In countless professional interactions, someone acting in his or her own name or on behalf of an organization has to prove to a private individual or to another organization who he or she is, and often also what mandate or assigned task he or she is there to carry out. Think of the identification of an emergency responder or a technician at someone’s home, or of physical service delivery at a company site. Today, this identification generally happens in three ways: (1) on the basis of trust (i.e., no identification), (2) on the basis of an identity document, or (3) on the basis of a “trust signal”, i.e., a non-conclusive, indicative cue, such as the presence of certain clothing (e.g., a police uniform), or a badge or e-mail issued by the organization involved:

• Relying on trust or “trust signals”. This is what happens in most situations, and it is not verification at all. The visitor is believed because the story is plausible, the clothing fits, and refusing feels impolite. Trust is precisely the surface that social engineering targets.
• Asking for an identity document. An identity document proves, at best, a legal identity. Counterfeit documents are hard to detect, and it says nothing about the function, the mandate and the time window that matter in exactly these situations.
• Asking for a badge or an e-mail. A badge is a printed trust signal, and it carries the same weakness as the uniform. An e-mail or an appointment confirmation can be spoofed or intercepted, and in larger organizations the recipient is often unable to distinguish a legitimate internal reference from an invented one.

Identification through the above means is far from ideal, since it is susceptible to social engineering and doesn’t allow full verification. But how do we prevent this type of social engineering?

A decentralized alternative

The answer is not to make the uniform harder to copy. It is to stop relying on appearance altogether, and to attach a cryptographic proof to the claim itself, supported by web3-technologies. We propose a decentralized verification system based on three building blocks.

• Verifiable Credentials (VCs) carry the claims and provide the cryptographic signature, i.e., this person, this function, this assigned task, is valid within this time window. A forged credential fails verification mathematically.
• Decentralized Identifiers (DIDs) on a blockchain provides a verifiable proof of identity of the issuer. This prevents having to contact the issuer directly.
• Zero-Knowledge Proofs (ZKPs) introduce selective disclosure. The holder is able to prove that he or she is an authorized officer of a given force, mandated for this specific intervention, and that the mandate is valid at this moment, without exposing a national registry number, a date of birth, or operationally sensitive details.

Practical Use

In practice, the verification of a person’s identity or assigned task takes place through a QR-code (or an NFC tag) that is scanned on the spot.

• Issuance. Organization A signs a VC that establishes the identity, the function and the mandate of the employee, linked to a DID on the blockchain.
• Verification. Party B, i.e., a company or a citizen, scans the QR-code and verifies the credential directly against the identity on the blockchain, without having to contact organization A. The authenticity is mathematically guaranteed. The check takes seconds, and it can be performed offline.
• Privacy. Thanks to ZKP and selective disclosure, the employee reveals only what is necessary, for example only the name of the employee, mandated for a particular task within a given time window, without surrendering all underlying personal data or commercially sensitive information.