PaperlayerView exact revision on arXiv

Source-linked AI summary

A Survey on Decentralized Identifiers and Verifiable Credentials

Carlo Mazzocca, Abbas Acar, Selcuk Uluagac, Rebecca Montanari, Paolo Bellavista, Mauro Conti

arXiv:2402.02455v2cs.CRcs.CY

TL;DR

Existing surveys often focus on DIDs and VCs within SSI, despite their use across a wider range of applications. This survey reviews their foundations, threats, implementations, applications, and global initiatives; its review finds uses across varied fields, with SSI remaining integral in most domains.

  • Problem

    Existing surveys primarily examine DIDs and VCs in SSI, leaving their use across other application domains less comprehensively surveyed.

    Source: B. Contributions · p. 3

  • Method

    The paper surveys DID and VC foundations, threats and mitigations, available implementations, application domains, and global initiatives and regulations.

    Source: B. Contributions · p. 3

  • Results

    The review finds DIDs and VCs used across varied fields, although they serve as integral SSI components in most domains.

    Source: F. Lessons Learned · p. 21

  • Takeaways & Limitations

    DIDs and VCs can serve scenarios requiring decentralized verification or immutability, including applications where human involvement is not primary.

    Source: F. Lessons Learned · p. 21

    Only a limited number of entities are currently ready to issue VCs, and traditional credential issuers may initially be unwilling to issue signed variants.

    Source: D. Integration · p. 25

Abstract

from arXiv · show

Digital identity has always been considered the keystone for implementing secure and trustworthy communications among parties. The ever-evolving digital landscape has gone through many technological transformations that have also affected the way entities are digitally identified. During this digital evolution, identity management has shifted from centralized to decentralized approaches. The last era of this journey is represented by the emerging Self-Sovereign Identity (SSI), which gives users full control over their data. SSI leverages decentralized identifiers (DIDs) and verifiable credentials (VCs), which have been recently standardized by the World Wide Web Community (W3C). These technologies have the potential to build more secure and decentralized digital identity systems, remarkably contributing to strengthening the security of communications that typically involve many distributed participants. It is worth noting that the scope of DIDs and VCs extends beyond individuals, encompassing a broad range of entities including cloud, edge, and Internet of Things (IoT) resources. However, due to their novelty, existing literature lacks a comprehensive survey on how DIDs and VCs have been employed in different application domains, which go beyond SSI systems. This paper provides readers with a comprehensive overview of such technologies from different perspectives. Specifically, we first provide the background on DIDs and VCs. Then, we analyze available implementations and offer an in-depth review of how these technologies have been employed across different use-case scenarios. Furthermore, we examine recent regulations and initiatives that have been emerging worldwide. Finally, we present some challenges that hinder their adoption in real-world scenarios and future research directions.

I. INTRODUCTION

This survey frames DIDs and VCs as tools for decentralized digital identity and reviews their use beyond SSI. It contrasts its broader coverage with prior surveys and identifies contributions spanning threats, implementations, applications, initiatives, and future challenges.

I. INTRODUCTION

  • Centralized identity systems can expose personal data through breaches and create single points of failure; federated systems still limit user control and depend on identity-provider trust.Growing use of online services and connected devices increases the relevance of digital identities beyond individuals.Source: §I · p. 1
  • DIDs and VCs support decentralized identity: DIDs identify entities, while VCs carry claims that external parties can verify without contacting issuers.The survey situates these technologies within SSI, where users control their information and can share trusted credentials without an intermediary.Source: §I · pp. 1–2

A. Comparison with Related Surveys

  • Most existing surveys focus on SSI or narrower subtopics, while this survey reviews applications such as smart transportation and industry.It also compares related work on threats, implementations, regulations, and future directions.Source: A. Comparison with Related Surveys · pp. 2–3

B. Contributions

  • The survey identifies threats to DIDs and VCs and proposes potential mitigation strategies.Related surveys often overlook these threats and mitigations, according to the paper.Source: B. Contributions · p. 3, A. Comparison with Related Surveys · p. 3
  • The survey compares major commercial implementations to help developers make choices suited to their needs.Its comparison aims to offer practical guidance beyond feature reporting.Source: B. Contributions · p. 3, A. Comparison with Related Surveys · p. 3
  • The survey reviews research applying DIDs and VCs across diverse domains beyond SSI systems.It also examines global initiatives, regulations, and projects related to their adoption.Source: B. Contributions · p. 3
  • The survey identifies DID- and VC-specific challenges and underexplored areas, then outlines future research directions.It presents this analysis alongside a review of implementations, applications, and global initiatives.Source: B. Contributions · p. 3

C. Organization

Digital identity has evolved from centralized and federated models toward user-centric and self-sovereign approaches. The survey outlines this history and organizes its remaining sections around identity fundamentals, security, implementations, applications, global initiatives, and future challenges.

C. Organization

  • The survey is organized from digital-identity foundations through security, implementations, applications, global initiatives, challenges, and future research.It concludes with a summary of key insights.Source: C. Organization · p. 4

II. FUNDAMENTALS OF DIGITAL IDENTITY

  • The fundamentals section introduces the development of digital identities, focusing on standards and technologies that enable SSI systems.It frames this development as a shift from centralized toward decentralized identity models.Source: §II · p. 4, A. Digital Identity Evolution · p. 4

A. Digital Identity Evolution

  • Centralized identity relies on service-specific usernames and passwords, which can expose users to attacks and leave them with fragmented identities.Centralized models also create a single point of failure and require service providers to invest in protecting user data.Source: A. Digital Identity Evolution · pp. 4–5
  • Federated identity lets users access multiple services with one identity, but still depends on trusted identity providers and can complicate mutual recognition at scale.Users retain limited control over their data.Source: A. Digital Identity Evolution · p. 5
  • User-centric identity gives individuals autonomy over sharing, while SSI places users at the core and relies on decentralized infrastructure, DIDs, and VCs.In SSI, users control a DID linked to a key pair; VCs let others verify claims without contacting the issuer.Source: A. Digital Identity Evolution · p. 5

B. Decentralized Identifiers (DIDs)

DIDs are standardized identifiers that resolve to documents containing information used to identify subjects and verify control. The section also distinguishes DID types and describes DID-based protocols for secure communication and mutual authentication.

Architecture

  • DIDs were formalized as a W3C Recommendation after collaborative work from 2017 to 2019.A DID identifies a subject, which may be human or non-human, and includes a method-specific identifier.Source: B. Decentralized Identifiers (DIDs) · pp. 5–6
  • Each DID resolves to a machine-readable DID Document, and control can be proved using the private key corresponding to its public key.A DID Controller is authorized to modify the document; a universal resolver supports multiple DID systems.Source: B. Decentralized Identifiers (DIDs) · p. 6

Types of DIDs

  • Anywise DIDs support unspecified numbers of parties, pairwise DIDs limit visibility to two parties, and N-wise DIDs are known to exactly N parties.Pairwise DIDs use a distinct identifier for each relationship to reduce correlation risk.Source: B. Decentralized Identifiers (DIDs) · p. 6

Communication Protocols

  • DID-based communication protocols use DIDs for private, secure communication and mutual authentication between SSI entities.DID Auth uses a customizable challenge-response cycle for an identity owner to prove control of a DID to a service provider.Source: B. Decentralized Identifiers (DIDs) · p. 6

C. Verifiable Credentials (VCs)

The survey describes VCs as portable, cryptographically verifiable claims and VPs as the holder’s means of presenting them. It also reviews registry functions and threats to credential security.

C. Verifiable Credentials (VCs)

  • VCs are interoperable, tamper-proof structures for cryptographically verifiable claims, while VPs specify how holders sign and present credentials.Holders can selectively reveal a subset of VC information, including through SD-JWT, which uses salted-claim digests.Source: C. Verifiable Credentials (VCs) · pp. 6–7

D. Verifiable Data Registry (VDR)

  • A Verifiable Data Registry provides information needed to create, manage, resolve, and verify DIDs and VCs, including DID Documents and public keys.The W3C standards do not specify how a VDR must be implemented; proposed approaches include DLTs and Information-Centric Networking.Source: D. Verifiable Data Registry (VDR) · pp. 7–8

