did:gns

The did:gns method is a decentralized identifier implementation built on the GNU Name System (GNS), a censorship-resistant naming system that operates without reliance on blockchain technology. This method leverages GNS's inherent capabilities as a public-key infrastructure to create and manage digital identities.

Each identity in the system is represented by a zone key pair (public-private), allowing users to maintain multiple independent identities. The system stores DID Documents in GNS zones, with each document encrypted and digitally signed using zone-specific keys. This approach ensures both privacy and authenticity of identity data.

Key features include:

• Decentralized Operation without blockchain dependency
• Cryptographic Privacy through record encryption
• Censorship Resistance via distributed architecture
• Multiple Identity Support through separate zone keys
• Flexible Record Management with configurable expiration times

The method provides strong security guarantees through its cryptographic foundation while maintaining user privacy. Unlike blockchain-based methods, did:gns relies on distributed hash tables for data distribution, making it resistant to denial of service attacks and offering efficient resolution.

Technical Implementation:

1. DID Generation and Structure

• Format: did:gns:<Base32GNS-encoded-zone-key>
• Example:

  did:gns:000G006K2TJNMD9VTCYRX7BRVV3HAEPS15E6NHDXKPJA1KAJJEG9AFF884

• Generated from GNS zone keys
• Uses Base32GNS encoding for public keys

2. Resolution Process

• Extracts public zone key from DID identifier
• Resolves DID_DOCUMENT record type at Apex Label
• Implements normalization through Base32GNS decoding
• Records are encrypted and signed by zone keys

3. Key Management and Security

• Each identity maintains unique zone key pairs
• Private keys never exposed in DID documents
• Documents signed using zone-derived private keys
• Records encrypted with derived symmetric keys
• Supports key rotation through document updates

4. Technology Stack

• Built on GNU Name System protocol
• Uses Distributed Hash Tables for data storage
• Implements DID_DOCUMENT record type (GANA 65566)
• Utilizes Base32GNS encoding scheme
• Employs cryptographic signatures for authentication

5. Update and Deletion Mechanisms

• Supports document updates through record modification
• Offers temporary deletion through record depublication
• Enables permanent revocation through zone key invalidation
• Record expiration controls update propagation