Decentralized Identity and Web3

One thing I’ve been hearing recently is that decentralized identity is the "next cycle" to continue to drive the adoption of Web3. Decentralized identity is not “the next cycle” following the whole “DeFi season, NFT season, DAO season” narrative. Rather, it’s the continual catalyst that will unlock a new set of use-cases on top of those existing paradigms that were previously unavailable.

In short, decentralized identity adds the following in a trust-minimized and user-centric manner:

• Who you are - which is a core set of claims about a person or entity.
• What you can do - which are any available actions based on those claims, which are verified and originated from a relevant source.

We can illustrate this with our good friend Steve:

In this case, we have a core set of claims that unlock different things for the subject, including physical access, group memberships, and more.

With current technologies, we can have a user sign-in using their keys (e.g. Sign-In with Ethereum), have credentials issued to their identifier (and store them), and use capabilities to retrieve and present those credentials. In a future post, I’ll break down the core basics of decentralized identity – everything from DIDs, Verifiable Credentials, and more. The use-cases that these types of workflows empower will really be what drives the space to another level during the next cycle.

To start with the basics, we need to set the stage with how the web3 space operates now, and then how it can operate in the future.

The Future is Now

Our current scope with no external verifiable data deals strictly with asset exchange. Two parties can trustlessly transfer assets with no intermediary, based on a particular time (whether immediate, within a certain amount of blocks), or confirmation thresholds (enough signers to send from a multisig).

We’ve been able to reinvent an entire set of financial interactions, making them trustless by using this type of exchange, and it’s quite incredible. But beyond that, it becomes difficult to have more meaningful interactions because the more we trust the other side of the trade without additional verifiable information, the more counterparty risk we incur. How do we know 0xaLiCe is who they say they are?

Let’s take this a step further by now introducing a case where a form of authenticity is required in some way about one of the counterparties.

This wonderful painting of Steve requires a bit of provenance tracing in order to be sold, and with that, knowing that the artist is the seller, and was responsible for creating the work. This is because we want a first edition copy of Steve sold directly by the artist (who wouldn't). Adding additional information such as some basic facts about a counterparty reintroduces trust in the transaction.

This comes with the correlation risk that there is now a name attached to a public key. However, the seller here has taken on this risk because the asset in question is worth more than the cost of the trust portion of this transaction.

Now with the additional context we’ve added, this interaction becomes safer due to Bob knowing that he’s buying this original Steve from the artist. Bob in this case may or may not associate his name with his public key, as he doesn’t require any form of authenticity. The trust portion of the transaction typically falls on the originator. Alice just needs to know that Bob has the money to pay for the art. Other than that, she couldn't care less who the buyer is.

That’s the beauty of this space: both counterparties don’t necessarily need the same assurance levels.

Levels of assurance (LOA) represent the trust cost based on the stakes of the transaction itself. For example, if Alice has a name and a few social media handles tied to a public key, she may be able to prove authenticity when it comes to selling NFTs – a low assurance use case.

We’ve introduced some risk with these forms of personally identifiable information (PII), but as we go up the chain in information sensitivity requirements, unfortunately, it requires much more risk on Alice who has to meet some criteria for the transaction and disclose information.

A case where a government-issued identifier might be required would be a scenario in which Alice wants to participate in a permissioned DeFi protocol with KYC [customer/counterparty] requirements. Thankfully are ways in which Alice can prove her identity without having to publicly disclose any of this information:

In the case above, Alice can have a credential issued for a particular purpose, store it in a personal data vault, and only authorize access to that credential when she consents to the interaction. Additionally, Alice controls this credential at all times and can present it to any requesting platform: it isn’t limited to a single platform because it’s a credential she owns and controls.

What Comes Next

With these kinds of interactions now possible, there’s a lot more we can do in the space, and plenty of new avenues unlocked:

DeFi

• Currently, lending in DeFi is mostly overcollateralized so there’s a backstop in case of any market uncertainty. With credentials gained from a variety of on-chain and off-chain sources, undercollateralized lending with richer credit histories used as evidence is now possible. With additional information, risk can now be accurately assessed.
• Additionally, permissioned trading and lending pools in DeFi are now possible for institutions, as you can accurately identify counterparties with enough assurance through credentialing.

NFTs and DeSoc

• Currently, you have limited assurance levels on who you’re interacting with when buying NFTs. By assembling just the right amount of information through credentialing (such as social media accounts and other art-related connections), you know exactly who you’re buying from without having to solely rely on centralized platform verification processes.
• Decentralized knowledge bases are now possible, as you can accurately assess the fact that a reputable author or creator is the one producing specialized content.
• Decentralized identity and data also open up the possibility of exporting one’s social graph, including all connections, followers, posts, and more that can be portable and travel with users from platform to platform.

DAOs

• Decentralized Identity will dramatically change the way DAOs operate, especially in the context of delegation. Your steward won't just be a public key, but a mix of on and off-chain information that makes them both qualified and trustworthy to earn your voting power.
• DAO members would now also be able to demonstrate skills and earned certifications that travel with them to different DAOs. For example, in the case of a worker collective, each worker can attest to certifications that they’ve earned in order to assert that they are the most qualified for a job to be done.

Decentralized identity isn’t the next big thing - but instead, it’s the necessary component in order to power a new future.

However, the future is quite closer than it seems.

If you want to chat about decentralized identity or any related use-cases, check out our Discord server: