My illustration entitled: “The Broken Mirror of Data Extraction” – a giant corporate scanner attempts to reconstruct Herbert’s complete identity from countless fragments. Herbert raises a cryptographic shield that permits one verified fact through while shattering the invasive profile around him. Represents: Verification does not require mass collection, profiling or permanent surveillance.
Identity is becoming infrastructure.
A person increasingly needs a digital identity to communicate, work, study, travel, receive public services, open financial accounts and participate in technological society. What was once a collection of separate documents is becoming an interconnected system of databases, accounts, credentials and permissions.
This transformation can make life more convenient. It can also create one of the most consequential concentrations of power in digital civilization.
If a single institution controls the identity through which a person enters society, that institution may acquire the power to observe, classify or exclude the person across many domains at once. The identity layer can become a permission layer. Whoever controls it can determine not only who a person is, but also what that person is allowed to do.
Self-sovereign identity proposes a different architecture. Rather than requiring every verifier to retrieve personal information from a central identity provider, it allows an individual to hold cryptographically verifiable credentials and present only the evidence required for a particular interaction.
The principle can be expressed simply:
A person should be able to prove what is necessary without revealing everything else.
Identity Is More Than a Name
Identity is often discussed as if it were one permanent record containing the complete truth about a person. In reality, digital identity consists of several related but distinct elements.
An identifier distinguishes one person, organization or device from another within a particular system. An attribute describes something about that subject, such as an age, nationality or professional qualification. A credential contains one or more claims made by an issuer. An authenticator helps demonstrate that the person attempting to use an account or credential is its legitimate controller. An authorization determines what that person may do.
These elements should not be carelessly merged.
Proving that a person is old enough to enter a venue does not necessarily require revealing a full legal name, home address and exact date of birth. Proving that someone possesses a valid professional qualification does not always require disclosing an employment history. Authenticating control of an account does not require every service to possess a copy of a passport.
When systems demand complete identity records for limited purposes, they transform ordinary verification into excessive collection.
The Centralized Identity Model
In a centralized identity system, one organization creates an account, stores the associated information and decides when the identity will be recognized. The user receives access but does not control the underlying record.
This model can be convenient. One institution performs enrollment, maintains security and resolves disputes. Yet it also creates a central point of surveillance, failure and exclusion.
The institution can observe when and where the identity is used. A breach can expose information belonging to millions of people. An administrative error can deny access to services. A change in policy can make an identity valid one day and unusable the next.
The individual may be allowed to use the identity but cannot necessarily move it, inspect all information associated with it or continue using it after leaving the provider.
The identity belongs operationally to the database.
Federated Identity and the Convenient Gatekeeper
Federated identity improves convenience by allowing a person to use an account from one provider to enter services operated by others. “Sign in with” systems reduce the need to create and secure a separate password for every website.
Federation can improve usability, but it may enlarge the power of the identity provider. The provider can become an intermediary between the person and numerous independent services. It may learn where the identity is presented, while the user becomes dependent upon the continued existence and cooperation of one account.
If the account is suspended, compromised or withdrawn, the consequences can spread across every connected service. A credential intended to simplify access can become a universal point of revocation.
This is not self-sovereignty. It is centralized identity made portable only with the gatekeeper’s continuing permission.
What Self-Sovereign Identity Means
Self-sovereign identity, commonly abbreviated as SSI, is an approach in which the individual occupies the central position in the administration and presentation of his or her digital identity.
The phrase does not mean that a person may invent any claim and compel others to accept it. A university still determines whether it issued a degree. A government still determines whether it issued a passport. A professional body still determines whether a licence remains valid.
Self-sovereignty concerns the architecture connecting these claims to the individual.
The issuer creates and cryptographically signs a credential. The holder receives and stores it. When evidence is required, the holder presents an appropriate proof to a verifier. The verifier checks the issuer’s signature and the credential’s status without necessarily contacting the issuer for every interaction.
Authority over the truth of a claim may remain with the legitimate issuer. Authority over when, where and how that claim is presented should remain as far as possible with the individual.
