Relationship between eIDAS and W3C DID/VC (and hence UNTP)

[onthebreeze]

Impacted sections

• https://uncefact.github.io/spec-untp/docs/about/References

Issue Description

I've received some questions about how the UNTP approach to identity reconciles with the EU regulated approach as defined by the eIDAS framework. I'm not an eIDAS expert and so have raised this ticket to promote some discussion amongst our team and hopefully reach a point where we can update the https://uncefact.github.io/spec-untp/docs/about/References page with something relevant and useful about how UNTP can work with / be interoperable with the EU eIDAS framework.

Very high level assessment.

My initial thinking is that both UNTP and eIDAS intent is to add trust to electronic interactions through confidence in high integrity identity.

• UNTP (based on W3C DID / VC specifications) essentially says "mint your own identity (a DID) and if you want to add stronger integrity to it then link it to an authority issued identity using the Digital Identity Anchor credential.
• eIDAS says "get your high integrity digital identity directly from an authority and use it for your digital interactions."

I think these are not incompatible in the sense that a DID + DIA serves much the same purpose as an eIDAS identity. What we could probably do is to add a section to https://uncefact.github.io/spec-untp/docs/specification/DigitalIdentityAnchor that indicates how an authority issued digital identity can be used as the issuer of UNTP credentials like DPP, DCC, etc.

Another thing to note is that the new candidate recommendation from W3C on "Controlled Identifiers" (CID) looks sort of like a DID that is issued by an authority. Perhaps it will also have a place in the UNTP architecture.

I suspect did:ebsi might also have a role to play

Comments welcome - especially from those familiar with eIDAS.

[onthebreeze]

For what it's worth (noting hallucination risk), here's what chat GPT had to say about it. Attaching a PDF as, for some reason, the usual cut & paste of markdown didn't work (I think chatGPT have made an unwanted "improvement").

Relationship Between eIDAS and W3C DID.pdf

[Fak3]

Another thing to note is that the new candidate recommendation from W3C on "Controlled Identifiers" (CID) looks sort of like a DID that is issued by an authority.

CID spec describes the data model, it does not say who issues it. DID documents that rely on it, can be self-issued.