Skip to main content

The NGIAtlantic.eu project has ended in February 2023. For the follow-up initiative, visit NGI Transoceanic.

Crossword cybersecurity

Project Coordinator (EU) :

Crossword Cybersecurity

Country of the EU Coordinator :

UK

Organisation Type :

Research

Project participants :

Crossword Cybersecurity:

David Chadwick is the R&D Director for Identiproof, and is the project manager of this project. David will lead the architecture design for Idenifproof and contribute to the VC and protocol profiles and overall system architecture.

Ioram Sette is the product manager for Identiproof at Crossword Cybersecurity in the UK and a Lecturer at CESAR School University in Brazil. He leads the implementation team.

Dariusz Żbik is a so ware architect working for Crossword Cybersecurity since 2017. His past experience includes work with blockchain technologies and SSO servers with OAuth2/SAML functionalities.

Andrzej Boruch is a senior so ware developer working for Crossword Cybersecurity since May 2018. His past experience includes work with blockchain technologies.

Grzegorz Kukulski is a junior so ware developer working for Crossword Cybersecurity since May 2021. He has a master’s degree in automation and robotics at AGH University of Science and Technology, Cracow (Poland). Previously he worked for several years as a PLC programmer.

Sergio Sette is a subcontractor and a senior iOS developer with 11 years of experience as a software developer and 8 years of experience as an iOS developer in companies such as CESAR, William Hill, Revolut and Booking.com.

 

Fraunhofer:

Michael Kubach has been involved in the Fraunhofer-coordinated identity and trust research projects FutureID and LIGHTest (lightest.eu/) and led the project team of the TRAIN ESSIF-Lab (train.trust-scheme.de/info/) project. He is project lead for Fraunhofer in the German ONCE project (once-identity.de/) that is integrating the German national eID and wallet-based SSI identities.

Isaac Henderson is the Technical Architect of TRAIN and has expertise in Trust Infrastructures Development. And also has been involved in the Technical Team of Research Projects related to Identity and Trust. He also successfully developed a TRAIN PoC for the Global Covid Credential Network (GCCN) an initiative from Linux Foundation for Public Health.

 

Spruce Systems Inc:

Oliver Terbu holds a MSc in Computer Science from the Technical University of Graz. He has been working in the Digital Identity space for about a decade and was involved as chair, lead editor, author and contributor in various organizations (e.g., ISO, CEN/CENELEC, W3C, DIF, OIDF). He is Senior Technical Product Manager at Spruce.

Charles E. Lehner is a so ware engineer at Spruce, Mr. Lehner is working on DIDKit, a cross-platform decentralized identity toolkit with a core library written in Rust.

State of US partner :

New York

Starting date :

Next Generation SSI Standards


Experiment description

Experience has taught us that for wide user acceptance of any new technology, evolution is more successful than revolution, and building on existing infrastructures and standards is more successful than trying to replace them with completely new ones. The world has many examples of innovative technologies failing because they did not use the existing infrastructure and standards, e.g. electric cars ini ally failed because gas/petrol stations could not recharge them. So hybrid cars were invented.

Self Sovereign Iden ty (SSI) is a new paradigm, with new technologies and concepts, specifically: verifiable credentials (VCs) and decentralised identifiers (DIDs). In order to minimise the learning curves for new users and administrators, and improve user acceptance, we are building our SSI infrastructure on existing infrastructures wherever possible. This means that for trust infrastructures we are using X.509 PKI and ETSI Trust Lists (as specified by eIDAS), rather than block-chains, as this leverages the existing ubiquitously-adopted Internet trust infrastructure (as do COVID-19 certificates). Block-chains may
eventually become the predominant trust infrastructure, but in order to kick start SSI, including the European Digital Identity Wallet, we believe that PKIs should be the initial trust infrastructure. The incorporation of trust federations into SSI, using ETSI Trust Lists and the DNS was designed and implemented in the eSSIF-Lab TRAIN project by our project partner Fraunhofer.