III. THREATS & MITIGATION STRATEGIES

  • The threats section frames DID and VC security as requiring mitigation despite their security and privacy benefits.The survey introduces threats and potential strategies for mitigating them.Source: §III · p. 8

A. Key and Credential Compromise

  • DID or credential key theft can enable impersonation; suggested mitigations include key rotation, MFA, secure hardware, and trusted third-party recovery.MFA can require the same credential from multiple devices so compromising one wallet alone is insufficient.Source: A. Key and Credential Compromise · p. 8
  • Binding a credential to its holder’s DID and requiring proof of the holder’s private key addresses credential theft, while issuer signatures and trusted-issuer checks address forgery and unauthorized issuance.The issuer identifier and a register of trusted issuers and authorized claims help verifiers assess who may certify the claims.Source: A. Key and Credential Compromise · p. 8

B. Credential Validity

Credential validity can change over time, while privacy and communication threats require controls on disclosure, linkage, and message integrity. The paper also introduces implementations for developers.

B. Credential Validity

  • A credential’s validity may change through expiration or loss of privileges, so verifiers must check validity before acceptance.Issuers can specify a validity period; revocation lists, including Revocation List 2020, can represent revoked credentials with bits and may be compressed with ZLIB.Source: B. Credential Validity · p. 8, Table IV · p. 9

C. Privacy

  • Selective disclosure limits revealed claims, while pairwise DIDs can reduce—but not eliminate—linkage across presentations.Linked unlinkability can support recognizing repeat presentations while reducing correlation across providers; claims intended only for verifiers can also be encrypted for authorized service providers.Source: C. Privacy · pp. 8–9

D. Man-in-the-Middle

  • End-to-end encryption protects communications, issuer signatures expose VC modification, and a verifier’s nonce or timestamp can mitigate VP replay.A valid VP must include the verifier’s challenge nonce.Source: D. Man-in-the-Middle · p. 9

IV. IMPLEMENTATIONS

  • The survey compares available DID and VC implementations to guide developers choosing solutions for specific use cases.It notes that implementations are still at an early stage and relatively few are available.Source: §IV · p. 9

A. DIDKit

The survey compares four DID and VC implementation options, describing their capabilities and constraints across platforms and use cases.

A. DIDKit

  • DIDKit provides cross-platform DID and VC functionality through a Rust core, with language bindings that may add complexity compared with direct Rust use.It supports selective disclosure through SD-JWT, W3C-compliant VC signing and verification, and DID handling and generation.Source: A. DIDKit · pp. 9–10

B. IOTA Identity Framework

  • IOTA Identity supports DLT-agnostic use as well as an IOTA-specific method, with Rust and Node.js interfaces and selective disclosure options.Its IOTA ledger is described as feeless, accessible without a cryptocurrency token, and compatible with other DLT features such as payments and smart contracts.Source: B. IOTA Identity Framework · p. 10

C. Hyperledger Aries

  • Hyperledger Aries offers tools for decentralized identity across protocols, credential types, ledgers, and registries, but its architectural complexity and steep learning curve can hinder process-heavy testing or certification.The survey describes Python and .NET agents and a lightweight static agent without persistent storage.Source: C. Hyperledger Aries · p. 10

D. Microsoft Entra Wallet Library

  • Microsoft Entra Wallet Library supports mobile DID and VC issuance and presentation, using distinct DIDs per relying-party interaction to protect privacy.The library has limitations: developer resources require Microsoft 365 Developer Program registration and personal information, and its mobile focus limits broader use cases.Source: D. Microsoft Entra Wallet Library · pp. 10–11

E. Veramo

The survey reviews Veramo and implementation trade-offs, then surveys DID and VC applications, especially across smart transportation use cases.