Christopher Allen’s 2016 essay, The Path to Self-Sovereign Identity, described principles including control, access, transparency, persistence, portability, interoperability, consent, minimal disclosure and protection. These principles define SSI more meaningfully than the use of any single database or blockchain.
The Issuer–Holder–Verifier Model
A self-sovereign identity system commonly involves three principal roles:
- The issuer makes one or more claims and signs a credential. A university might issue a degree credential, or a government might issue a residency credential.
- The holder receives the credential and stores it in a digital wallet or another personally controlled system.
- The verifier requests evidence and checks whether the presented proof is authentic and acceptable for a particular purpose.
A person may occupy different roles in different relationships. An employer can verify an applicant’s qualification and later issue an employment credential. An organization can hold credentials concerning its registration while issuing credentials to its authorized representatives.
The architecture separates the creation of a trusted claim from its later presentation. This can prevent the issuer from automatically learning every occasion on which the credential is used.
It also reduces the verifier’s need to maintain an extensive copy of the original document. The verifier may receive sufficient cryptographic evidence without becoming another permanent warehouse of personal information.
Verifiable Credentials
A verifiable credential is a digital representation of claims whose issuer and integrity can be checked cryptographically.
The W3C Verifiable Credentials Data Model 1.0, published as a Recommendation in November 2019, provides a standard model for expressing such credentials on the Web.
A credential may state that a person holds a qualification, possesses a licence, belongs to an organization or satisfies a defined condition. A digital signature enables a verifier to detect whether the credential has been altered and to check whether it came from the claimed issuer.
The credential does not become true merely because it is cryptographically signed. Cryptography proves the relationship between the credential and its issuer; the verifier must still decide whether the issuer is competent and trustworthy for the claim being made.
A university’s signature may carry authority concerning a degree but not a medical diagnosis. A government agency may establish citizenship but not personal character. Trust should remain contextual rather than becoming a universal ranking of the individual.
Decentralized Identifiers
Many SSI systems use decentralized identifiers, or DIDs. A DID is an identifier designed to be created and controlled without requiring it to be permanently assigned by one centralized identity provider.
A DID can be associated with cryptographic material and service information through a DID document. The controller can use private keys to authenticate actions, establish secure relationships or receive credentials.
As of July 2021, the W3C Decentralized Identifiers specification is a Candidate Recommendation rather than a finalized W3C Recommendation. Its development nevertheless reflects an important architectural shift: an identifier need not always depend upon an account granted by a dominant platform.
A DID also does not have to reveal a person’s civil identity. Different identifiers can be used for different relationships. A person may establish one identifier with a university, another with an employer and another with a medical provider.
This separation reduces correlation. If the same permanent identifier is used everywhere, a formally decentralized system can still make a person’s entire life easy to connect and observe.
Selective Disclosure
Traditional identity verification often works by displaying an entire document. A person presents a passport to prove nationality, even though the passport also reveals a full name, photograph, document number and date of birth. A driving licence may be shown to establish age while unnecessarily exposing a residential address.
Selective disclosure allows the holder to reveal only the credential attributes required for the transaction.
A person might disclose:
- that he or she is over a required age without revealing an exact date of birth;
- that a professional licence is valid without revealing its identifying number;
- that residency exists within a jurisdiction without revealing a home address;
- that an income exceeds a required threshold without revealing the precise amount;
- that a credential has not expired or been revoked without presenting every field it contains.
This changes the governing assumption of identity. Instead of asking how much information a person can be persuaded to surrender, the system asks what minimum proof is actually necessary.
The distinction is central to Privacy Is Sovereignty. Privacy is not the absence of every interaction. It is the capacity to establish appropriate boundaries around personal information.
Zero-Knowledge Proofs
Zero-knowledge proofs extend the principle of selective disclosure. In general terms, they allow one party to demonstrate that a statement is true without revealing the underlying secret or all of the information used to establish it.
Instead of disclosing a date of birth, a person may prove that the date contained within a valid credential places him or her above a required age. Instead of disclosing an account balance, a person may prove that it exceeds a defined threshold.
This does not mean that the verifier learns literally nothing. The verifier learns that the specified statement has been proven under the system’s rules. The privacy advantage is that unrelated information need not accompany that proof.
