codeforpdx / codeforpdx/PASS

Update signatures system to use verifiable credentials

Open
#259 1 comment 0 reactions 1 assignee View on GitHub

@timbot1789 is already working on this.

Since Jun 16, 2023.

discovery enhancement
Dominant language
JavaScript
Stars
38
Forks
23
Avg merge
11m
Merged PRs (30d)
4

Description

Is your feature request related to a problem? Please describe.
Currently, we are adding cryptographically secure signatures to documents in PASS that can accurately claim if a document has been seen and certified by a certain entity.

However, the method we're using to assign the signatures is a bespoke method designed by me. I am not a security expert, and my design is not particularly robust. Because of this, it will be difficult for other institutions to read the signature, and even if they can, they may be hesitant to accept a nonstandard security system designed by an unpaid volunteer without expertise in the area.

Describe the solution you'd like
There is a W3C standard for issuing these types of certificates, verifiable credentials. This system is conceptually similar to what I wrote up, but is an accepted industry standard with several supporting libraries. Switching the signature system to instead issue these verifiable credentials will make PASS easier to use, and more trustworthy.

Describe alternatives you've considered
There are several other individual credentialing standards for individual documents (like mobile driver's license). They are all useful, and PASS would benefit from adding them. However, verifiable credentials has a few advantages that make it a good starting point:

  1. It's web native. Other standards tie the credential to a specific device that must be brought with you, or otherwise can't be used on the web
  2. It can be used on any file. Other standards can only be used on certain file types
  3. It's fully decentralized. Anyone can issue a verifiable credential. And anyone can anonymously verify a web credential. Other standards require the credential to be issued by certain bodies, and only allow verification by certain bodies

Additional context
We'll want to research a good library to use to generate web credentials. It needs:

  • To be usable in the browser with javascript
  • preferably be able to render encryption keys as JSON Web Token.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.