E. Veramo

  • Veramo is a modular JavaScript framework whose plugin-driven agent supports identifier and credential operations across Node.js, browsers, and React Native.Its selective-disclosure plugin is still in beta.Source: E. Veramo · p. 11

F. Lessons Learned

  • Implementation choice depends on developer needs: DIDKit supports multiple languages, Veramo is JavaScript-only, and Aries can pose a learning curve.The survey also identifies IOTA Identity as promising for human and IoT deployments because its ledger supports a VDR without configuring another DLT.Source: F. Lessons Learned · p. 11

V. APPLICATIONS

  • The application review selects domains based on field maturity, potential real-world impact, and the availability of a substantial research base.It spans fields from smart transportation to smart healthcare.Source: §V · p. 11

A. Smart Transportation

  • In vehicular communications, DIDs and VCs are used for authentication and decentralized trust, including DID-based vehicle identities and VIN-linked credentials.D-V2X replaces a traditional VPKI with a decentralized vehicular PKI; privacy approaches include multiple DIDs and zero-knowledge proofs.Source: A. Smart Transportation · pp. 12–13
  • A reputation-transfer mechanism changes blockchain addresses while retaining reputation, using a secret-derived address chain, a ZKP, and a Merkle Tree.The old address is removed from the reputation mapping after the proof is checked and the reputation is released to the new address owner.Source: A. Smart Transportation · p. 13
  • DIDs and VCs support transportation services including route planning, road-condition updates, port truck authorization, and temporary vehicle access.In BDRA, vehicles register DIDs with an RSU, and RSUs collaborate to issue service-access VCs.Source: A. Smart Transportation · p. 13
  • Transportation applications include vehicle provenance chains, location attestations, and DID-bound credentials for secure V2X communication and key management.The provenance example links signed data versions so data points remain traceable through their lifecycle.Source: A. Smart Transportation · p. 13
  • For EV charging, DIDs and VCs support energy trading integrated with ISO 15118-20 and anonymous verification using pseudonyms and zero-knowledge proofs.Charging participants authenticate each other by verifying the other party’s VC without revealing additional user information.Source: A. Smart Transportation · pp. 13–14

B. Smart Healthcare

The section surveys healthcare uses of DIDs and VCs spanning health certification, coordinated care, data access, and connected devices. These systems use credentials and decentralized identity to support privacy-aware verification and data sharing.

Healthcare Services

  • DID- and VC-based immunity-passport apps can provide tamper-proof, privacy-preserving test and vaccination certifications that verifiers use to determine eligibility for social activities.Credentials issued by trusted entities are stored in citizen hardware or digital wallets after verification and testing.Source: B. Smart Healthcare · p. 14
  • RDIS uses DIDs tied to patient profiles and signed attestations, with smart contracts verifying attestations and audit logs recording only the DID and a timestamp.The system supports communication among specialists and delegated representation for patients who are minors or otherwise limited.Source: B. Smart Healthcare · p. 15

Healthcare Data Management

  • DSMAC uses DIDs for authentication and VC roles for ordinary access decisions, switching to context-sensitive ABAC in emergencies; patients can also issue VCs expressing EHR-sharing consent.The patient creates access policies and embeds them in a DID Document shared on the blockchain.Source: B. Smart Healthcare · p. 15
  • Federated learning lets healthcare providers train models collaboratively without sharing raw data, while model weights may be further processed to help prevent inference attacks.The section notes that a trusted authority such as a hospital can address participants’ lack of trust.Source: B. Smart Healthcare · p. 15

Healthcare Services

  • For IoMT monitoring, devices register with DIDs and VCs that generate authentication tokens for secure data transmission and identification in interactions with healthcare providers.The use case concerns lightweight wireless sensors that remotely monitor patients.Source: B. Smart Healthcare · p. 15

Healthcare Data Management

  • DIDs and VCs can support personal-data trading by letting owners authenticate identity and issue buyers permission credentials, with ABAC regulating access through user-defined attributes.Those attributes may include sensitive health information.Source: B. Smart Healthcare · p. 15

C. Industry

The section reviews DID and VC applications across manufacturing, energy, and supply chains. Examples use credentials for device identity, controlled participation, certification, and attribute verification.

