIN can be integrated into VC eco-systems in order to easily decide whether issuers and verifiers are trustworthy or not.

For the global SSI community the benefits of the project have been enormous. First, the participants have identified numerous omissions and errors in the OpenID4VCs protocol suite and have proposed text to rectify these that will benefit everyone. Secondly, the profile of OpenID4VCI that the participants produced was used very effectively by the global community participating in the JFF Plugfest. They used this profile to build their VC Issuers and wallets that could seamlessly interwork with similar products from other JFF participants. We plan to continue working with the JFF community by providing them with our profile for OpenID4VPs, in the anticipation that they will use this in a similar way to our issuing profile, thereby facilitating the verification of VCs and VPs between wallets and verifiers.

We plan to continue working with the W3C VC and OIDF OpenID4VCs working groups over the next couple of years in order to help them shape the final versions of these standards for the global SSI community.

Future R&D that is planned by the partners includes:

• adding trust in wallet software providers to the TRAIN infrastructure,

• integrating TRAIN with the OIDF’s GAIN proof of concept project,

• completing the design of sending encrypted VCs between wallets and verifiers and implementing this in our prototype products.

Future product developments that are planned by the partners includes:

• Crossword plans to make Identiproof interoperable with other solutions by implementing multiple protocols. This includes the compliance with the OIDC protocols and the TRAIN network, which were prototyped and tested in this project.

• Spruce plans to continue to build the Credible wallet and a suite of supporting open source software products for use cases across public sector, institutional, and web3.

• Fraunhofer plans to continue to build the TRAIN infrastructure enabling support for user friendly CRUD operations on the Trust List. And also plans to contribute to the Gaia-X Federation Systems (GXFS) and Gaia-x Trust model specification which will be later adapted by different federations and dataspaces in EU. Moreover Fraunhofer aims to integrate the developed solutions into the German Showcase Project ONCE.

NGI related Topic :

Strengthening Trustworthiness and Resilience Of the Internet

Call Reference :

5