Research into zero-knowledge proofs and anonymous credentials predates contemporary blockchain identity systems by decades. Work by Shafi Goldwasser, Silvio Micali and Charles Rackoff established the theoretical foundations of zero-knowledge proofs, while David Chaum and later Jan Camenisch and Anna Lysyanskaya developed influential approaches to privacy-preserving credentials.
SSI should therefore not be understood merely as a product of blockchain. It belongs to a much broader history of public-key cryptography, privacy-enhancing technology and user-controlled identity.
Self-Sovereign Identity Does Not Require a Blockchain
Blockchains and distributed ledgers can support parts of an SSI architecture. They may provide a shared method for discovering public keys, registering decentralized identifiers, publishing credential schemas or checking revocation information without relying upon one private database.
But personal credentials should not simply be written to a public blockchain.
A replicated ledger is designed to preserve and distribute information. Personal data may require confidentiality, correction, contextual use and eventual deletion. Encryption does not eliminate every risk because encrypted information may remain permanently available for future analysis, correlation or attacks against its cryptographic protection.
A blockchain can also introduce new centralizations through governance, validator concentration, software dependencies, wallet providers or control over the protocol’s development.
The correct principle is architectural minimalism. Use a distributed ledger only where distribution serves a necessary function. Keep personal credentials under the holder’s control. Place no personal information on a permanent public record when a less revealing mechanism can achieve the same purpose.
Decentralization is a check on power, not a commandment that every piece of data must be distributed everywhere.
The Universal Identifier Problem
A universal identity number appears efficient because it allows records from different services to be connected. That efficiency is precisely what makes it dangerous.
When the same identifier is presented to employers, banks, hospitals, retailers, platforms and government agencies, information collected in separate contexts can be combined into a unified profile. The identifier becomes a permanent index through which the person can be reconstructed.
Even if each institution collects only a limited amount of data, the common identifier allows those fragments to be assembled. Identity becomes the bridge through which separated databases acquire collective power.
Pairwise or context-specific identifiers offer an alternative. A person can maintain distinct relationships without presenting the same correlatable identifier everywhere. A verifier receives sufficient assurance for its purpose but not a universal key to the person’s wider life.
This is one reason why metadata matters. Privacy can be lost through the structure of relationships even when the underlying credential contents remain encrypted.
The Issuer Should Not Follow the Credential
A physical university certificate can be presented without notifying the university. A passport can be inspected without the issuing government automatically receiving a real-time record of every inspection. Digital credentials should preserve this separation whenever possible.
If a verifier must contact the issuer during every presentation, the issuer can construct a history of where and when the credential is used. A qualification intended to establish trust becomes a tracking mechanism.
Cryptographic verification can reduce this dependency. The verifier can check a signature using previously obtained public information rather than requesting repeated confirmation from the issuer.
Revocation creates a more difficult problem. Verifiers need to determine whether a credential remains valid, but a status check can reveal that a particular credential is being presented. Privacy-preserving revocation mechanisms should therefore avoid allowing issuers or registries to follow individual credentials across every use.
Identity Wallets and the Question of Custody
In an SSI system, credentials and cryptographic keys may be stored within an identity wallet. The wallet could operate on a phone, computer, dedicated device or trusted service.
A wallet should not be called self-sovereign merely because the interface gives the user a choice of credentials. The deeper question is who controls the keys, data and recovery process.
If a platform can silently access credentials, prevent export or revoke the wallet, the individual remains dependent upon that platform. If the wallet uses proprietary formats that cannot be transferred elsewhere, apparent control becomes lock-in.
Meaningful custody requires portability, interoperable standards and the ability to change providers without rebuilding one’s identity from the beginning.
At the same time, absolute dependence upon one private key creates a different vulnerability. People lose devices, forget secrets, become incapacitated or die. A workable identity system must support recovery without allowing the recovery authority to become a hidden master key.
Recovery might involve multiple devices, trusted guardians, threshold cryptography or reissuance by credential issuers. No method is perfect. The objective is to distribute recovery power so that neither a single provider nor a single accident can permanently dispossess the individual.
Biometrics Are Not Private Keys
Biometrics can help connect a credential to its legitimate holder, but they should not be mistaken for secret cryptographic keys.