Given that OpenID Connect (OIDC) is a widely deployed and understood federated identity management system, we propose to adopt the extensions that we are currently helping to specify (OIDC4VCI, OIDC4VPs and SIOPv2, collectively known as OIDC4VCs) as our transfer protocols for SSI identity management. This follows our principle of evolution rather than revolution.

Because the standards we propose to utilise (W3C Verifiable Credentials Data Model, Decentralised Identifiers and OIDC4VCs) are either new or still under development, there are many ambiguities, errors and omissions in them that need to be corrected. By independently implementing these (draft) standards in Europe and the USA, and performing interworking tests between the continents, will allow us to identify these issues and suggest corrections to the standards organisations.

Finally, looking ahead there are certain useful SSI functionalities that currently are not standardised. These are:

  • the use of ETSI trust lists for scaling trustworthiness,
  • the support for Levels of Assurance of user authentication,
  • end to end encryption of con den al credentials,
  • multiple signatures on credentials.

We will implement these additional functionalities and report on our achievements to the standards bodies, so that they can be considered for standardisation in due course.

Impacts :

Impact 1: Enhanced EU – US cooperation in Next Generation Internet, including policy cooperation.
We have identified the OpenID Foundation and the W3C as areas for enhanced EU-US cooperation, and Spruce and Crossword are working together to input changes to the draft standards for the W3C Verifiable Credentials Data Model v2 and the OIDC4VCs protocol suite, in order to ensure their practical implementability and use.

Increasing trustworthiness is a vitally important aspect of EU-US cooperation. We have identified the OIDF Global Assured Identity Network (GAIN) Proof of Concept project as another area for enhanced cooperation. GAIN wants to establish a global trust infrastructure for identity management. Fraunhofer has presented TRAIN to the group, describing how TRAIN operates as a trust infrastructure, so that it can eventually be integrated into the GAIN PoC. Crossword is attending the weekly meetings and has produced an outline design document that describes how the TRAIN trust infrastructure can be integrated into the GAIN technical solution. Crossword is feeding the results back into the GAIN project.

Impact 2: Reinforced collaboration and increased synergies between the Next Generation Internet and the US Internet programmes.
Spruce did not apply for an NSF grant and therefore did not receive any NSF funding. Consequently we are not familiar with the US NSF Internet program. However, we are familiar with the US Silicon Valley Innovation Program (SVIP) which is funding a number of W3C Verifiable Credentials related projects. These funded organisations are invariably participating in the W3C VC WG, and we are collaborating with them. Indeed, the W3C Postman tests that we are using have come from the SVIP funded supply chain project being run by Transmute. We fully expect the results of our project to be fed back into the SVIP.

Impact 3: Developing interoperable solutions and joint demonstrators, contributions to standards.
The project is having a large impact on developing interoperable solutions and contributing to standards. We believe that we are making a significant contribution to the OpenID4VCs protocol suite. Results below details the 17 contributions that we have made to OIDC during the project. The experiments will increase the precision of the standards by removing any ambiguities that currently exist. One example in the W3C VCDMv1.1 is whether the VC properties that are converted into JWT claims should be replaced or duplicated. Both have been implemented. A new draft standard has been created, specifically describing how JWT credentials are to be produced and the project partners are collaborating in the writing of this new standard. Organisations that are cooperating in this new standard include: Crossword, Spruce, Microsoft, Transmute and Mesur.io.

We know that our OpenID4VC profiles that we developed for our NGI interworking tests are having a significant impact elsewhere as within one week of publication, 6 JFF participants expressed an interest in joining us in the interworking tests, and in the end, by 14 November, 11 other organisations had joined us and successfully performed credential issuing tests.

In a Pilot for the UNDP GCCN, interworking experiments within Europe on the basis of TRAIN are being performed (United Nations Development Programme Contract HHD/UNPD1/0000043524.). TRAIN is also currently being evaluated for inclusion into the GAIA-X Federation Services specification, and also for the German Showcase Secure Digital Identities Project ONCE.