Smart Manufacturing

  • DIDs and VCs address smart-manufacturing concerns including centralized-system limitations and third-party trust by supporting device ownership verification and digital-twin data integrity.Smartphones can receive unique DIDs linked to IMEI attributes, while the SIGNED framework uses encrypted VC claims for verifiable digital-twin attributes.Source: C. Industry · pp. 15–16
  • DIDs and VCs support firmware-update authorization: devices request software through a VC and check publisher authorization, while a DLT supervisor can log and monitor trusted devices.The Gnomon framework registers device DIDs with an identity hub before delivery; a DID Document can specify a secure download endpoint.Source: C. Industry · p. 16
  • Credential-controlled federated learning supports industrial collaboration: TruFLaaS can revoke participation credentials when submitted model quality falls below a threshold, while FlowChain identifies participants and regulates IIoT participation.TruFLaaS supports shared tasks such as predicting machine breakdowns.Source: C. Industry · p. 16

Energy Distribution

  • In energy systems, user credentials can document supplied or under-scheduled energy in blockchain-stored credit histories, while DIDs support privacy-preserving credit assessment and microgrid access.Flex registers stakeholders through DIDs and lets authorized parties validate equipment attributes such as an inverter’s capacity or model number.Source: C. Industry · p. 16
  • DID-based ABAC for smart grids replaces traditional attributes with VCs attesting to attribute validity without disclosing sensitive information, and pairwise DIDs tailor identifiers to interactions.Source: C. Industry · p. 17

Smart Supply Chain

  • Supply-chain certifications can be issued as VCs, stored off-chain on IPFS, and retrieved through blockchain-recorded hashes, supporting integrity and authenticity checks.DIDs identify supply-chain entities such as devices and personnel; the broader approach is presented as supporting transparency, traceability, interoperability, and logistics.Source: C. Industry · p. 17
  • Verifiable Supply Chain Credentials extend the VC data model to verify asset alterations across blockchains, while selective disclosure lets manufacturers share certified carbon-footprint information without supplier trade secrets.Other cited applications use VCs for software-bill-of-materials authenticity and for shipping access and proof of item withdrawal.Source: C. Industry · p. 17

D. Other Smart Services

This section surveys DID and VC applications in smart cities, tourism, education, homes, reputation systems, and agriculture. The examples range from credential-based access and verification to data-backed agricultural payouts.

Smart Cities

  • Smart-city implementation remains early, with no city yet achieving full digitalization, although combining DIDs and VCs with other technologies may enhance services.Source: D. Other Smart Services · p. 17

Smart Tourism

  • Tourism applications use DIDs and VCs to authenticate authorized companies and support paperless travel, including visa credentials presented for identity checks in services.IPFS can store tourism organizations’ DID Documents and VCs; the section also describes Singapore airport’s passport-free biometric clearance starting in 2024.Source: D. Other Smart Services · p. 18

Smart Education

  • Digital education passports address slow, costly, and easily falsified paper-certificate validation, while blockchain records of credential steps can establish verifiable achievement dependencies.Consortium smart contracts support decentralized verification; ELMO2EDS converts EMREX credentials into EBSI diplomas to enable user authentication.Source: D. Other Smart Services · pp. 18–19

Smart Home

  • For smart-home access, an OAuth server can process a technician’s DID and company-issued VC into an access token when devices lack capacity to verify credentials themselves.Devices with sufficient resources may verify VCs directly, including credentials describing user capabilities over the device.Source: D. Other Smart Services · p. 19

Reputation-based Systems

  • In e-commerce reputation systems, sellers can issue feedback-token VCs after purchases so customer reviews and identity information are authentic and tamper-proof.Platforms may reward reviewers with discount tokens.Source: D. Other Smart Services · p. 19

Smart Agriculture

  • Agricultural IoT data sharing can combine DIDs, VCs, blockchain, smart contracts, and oracles, with device credentials grounded in blockchain source proof and payouts automated for qualifying farmers.Oracles bridge blockchain systems to external agricultural IoT data used in risk assessment.Source: D. Other Smart Services · p. 19

E. Identity Management

This section reviews identity and access-management applications of DIDs and VCs, from user and device identity systems to privacy-preserving credentials and cross-system verification. The examples include methods for credential recovery, selective disclosure, access control, and content or service discovery.

