Digital Identity

Transcript

[Music] okay thank you Ming and thank you for having me um I'm going to talk about digital identity the the uh uh my original topic was to talk about digital identity and publicy structure but you know there's only 20 minutes and who am I kidding so let's uh launch right in it so what is digital identity so conceptually it's a digital object that maps onto a physical entity normally

when we talk about this stuff uh we're talking about people but it can also mean a uh a company a corporation or a device so the the common saying is that on the blockchain nobody knows your fridge and so they're they're talking about digital identity um why do we want digital identity so we want to tie actors in the physical world to the digital world so this is for instance good because it allows actors with some Authority in the physical world to express that Authority on the blockchain so you can imagine a

form of proof of birth or proof of death as a uh digital attestation or signature by a doctor uh also digital kyc is is a uh common use case where a bank attests that they've done certain checks and now that attestation can be used on a blockchain in a smart contract doing crowdfunding or or what have you uh um it also allows mapping of social structures into the digital realm and kind of enhancing um social structures through smart contracts so this is for instance uh Community

formation uh we have a dab called inflect that that uses this also reputation systems are anchored in this notion of uh uh digital identity because digital identities say stuff about each other and and that's forms reputation uh there's also the humanitarian side a lot of um refugees or uh victims of human trafficking often lack paper documentation altogether and if we can have a system where you have a digital identity system maybe coupled with Biometrics run by ngos Etc this this might help a lot of

people uh how how how do we map from digital to physical the most common form is by using a secret that only the physical entity knows so for instance on ethereum you have an ethereum account or an address that has an Associated private key and anyone who has that private key can send transactions interact with contracts Etc and so the the assumption is there that uh the holder of the private key is the physical entity and it it Maps uh onto the blockchain another example is is

Facebook if someone has my password to Facebook they can post on my wall and they can kind of act as me in in the context of the Facebook platform um so lastly here this a digital signature is proof of knowledge of a secret without revealing the secret so this is why uh digital signatures are so important for for uh blockchains because it uh authenticates that you know the secret and that creates the mapping to the physical entity so uh the most common form of digital identity today is what we call

Federated identity so this means that you have a third-party identity provider uh that hand handles this mapping from the digital to the physical and so whenever you act as your um digital Identity On A blockchain or in a digital space you do so through this centralized intermediary so I'm sure you all have seen uh log in with Facebook log in with Google this is Facebook acting or you acting through Facebook um as a digital identity so what we want to try and move towards is this notion of self Sovereign

identity so uh this this image came up when I when I Googled self Sovereign and isn't it so empowering um so so this is the idea of having the user actually be in control of their own identity uh if we use a a a platform like ethereum then smart contract can can do a lot of what the central identity provider like Facebook does uh while being a a shared resource owned by no one and everyone uh the idea here is that the user controls their private Keys when interacting uh with the blockchain but

critically the user can also choose to let a third party control the keys for them so we can have uh all the benefits of of the Federated identity model in the The Sovereign self- Sovereign identity model so how how do we build uh a digital identity system with self- sovereignty at the core so the starting point is the notion of uh a public key so with every public key comes an Associated private key and the public key then becomes this digital object that is mapped to the

private key holder which lives in in the uh uh Physical Realm so examples is uh an ethereum address a Bitcoin address something like a a a minilock ID if if anyone has used or heard of minilock um the this is like a very onedimensional um Atomic object but but sometimes this is enough like if I go on um ujo music for instance and I want to buy imin heap's latest song uh imagin might not even care who I am she only know she

only cares that uh that she gets paid and so the the only information she needs is that there is some kind of identity here and I got paid by that identity so sometimes this is all that's needed uh most of the time though you want some more uh information so what we want to try and do is tie some data cryptographically to this key and we can do so using uh smart contracts or in other systems uh you might be able to do it using digital signatures so some basic stuff we can we

can attribute to the to the key is uh a name maybe a profile picture email Etc uh in cases of Corporations you might have some tax information Etc uh or for the balance three uh triple entry accounting system you have an accounting Ledger that's attached to your to your digital identity uh here we could also bootstrap other services so you can uh you can attri you can have an attribute attribute attribute yeah that's one you you can have an attribute which is your uh Twitter account your Facebook account

