did:webs

The did:webs method is a secure, web-based Decentralized Identifier method that combines traditional web infrastructure with advanced cryptographic trust mechanisms. Unlike its predecessor did:web, this method's trust is not rooted in DNS, webmasters, or certificate authorities, but instead uses KERI (Key Event Receipt Infrastructure) to provide a secure chain of cryptographic key events controlled by the identifier's owner.

Key features:

• Uses web servers for publishing and discovery while maintaining strong cryptographic trust
• Leverages KERI for secure key management and rotation
• Does not require blockchains but can optionally reference them
• Supports multi-signature capabilities
• Enables pre-rotation of keys for enhanced security
• Provides end-verifiable authenticity through cryptographic proofs

The method achieves a balance between accessibility and security by:

• Utilizing familiar web infrastructure for deployment
• Implementing robust cryptographic trust mechanisms
• Supporting scalable and cost-effective operations
• Avoiding reliance on exotic cryptography
• Enabling transparent governance

Technical Architecture:

1. DID Generation and Structure:

   • Format: did:webs:<host>[:<path>]:<aid>
   • The <aid> component is a KERI Autonomic Identifier
   • Supports both domain names and IP addresses in the host component

2. Resolution Process:

   • Transforms DID to HTTPS URL
   • Retrieves both DID document and KERI event stream
   • Verifies authenticity through KERI validation
   • Processes key events to determine current state

3. Key Management:

   • Supports multiple key types including Ed25519 and Secp256k1
   • Enables threshold signatures
   • Implements pre-rotation mechanism for key recovery
   • Maintains cryptographic continuity through key changes

4. Security Features:

   • End-verifiable authenticity
   • Non-repudiation through KERI events
   • Duplicity detection
   • Multi-signature support
   • Witness network validation

5. Technology Stack:

   • HTTPS for transport
   • KERI for cryptographic trust
   • CESR for data encoding
   • JSON for DID documents
   • Optional blockchain anchoring