Glossary

This glossary provides public, non-secret definitions used across the UbID Documentation Center. Product and protocol pages provide additional context.

Identity and participants

Term	Public meaning
Account	A service relationship used to manage access, preferences, devices, or operations; it is not the complete digital identity of a person.
Subject	Person, organization, device, or entity described by credential claims.
Holder	Participant that controls receipt and presentation of a credential; the holder and subject can be different.
Issuer	Organization accountable for validating and signing the claims in a credential.
Verifier	Participant that checks presented evidence under an approved verification policy.
Relying party	Organization or service that uses the verification result to make its own decision.
Proofing provider	Service that produces identity, document, biometric, or other evidence used by an issuer or policy.
Custodian	Participant entrusted with a bounded custody or recovery responsibility.
Controller	Party that determines the purposes and means of personal-data processing under applicable law.
Processor	Party that processes personal data on documented instructions from a controller.
Digital identity	A managed set of identifiers, credentials, keys, devices, relationships, and policies used to represent an entity digitally.
Identifier	Value used to distinguish or reference an entity within a defined context.
Scoped identifier	Identifier limited to a relying party, purpose, relationship, or context to reduce correlation.

Credentials and evidence

Term	Public meaning
Claim	A statement about a subject, such as a qualification, role, or attribute.
Credential	A set of claims and associated metadata issued by an accountable authority.
Verifiable Credential (VC)	Tamper-evident claims whose issuer and integrity can be cryptographically verified.
SD-JWT	IETF mechanism for selective disclosure of claims in a signed JSON Web Token.
SD-JWT VC	Credential profile that applies SD-JWT to verifiable credential use cases; its exact specification version must be declared.
Disclosure	Claim or disclosure element intentionally released for one presentation.
Selective disclosure	Holder-controlled presentation of only the claims required for a transaction.
Derived claim	Fact computed or asserted from source data, such as an age threshold result, without disclosing every source value.
Presentation	Package of credential-derived evidence delivered to a verifier for a defined purpose.
Holder binding	Cryptographic or policy relationship showing that the presenter is authorized to use a credential.
Credential status	Issuer-controlled indication used to evaluate suspension, revocation, or another lifecycle state.
Schema	Versioned definition of claim names, types, constraints, and semantics.
Evidence	Reviewable record of observations, authorization, policy, and outcome without unnecessary secret or personal content.
Evidence chain	Linked artifacts or references that make an operation and its decision path independently reviewable.
Assurance	Confidence supported by defined evidence, process, controls, and review.

Identifiers, protocols, and access

Term	Public meaning
DID	Decentralized Identifier resolved through a DID method to verification or service material.
DID document	Resolved data describing verification methods, services, or relationships for a DID.
DID method	Rules for creating, resolving, updating, and deactivating a class of DIDs.
DIDComm	Identity-bound encrypted messaging for authorized agents and services.
OpenID4VCI	OpenID protocol for offering and issuing credentials to compatible wallets.
OpenID4VP	OpenID protocol for requesting and presenting credentials or proofs.
DCQL	Query language used by OpenID4VP to express credential and claim requirements.
OpenID Connect (OIDC)	Identity layer used to establish authenticated sessions; it is not a verifiable-credential format.
OAuth 2.0	Authorization framework for delegated API access; it does not itself prove credential truth.
WebAuthn	W3C API for public-key credentials, including passkeys and hardware authenticators.
Passkey	Phishing-resistant public-key credential used for authentication, often synchronized or device-bound.
MCP	Model Context Protocol for controlled discovery and invocation of resources, prompts, and tools by AI-enabled applications.
Trust API	Governed interface exposing bounded trust capabilities without granting access to internal data stores or unrestricted cryptographic material.

Cryptography and security

Term	Public meaning
Private key	Secret cryptographic value used to sign, decrypt, or prove control; it must not be published.
Public key	Cryptographic value that can be distributed to verify signatures or establish protected exchanges.
KID	Key identifier binding a cryptographic operation to a named key and version.
KMS	Key management service governing creation, protection, use, rotation, and retirement of institutional keys.
HSM	Hardware security module designed to protect and perform operations with cryptographic keys.
TEE	Trusted execution environment that can isolate sensitive computation and produce attestation evidence.
Attestation	Evidence about the identity and measured state of hardware, software, or a protected environment.
Zero Trust	Security model requiring explicit verification and least privilege at each access and service boundary.
Defense in depth	Multiple independent controls so that failure of one layer does not become complete compromise.
Nonce	One-time or freshness value used to reduce replay and bind an operation to a challenge.
Audience	Intended recipient or verifier to which a token, proof, or presentation is bound.
Replay attack	Reuse of a previously valid message, token, challenge, or presentation in an unauthorized context.
Crypto-agility	Ability to change algorithms, key sizes, providers, and formats under controlled migration.
Post-quantum cryptography (PQC)	Cryptographic algorithms designed to resist known attacks from sufficiently capable quantum computers.
Hybrid cryptography	Combination of classical and post-quantum mechanisms so security does not depend on one family during migration.

Privacy, lifecycle, and governance

Term	Public meaning
Data minimisation	Collecting, disclosing, processing, and retaining only what is necessary for a declared purpose.
Purpose limitation	Restricting data use to specified, legitimate, and compatible purposes.
Privacy by design	Embedding privacy objectives and controls into architecture, defaults, lifecycle, and operations.
Consent	One possible legal basis or authorization mechanism; it is not universally valid or required for every processing activity.
Retention	Approved period and conditions for keeping a defined data class.
Revocation	Issuer or authority action indicating that a credential or authorization should no longer be accepted under policy.
Suspension	Temporary lifecycle state pending review, correction, or another event.
Recovery	Governed process for restoring legitimate identity or wallet access without creating a universal administrator secret.
Threshold recovery	Recovery requiring an approved subset of independent shares, custodians, or authorizations.
Jurisdiction profile	Versioned policy overlay translating local legal, sector, role, and purpose requirements into controls.
Trust policy	Rules defining acceptable issuers, credentials, formats, algorithms, status, disclosure, assurance, and context.
Policy version	Immutable identifier for the exact rules evaluated for a historical decision.
Human review	Authorized assessment of an indeterminate, disputed, exceptional, or consequential result.
Certification	Formal status issued under a recognized scheme for a defined scope and validity period.
Conformity assessment	Evaluation of a product, service, or process against specified requirements.
Operational accountability	Ability to explain who acted, under which policy, with what evidence, and what outcome occurred.