Impact 4: An EU - US ecosystem of top researchers, hi-tech start-ups / SMEs and Internet-related communities collaborating on the evolution of the Internet

The project is contributing to an EU-US ecosystem of top researchers who are focussed on SSI/Verifiable Credential solutions. The project partners have reached out to the lead developers of the W3C VC API test suite and OIDC conformance testing infrastructure, and they are now cooperating with us in extending the scope of these testing systems. We are involving more SMEs and high tech companies as the test suites are developed. We have already made our profiles available to the 30 organisations involved in the JFF Plugfest and 11 of them have already joined us and participated in successful interworking tests. The partners have increased their own collaboration as a result of this project both at a practical level, by providing each partner with more intimate knowledge of the other’s products, and
how fine nuances in the interpretation of the standards may adversely affect interworking, and at the strategic level, by proving to prospective customers that not only do their products interwork in theory by conforming to the standards, but also in practice due to these experiments. This will help each partner when talking to their prospective customers, by highlighting the international applicability of their products, and allowing each company to reference the other collaborating partner in sales meetings. This project should increase the market reach of the participants in their respective regions.

Spruce is an open source software company with the mission of empowering users to control their identity and data across all digital interactions. The maturation of the Spruce libraries developed for this project and the opportunities for interoperability among partners are already bearing fruit. In particular, the Credible wallet is now positioned to become a central product in the Spruce offering. Because of the successful outcome of this project, Spruce is planning to continue the work on the developed NGI issuer and verification services. The project has increased cohesion across collaborations by defining how digital credentials are handled using open standards with the user in control.

Results :

The experiment provided 21 results (see deliverable for details).   However, areas in which we exceeded KPI expectations are:

  1. We created a web site (ngiatlantic.info) where we published our OpenID4VCs profiles and preliminary results, along with the endpoints of our prototype implementations for others to test against.

  2. Our issuing profile of OpenID4VCI was adopted by participants in the JFF Plugfest, and nearly half of the participants added their endpoints to our table so that much wider interoperability testing could take place.

  3. Consequently we performed a large number of issuing interworking tests with participants in the JFF Plugfest, and demonstrated 19 interworking exchanges between products independently developed by 6 organisations, as the table below shows.

    Group 1 JWT

    Issuer ⇒

    Spruce

    Crossword

    walt.id

    Danube Tech

    Velocity Network

    Greenlight

    Wallet ⇓

    Spruce

     

    done

    done

    Done

     

     

     

    Crossword

    done

     

    done

    TBD

     

     

     

    IQ4

    done

    done

    TBD

    TBD

    Done

    Done

     

    Sphereon

    Done

    Done

    Done

    Done

    Done

    Done

     

    ValidatedID

    done

    TBD

    done

    done

    done

    TBD

     

  4. Other participants in the JFF plugfest took our issuing profile, and with only minor adjustments to it (they changed JWT proofs to JSON-LD proofs, along with the corresponding cryptographic algorithms) performed an additional set of 25 interworking exchanges between products independently developed by 7 organisations as the table below shows.

    Group 2 LDP

    Issuer ⇒

    Spruce

    Mattr

    Diwala

    Entrustient

    walt.id

    Danube Tech

    Wallet ⇓

    Spruce

     

    done

    TBD

    Done

    Done

    Done

     

    Mattr

    Done*

     

    Done

    Done

    Done*

    Done

     

    Diwala

    Done

    Done

     

    Done

    Done

    Done

     

    Entrustient

    Done

    Done

    Done

     

    Done

    Done

     

    Sphereon

    Done

    Done

    Done

    Done

    Done

    Done

    * Signature used is incompatible (but is not validated by the wallet)

  5. We have written an initial design for how the TRAIN trust infrastructure can be integrated into the OpenID GAIN project (https://openid.net/gainpoc/).

  6. We participated in the weekly W3C VC Edu and CCG meetings, and publicised our project’s ongoing results there. As a result our OpenID4VCI profile was adopted by the JFF Plugfest, whose members mostly attend the W3C VC Edu meetings.

