Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarify that the DID Method of a witness DID and diffentiating the DID Log Entry proofs #123

Closed
wants to merge 5 commits into from
+14 −1
Closed

Clarify that the DID Method of a witness DID and diffentiating the DID Log Entry proofs #123

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
52f2c3d
Clarify that the DID Method of a witness DID and diffentiating the DI…
swcurran Oct 24, 2024
ede146f
Merge branch 'main' into witness-proofs
swcurran Oct 28, 2024
d3d6855
Merge branch 'main' into witness-proofs
swcurran Nov 7, 2024
d195c91
MUSTs around witness resolution
swcurran Nov 7, 2024
8d55ac2
Merge remote-tracking branch 'origin/witness-proofs' into witness-proofs
swcurran Nov 7, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 14 additions & 1 deletion spec/specification.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -353,6 +353,14 @@ For each entry:
Integrity]] proofs **MUST** be valid and **MUST** be signed by a threshold
of [[ref: witnesses]]. For details, see the [DID
Witnesses](#did-witnesses) section of this specification.
2. A `did:tdw` resolver can differentiate between the proofs from witnesses
and that of the [Authorized Keys](#authorized-keys) by the DID Method of
the signing key for the proof. The DID Controller's proof **MUST** be
signed using a `did:key` DID, while the witness proofs **MUST NOT** be a
`did:key` DID. For details about the witness DID methods, see the [DID
Witnesses](#did-witnesses) section of this specification. In addition, the
The DID Controller's proof **MUST** be signed using a key from the
currently active `updateKeys` [[ref: parameter]].
3. Verify the `versionId` for the entry. The `versionId` is the
concatenation of the version number, a dash (`-`), and the `entryHash`.
1. The version number **MUST** be `1` for the the first [[ref: log entry]] and **MUST** be
Expand Down Expand Up @@ -383,7 +391,7 @@ For each entry:
the active array of `nextKeyHashes` [[ref: parameter]], as defined in the
[Key [[ref: Pre-Rotation]] Hash Generation and Verification](#pre-rotation-key-hash-generation-and-verification)
section of this specification.
9. If any verifications fail, discard the DID as invalid with an error message.
9. If any verifications fail, discard the DID as invalid with an error message.
10. As each [[ref: log entry]] is processed and verified, collect the following information
about each version:
1. The [[ref: DIDDoc]].
Expand Down Expand Up @@ -899,6 +907,11 @@ An overview of the [[ref: witness]] mechanism is as follows:
- Over time, the list of [[ref: witnesses]] may evolve, with each change being
approved by the declared list of [[ref: witnesses]] from **before** such a
change.
- The DID of the witnesses **MUST** be `did:tdw` DIDs to prevent the need for
a `did:tdw` resolver having to resolve DIDs of other DID methods.
- `did:tdw` resolvers **MUST** prevent infinite loops in DID resolution in
cases where the witnesses for a `did:tdw` DID use the same witnesses as the
DID being resolved.
- The [[ref: DID Controller]] prepares a [[ref: DID Log Entry]] and shares it with
the [[ref: witnesses]].
- The specification leaves to implementers *how* the [[ref: log entry]] data is provided to the [[ref: witnesses]].
Expand Down