did:trustbloc

TrustBloc DID Method is a decentralized identity solution that enables groups of independent entities to collectively manage a DID registry using a permissioned ledger. Built on the Sidetree Protocol, this method allows organizations to form consortiums where each member maintains their own nodes while sharing custody of the DID registry.

The method implements a unique Discovery Service that allows clients to:

• Verify consortium endorsement by stakeholders
• Validate stakeholder configuration files
• Access Sidetree endpoints for DID operations

Key features include:

• No reliance on a single blockchain
• Multi-stakeholder governance model
• Built-in configuration verification system
• Cryptographic agility support
• Caching mechanisms for improved performance

DIDs follow the format:

did:trustbloc:[consortium-domain]:[document-id]

The architecture employs a hierarchical trust model where:

• Consortiums define overall policies and member lists
• Stakeholders operate nodes and sign policy changes
• Each stakeholder maintains their own Sidetree endpoints
• Configuration files are cryptographically signed by stakeholders

Technical Implementation:

1. DID Generation:

• DIDs are created through Sidetree Create operations
• Format follows did:trustbloc namespace convention
• Document IDs are generated according to Sidetree Protocol specifications

2. Resolution Process:

• Client discovers endpoints through consortium configuration
• Verifies stakeholder signatures and endorsements
• Queries multiple stakeholders based on consortium policy
• Uses Sidetree endpoints for actual resolution

3. Key Management:

• Supports multiple verification methods
• Implements JWK format for public keys
• Enables key rotation through Update operations
• Provides Recovery mechanism for compromised keys

4. Security Features:

• Well-Known DID Configuration for domain linkage
• Multi-signature endorsement requirements
• Configurable caching policies
• Historical configuration tracking

5. Technology Stack:

• Built on Sidetree Protocol
• Uses JWS for configuration signing
• Implements JSON for configuration data
• Supports HTTP(S) for endpoint discovery
• Employs SHA-256 for history verification

The method provides robust security through multiple stakeholder verification while maintaining flexibility in consortium governance and operation.