The results of the JFF plugfest validate our hypothesis c), because the JFF participants were free to choose their own issuing protocol from three candidates that were available: OpenID4VCI, VC-API and DIDComm. Very few participants chose DIDComm and none of them that did were able to pass the plugfest due to the immaturity of the protocol and the number of technical issues that they had to solve before they could demonstrate interoperability. Just under half of the participants chose OpenIDVCI and just over half chose the VC-API. However the results of the plugfest showed that there were more independent implementations of OpenIDVCI than the VC-API, as the majority of the latter only implemented the digital signing functionality of credential issuing, rather than the full functionality, as they used a common broker to communicate with the wallet.

Our tests with ETSI trust lists, as implemented by the TRAIN infrastructure, indicated that this trust infrastructure is scalable to the proportions needed by SSI. We built two trust lists, one for the US and one for Europe and demonstrated interoperability between them. The OpenID GAIN project is now attempting to connect different trust infrastructures together, using the OIDC Federation protocol as the common management protocol. None of these trust infrastructures are believed to be blockchain based to the best of our knowledge. We have performed some initial design work to show how TRAIN can be integrated into GAIN, but due to lack of time and resources have not been able to validate this yet. This will be a valuable follow on project, which we will submit to NGI Assure.

Future Plan :

This has been a really valuable project to both the participants and the global SSI community. For the participants, it allowed Spruce and Crossword to develop prototype implementations of the draft OpenID4VCs suite of protocols, and to show that their independently developed implementations were capable of interworking together. For Fraunhofer it allowed it to add trust in verifiers to its existing TRAIN infrastructure, and to have two independent implementations (from Spruce and Crossword) show how TRAIN can be integrated into VC eco-systems in order to easily decide whether issuers and verifiers are trustworthy or not.

For the global SSI community the benefits of the project have been enormous. First, the participants have identified numerous omissions and errors in the OpenID4VCs protocol suite and have proposed text to rectify these that will benefit everyone. Secondly, the profile of OpenID4VCI that the participants produced was used very effectively by the global community participating in the JFF Plugfest. They used this profile to build their VC Issuers and wallets that could seamlessly interwork with similar products from other JFF participants. We plan to continue working with the JFF community by providing them with our profile for OpenID4VPs, in the anticipation that they will use this in a similar way to our issuing profile, thereby facilitating the verification of VCs and VPs between wallets and verifiers.

We plan to continue working with the W3C VC and OIDF OpenID4VCs working groups over the next couple of years in order to help them shape the final versions of these standards for the global SSI community.

Future R&D that is planned by the partners includes:

  • adding trust in wallet software providers to the TRAIN infrastructure,

  • integrating TRAIN with the OIDF’s GAIN proof of concept project,

  • completing the design of sending encrypted VCs between wallets and verifiers and implementing this in our prototype products.

Future product developments that are planned by the partners includes:

  • Crossword plans to make Identiproof interoperable with other solutions by implementing multiple protocols. This includes the compliance with the OIDC protocols and the TRAIN network, which were prototyped and tested in this project.

  • Spruce plans to continue to build the Credible wallet and a suite of supporting open source software products for use cases across public sector, institutional, and web3.

  • Fraunhofer plans to continue to build the TRAIN infrastructure enabling support for user friendly CRUD operations on the Trust List. And also plans to contribute to the Gaia-X Federation Systems (GXFS) and Gaia-x Trust model specification which will be later adapted by different federations and dataspaces in EU. Moreover Fraunhofer aims to integrate the developed solutions into the German Showcase Project ONCE.

NGI related Topic :

Strengthening Trustworthiness and Resilience Of the Internet

Call Reference :

5

The 30-months project NGIatlantic.eu will push the Next Generation Internet a step further by providing cascade funding to EU-based researchers and innovators in carrying out Next Generation Internet related experiments in collaboration with US research teams.




contact action add button