Users and Devices

  • CanDID ports identities and credentials from existing web services into trustworthy credentials without requiring users to create DID-compatible credentials, and it provides key recovery.Source: E. Identity Management · p. 19
  • BIdM uses blockchain-based key lookup and accumulators for membership proofs and cross-domain authentication, while separating master blockchain identities from offline shadow identities.SmartDID targets IoT environments and uses dual credentials, commitments, and zero-knowledge proofs to protect sensitive attributes and credential linkages.Source: E. Identity Management · pp. 19–20
  • SSIBAC maps VC claims encoded in verifiable presentations to XACML access policies, with permission validators binding presentations to attributes, roles, or other abstractions.Source: E. Identity Management · p. 20

Privacy Preservation

  • VC selective disclosure lets users present only needed claims, such as age or insurance coverage, while concealing unrelated information; HMACs can hide diagnostic-record claims for selective sharing.Source: E. Identity Management · p. 20
  • SSI frameworks can pair DIDs with FIDO authentication, linking a locally stored authenticator key pair to identity and VC ownership; a TEE can serve users without external authenticators.Source: E. Identity Management · p. 20

Services and Data

  • DID-based content naming can resolve changing IPFS content through DNSlink, which binds a DID to a CID and updates the DNS record when content changes.The published content item includes the DID document, proof, signed metadata, and content.Source: E. Identity Management · p. 20
  • Cross-chain contracts can retrieve and verify permitted claims from heterogeneous VC issuers in JointCloud, while DIDs also support peer-to-peer service discovery and named-data content advertisements.In named data networking, content owners use hierarchical DIDs as names and authorize publishers to advertise name prefixes to routers.Source: E. Identity Management · pp. 20–21

F. Lessons Learned

DIDs and VCs support SSI across diverse application domains, while worldwide regulations and initiatives reflect growing adoption. The survey highlights regional shifts toward user-controlled identity and efforts to build interoperable ecosystems.

F. Lessons Learned

  • Across domains, DIDs and VCs are used as integral components of SSI and support user control, selective sharing, and access to services including education and healthcare.Their use across platforms and applications is also associated in the survey with interoperability and improved user experience.Source: F. Lessons Learned · p. 21
  • Decentralized verification and immutability let DIDs and VCs serve applications beyond human-centered SSI, including vehicle-to-roadside-unit communication and device firmware updates.The survey connects implementation choices to application needs: it presents IOTA Identity for sensors and vehicles, and Microsoft Entra Wallet for people managing credentials in mobile apps.Source: F. Lessons Learned · p. 21

VI. REGULATIONS, PROJECTS & ORGANIZATIONS

  • The survey reviews worldwide initiatives emerging since 2019, involving governments, technology firms, research institutions, and standardization bodies.It presents these initiatives as evidence of growing global interest in DIDs and VCs.Source: §VI · p. 21

A. Europe

  • eIDAS 2.0 shifts the EU framework from federated identity toward SSI, while the EUDIW is designed to store and share DIDs and VCs for online and offline services.The EBSI is a collaborative EU platform supporting cross-border services, including educational credential verification.Source: A. Europe · pp. 21–22

B. North America

  • In North America, the U.S. DHS seeks privacy-preserving credentialing solutions, while Canada’s DIACC is developing a trust framework emphasizing interoperability.The Pan-Canadian Trust Framework sets rules, standards, and practices for digital identity and VCs across Canada.Source: B. North America · p. 22

C. South America

The survey describes DID and VC initiatives across South America, Asia, Africa, Australia, and New Zealand. Their reported applications range from rural finance and identity services to credential verification and cross-border use.