A person can replace a compromised password or rotate a private key. A fingerprint, face or iris cannot be replaced so easily. Biometric characteristics are exposed through ordinary life and may be copied, inferred or captured without meaningful consent.
Centralized biometric databases create particularly serious risks because a breach can expose identifiers that remain attached to people for life. The consequences extend beyond the system in which the information was originally collected.
Biometric processing should therefore be limited, locally performed where possible and separated from unnecessary identity records. A biometric may unlock a device without being transmitted to every verifier. The system should disclose a cryptographic proof, not distribute the person’s body as a reusable credential.
Consent Must Be Specific and Understandable
An SSI wallet may ask the holder to approve the presentation of information. This interface is useful, but clicking “agree” does not automatically establish meaningful consent.
A request may be coercive if refusing it means losing access to employment, healthcare, banking or an essential public service. It may be misleading if the verifier requests more information than its stated purpose requires. It may be incomprehensible if the consequences are hidden behind technical language.
Meaningful consent requires a clear request, a defined purpose and a genuine opportunity to refuse unnecessary disclosure. The wallet should identify which attributes will be shared, with whom, for what purpose and for how long.
The system should also help the person distinguish between proving a fact and transferring the underlying data. A verifier that needs to know whether an age requirement is satisfied should not quietly receive permission to retain the complete credential.
My illustration “The Broken Mirror of Data Extraction” – work-in-progress. This art represents: Verification does not require mass collection, profiling or permanent surveillance.
Self-Sovereignty Is Not Isolation
Identity is relational. Other people and institutions make claims about us, and some of those claims have legitimate social importance. Self-sovereignty cannot mean that every person unilaterally defines every fact that others must accept.
A digitally sovereign individual may still rely upon governments, universities, employers, professional bodies and communities to issue credible attestations. Verifiers remain free to determine what evidence is appropriate for a legitimate purpose.
The objective is not to eliminate institutions. As explained in Against Digital Absolutism, legitimate authority may exist when it is necessary, limited, transparent, proportionate, contestable and subject to meaningful review or exit.
SSI redistributes the relationships among institutions. No single identity provider should automatically become the observer and gatekeeper of every interaction. Issuers attest, holders choose what to present and verifiers request only what they can justify.
The Risks of Self-Sovereign Identity
The language of self-sovereignty should not conceal unresolved dangers.
Credential formats may permit excessive disclosure. Wallet applications may collect telemetry. Repeated identifiers may allow correlation. Revocation mechanisms may reveal where credentials are used. Poor interfaces may cause people to approve requests they do not understand. Lost keys may deny access, while weak recovery systems may allow theft.
Issuers may also become concentrated. If one company’s credential is accepted everywhere while alternatives are excluded, the system recreates centralized identity at the trust layer. A technically decentralized network can remain socially dependent upon a small number of authorities.
Verifiers may demand stronger credentials than their purposes justify. The ability to request a credential can gradually become a requirement to present one. Voluntary identity infrastructure can evolve into compulsory identification.
There is also a danger of exclusion. People without compatible devices, stable connectivity, technical knowledge or recognized source documents must not be erased from social participation. A system cannot be sovereign if convenience for the technically equipped becomes abandonment of everyone else.
Ten Cypherpunkist Requirements for Identity Sovereignty
A self-sovereign identity system should be evaluated according to the power relationships it creates. From a Cypherpunkist perspective, it should satisfy at least ten requirements:
- Individual custody: The person should be able to hold credentials and control the keys used to present them.
- Selective disclosure: The system should reveal only the attributes necessary for a defined transaction.
- Unlinkability: Separate interactions should not become automatically correlatable through one universal identifier or proof.
- Data minimization: Issuers and verifiers should avoid collecting or retaining information merely because collection is technically possible.
- Portability: Credentials should be transferable among compatible wallets without requiring the original provider’s continuing permission.
- Open architecture: Standards, protocols and significant security assumptions should be available for independent examination.
- Plurality of trust: No unnecessary single issuer, registry or platform should control participation across every domain.
- Secure recovery: Loss of one device or key should not permanently destroy a person’s ability to establish identity.
