Verifiable Credentials
A verifiable credential is a digital statement whose issuer and integrity can be checked cryptographically. It can represent identity attributes, qualifications, permissions, memberships, certifications, licenses, or other governed attestations.
A credential is useful because it carries evidence in a form that can be presented and independently checked, subject to trust policy.
A credential connects four questions
A verifier needs to understand:
- Who issued the credential?
- Has the credential or presentation been altered?
- Is the credential still valid for this purpose?
- Does the presented evidence satisfy the verifier's policy?
Cryptographic signatures help answer provenance and integrity. Credential status, expiry, holder relationship, freshness, and trust policy answer the remaining questions.
Credential, source evidence, and database record
These are related but not identical:
- A source document or record may be used to establish a fact.
- An issuer decision determines which claims can be attested.
- A verifiable credential carries the resulting signed claims.
- A presentation reveals the credential or selected claims to a verifier.
- A verification result explains whether the presentation satisfied policy.
The verifier may not need a copy of the source document. In many cases, it is sufficient to receive trustworthy proof of the relevant claims.
Examples of credential claims
A credential may represent:
- identity attributes established by an authorized issuer;
- an academic qualification or course completion;
- professional membership or certification;
- an employment role or organizational affiliation;
- eligibility for a service or benefit;
- authorization to perform a regulated or restricted activity;
- a verified document-derived attribute.
The credential schema should be limited to the claims necessary for its purpose. It should not become a container for every attribute known about the holder.
Issuer provenance and trust
A mathematically valid signature is not sufficient by itself. The verifier must determine whether the issuer is trusted for the type of claim being presented.
For example, a university may be trusted to issue a degree credential but not a government identity credential. Trust therefore depends on the relationship among issuer authority, credential type, policy, and context.
Holder custody and presentation
The holder stores the credential in a wallet or protected vault and decides when to present it. Depending on the format and policy, the holder may present the complete credential or only selected claims.
The holder cannot change issuer-signed claims without invalidating the credential. Holder control concerns custody and presentation, not rewriting institutional evidence.
Status and lifecycle
A credential may have validity dates and status information. It may be renewed, replaced, suspended, or revoked according to issuer policy.
Deleting a local copy from a wallet is different from changing issuer-controlled status. The first affects the holder's device; the second affects whether the credential should continue to be accepted.
Portability and interoperability
UbID is oriented toward open identity and credential standards so that credentials can be understood by compatible systems. Portability does not mean universal acceptance. Each verifier remains responsible for deciding which issuers, credential types, algorithms, assurance levels, and status mechanisms it accepts.
A credential can be authentic and still be insufficient for a transaction. Verification must consider the issuer, credential type, status, freshness, disclosed claims, and the relying party's policy.