GitHub Etc um so here is kind of what it can look like do we have the laser thing is this no anyway I'll just point um so we have this public key which is kind of the core of of the identity uh the corresponding private key can can create and control a smart contract that that contains the attributes so the attributes could be stored on the blockchain but normally we we use a system like ipfs that Juan mentioned uh and we can have hashes that that corresponds to uh to objects and in ipfs um a second thing that we want to

have is attestations so what this is that we can let other identities attest to the validity of the attributes that you uh connected to your public key uh this can lend credibility to the attributes uh while at the same time letting the user have control of their own identities so this could be for instance a a government verifying your date of birth so you yourself claim that your date of birth is uh January 1st 1980 and the government can come in and say yes we we verify that this is true because we saw the the birth record or

something and they can do a digital signature and now you have uh on the blockchain a very strong um a very strong certificate if you will that that this is correct at least according to this government another one is is uh in the banks uh they can verify that you have an accredited investor status and so this means you have to have more than $250,000 in an account or something like this um more advanced is uh reputational attestations which we'll hear uh more about later by Andre uh so this would be you know not just saying that this information is

correct or not but kind of like you know more fuzzy things like I bought uh socks from this person and it was good so I get five stars um so this is what it can look like in in that case you know you have two of these identities and uh the first one has some this one has two attributes that one has one attribute and one can do an attestation of the other so it's it's a very abstract concept but in general you get things like you know certified things by authorities but you also have the notion of of web of trust where you can build um you can build reputation

Etc from the attestation of of your friends um so this is you know this sounds pretty good uh there's a big problem though and it's it's the following that vitalic brought up uh during the uh uh web of trust conference in in San Francisco and and the thing is you know what if you lose your private key and you kind of don't want a system where if you lose your private key which people do all the time H you don't want to lose your identity because that's you know that's too much to

uh too much power to put in in this one thing um so we need to be able to recover from Key loss which is I have my key on my phone I lose my phone what do I do and key compromise which is uh some attacker gets my key and starts acting in my name so how do we do this well uh the the way that the we've approached it is we want to allow the user to uh revoke and replace a key that they suspect might be uh compromised so let's say I lose my phone but I have a

backup okay someone could maybe find my phone and get that key so I want to make sure I replace that key so they can't start acting in my name um and then if I lose complete control I could have a uh a smart contract that I delegate the authority to to uh regain control for the user so a specific case of this is that you can have a multi- setup where you where you have three of your friends and then two of them are needed to to regain uh control for me so so they would basically uh be able to override the

current key and say here is here is another key that is now in control of this uh of this smart contract uh so let me talk about what we've been doing at consensus uh with the ort initiative so this is basically um trying to take these IDs and and make a uh functioning product out of it So currently uh the current status is is the following we have this kind of core identity model where you have a uh a

controlling key that controls your identity which is um attached to attributes uh we use ipfs to to store these attributes uh we have a registry where you can where you can look up uh the um the uh uh you can look up the key in a registry and get the corresponding attributes uh this is currently used inhouse in a uh a number of other consensus projects so balance three the triple entry accounting system the uh registry Builder uh the I mentioned inflect the event and Community Management tool and

the read it like a discussion platform nonsense um so here here is kind of like a screenshot from from balance 3 uh where where we see in the in the top right corner kind of the a very familiar like user badge thing and that information is is stored in ipfs and and retrieve via this smart contract system uh future directions instead of having it be tied to a single private key we want to tie the identity to a uh unique identifier so that we can have uh the

type of key rotation key revocation uh features that that we talk about and also key recovery uh we want to be able to have the attributes encrypted so that you can have private uh attributes and to be able to uh selectively disclose those to to uh um to your uh friends or whoever uh also uh integrating our our reputation system is also on the road map so uh this is the team for uport and that's it I don't know if I have

time for questions uh there sorry uh sorry I I shouldn't have written that but anyway thank you so much