- Contestability: Incorrect credentials, revocations and exclusions should be subject to understandable correction and appeal.
- Meaningful exit: A person should be able to change wallets, providers or technical networks without losing identity, credentials and social participation.
These requirements connect self-sovereign identity to the wider philosophy of Digital Sovereignty. Identity sovereignty does not require independence from every institution. It requires that cooperation with institutions does not become permanent technological subordination.
Applying the Cypherpunkist Test
Before describing an identity system as self-sovereign, we should ask:
- Who creates the identifier?
- Who holds the credentials?
- Who controls the cryptographic keys?
- Can the holder disclose only what is necessary?
- Can separate presentations be linked?
- Does the issuer learn whenever a credential is used?
- Is personal information written to a permanent ledger?
- Can the wallet export credentials to another provider?
- Who can revoke the credential, and on what grounds?
- Can an erroneous revocation be challenged?
- What happens when the device or key is lost?
- Can a person refuse unnecessary identification without being excluded from ordinary life?
If the provider holds the keys, follows every presentation, restricts portability and can revoke the identity without review, then the system is not meaningfully self-sovereign. It is a centralized identity service using decentralized terminology.
Conclusion: Proof Without Surrender
Digital identity can expand access, reduce fraud and allow trusted credentials to move across institutional boundaries. It can spare individuals from repeatedly submitting vulnerable copies of passports, licences and certificates.
But digital identity can also become the connective tissue of surveillance. Once identity, communication, finance, healthcare and public services share one permanent identifier, control over that identifier becomes control over digital existence.
Self-sovereign identity offers a different direction. It separates credentials from centralized accounts, verification from indiscriminate disclosure and legitimate institutional claims from permanent institutional observation.
Its central achievement is not that it places identity on a blockchain. Its achievement is that it can place the individual between the issuer and the verifier, possessing the credential and determining how it is presented.
The future of identity should not require a person to choose between remaining unknown and surrendering everything. Cryptography makes a third possibility available.
Reveal the minimum. Prove the necessary. Preserve the person.
Privacy is sovereignty.
Cryptography is applied freedom.
Decentralization is a check on power.
Code is political architecture.
Digital sovereignty belongs to the individual.
References
- Allen, Christopher. “The Path to Self-Sovereign Identity.” 25 April 2016.
- Camenisch, Jan and Anna Lysyanskaya. “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation.” Advances in Cryptology—EUROCRYPT 2001, 2001.
- Chaum, David. “Security Without Identification: Transaction Systems to Make Big Brother Obsolete.” Communications of the ACM, Volume 28, Issue 10, 1985.
- European Union. “Regulation (EU) 2016/679: General Data Protection Regulation.” 2016.
- Goldwasser, Shafi, Silvio Micali and Charles Rackoff. “The Knowledge Complexity of Interactive Proof Systems.” SIAM Journal on Computing, Volume 18, Issue 1, 1989.
- Grassi, Paul A., Michael E. Garcia and James L. Fenton. “NIST Special Publication 800-63-3: Digital Identity Guidelines.” National Institute of Standards and Technology, June 2017, including updates through March 2020.
- Sim, Herbert R. “Privacy Is Sovereignty.” 9 March 2013.
- Sim, Herbert R. “Metadata Is Power.” 25 July 2013.
- Sim, Herbert R. “Digital Sovereignty: A Formal Definition.” 10 December 2013.
- Sim, Herbert R. “The Architecture of Power: A Cypherpunkist Theory of Technology.” 22 June 2015.
- Sim, Herbert R. “The Right to Exit in Digital Civilization.” 1 November 2017.
- Sim, Herbert R. “The Cypherpunkist Test: Who Does the Technology Empower?” 10 October 2018.
- Sim, Herbert R. “Against Digital Absolutism: Why Cypherpunkism Is Not Anti-State or Anti-Corporation.” 22 August 2019.
- World Wide Web Consortium. “Verifiable Credentials Data Model 1.0.” W3C Recommendation, 19 November 2019.
- World Wide Web Consortium. “Decentralized Identifiers (DIDs) v1.0.” W3C Candidate Recommendation, 18 March 2021.