C. South America

  • Argentina’s DIDI project uses VCs documenting farmers’ sustainable practices to support climate risk scores presented to financial institutions for rural credit.The survey also describes regional efforts on digital wallets and cross-border trade, including Farmer Connect’s food-supply-chain traceability work.Source: C. South America · pp. 22–23

D. Asia

  • Asian initiatives include South Korean financial and public-service identity projects, China’s RealDID and WeIdentity, Hong Kong’s art-authentication platform, and Taiwan DID credentials.The survey notes that many existing Asian digital identity solutions remain centralized and do not specifically use DIDs and VCs.Source: D. Asia · p. 23

E. Africa

  • In Africa, VCs are used for credential verification, while DID- and VC-based initiatives also support financial identity verification and birth registration.Diwala’s credentials are used in more than 50 institutions across nine countries; Sierra Leone’s NDIP employs the Kiva Protocol for identity verification.Source: E. Africa · p. 23

F. Australia and Oceania

  • Australia’s initiatives focus on government-issued VCs in wallets, including education and employment, while New Zealand’s nursing service verifies credentials for internationally educated and licensed nurses.The survey also notes emerging cross-jurisdictional credential use in Australia and a legal foundation for an open accreditation scheme in New Zealand.Source: F. Australia and Oceania · p. 23

G. Lessons Learned

  • Across regions, the survey reports national SSI frameworks and identity-wallet initiatives in Europe, U.S. and Canadian government activity, and financial-inclusion projects in Argentina.It also describes adoption and planned initiatives in Asia, African work on financial inclusion and birth registration, and government-issued credentials in Australia and New Zealand.Source: G. Lessons Learned · p. 24

VII. CHALLENGES & FUTURE RESEARCH DIRECTIONS

The survey identifies challenges and future research directions for DIDs and VCs, including standardization, system scalability, and usability. Its discussion covers technical variation, growing ledger demands, and the complexity users face managing digital identities.

A. Standardization

  • DID methods vary in format, completeness, information density, and versioning, while domain-specific VC structures and non-normative security protocols complicate interoperability and compliance.The survey cites IoT’s lack of standardized device credential structures and the absence of consensus on cryptographic algorithms, key management, and lifecycle standards.Source: A. Standardization · pp. 24–25

B. Scalability

  • DID and VC verification can occur off-chain, but growing identity and document volumes may strain ledger storage, maintenance, query efficiency, and network capacity.The survey identifies indexing, caching, and sharding as retrieval approaches, alongside selective-disclosure protocols and more efficient revocation mechanisms.Source: B. Scalability · p. 25

C. Usability

  • Managing digital identities may burden average users, so wallets need intuitive sharing and consent flows, cross-platform interoperability, and automated credential-lifecycle support.The survey also identifies device synchronization and accommodation of region-specific legal requirements as usability considerations.Source: C. Usability · p. 25

D. Integration

The survey describes integration barriers and security concerns alongside the broader promise of DIDs and VCs. It concludes by reviewing threats, implementations, applications, and global initiatives, and identifying challenges and future research directions.

D. Integration

  • Only a limited number of entities are ready to issue VCs, and integrating DIDs and VCs requires existing systems to support decentralized issuance, verification, and revocation.The survey identifies interoperability frameworks, APIs, SDKs, and methods for building VCs from data in unmodified services as integration approaches.Source: D. Integration · pp. 25–26

E. Security and Privacy

  • Third-party DID-document management creates a risk that a DID controller could impersonate the owner by replacing the document’s public key, motivating authorization and auditing mechanisms.The survey also notes that key rotation can reduce but not eliminate compromise risk, and frequent updates may burden users.Source: E. Security and Privacy · p. 26
  • VC revocation remains underexplored: the survey reports one specification on the W3C standards track and one proposed efficient IoT revocation mechanism.It identifies scalability in high-throughput or constrained-device settings and cross-system interoperability as open research areas.Source: E. Security and Privacy · p. 26
  • DIDs’ privacy goals complicate compliance with KYC and AML screening, including checking credentials against sanctions lists.The survey calls for research into privacy-preserving techniques that provide verifiable information without exposing sensitive user details.Source: E. Security and Privacy · p. 26
  • SD-JWT conceals hidden-claim content but reveals the exact number of claims, which the survey says could enable inference attacks.Credential size also grows linearly with the number of claims, affecting end-user storage requirements.Source: E. Security and Privacy · p. 27

VIII. CONCLUSIONS

  • The conclusion presents the paper as a survey of DID and VC threats and mitigations, implementations, applications, global initiatives, and future research directions.It says the implementation analysis can help developers compare existing library features when making framework decisions.Source: §VIII · p. 27
Loading 2402.02455v2…