Decentralized identity is becoming the backbone of how organizations, governments, and individuals exchange trusted information.
In this live workshop, Agne Caunt (Product Owner, Dock Labs) and Richard Esplin (Head of Product, Dock Labs) guided learners through the foundations of decentralized identity: how digital identity models have evolved, the Trust Triangle that powers verifiable data exchange, and the technologies behind it: from verifiable credentials to DIDs, wallets, and biometric-bound credentials.
Below are the core takeaways from the session.
From centralized to decentralized identity
- Centralized identity: each system stores user accounts; creates password fatigue and PII honeypots that are prime targets for bad actors.
- Federated identity (IdP model): streamlines user management but concentrates risk; complex to set up so many one to one integrations.
- Decentralized identity: users store verified data in personal wallets and share it with verifiers as needed. Removes central databases, increases privacy, and enables seamless portability of trusted data.
The paradigm shift: from organization-centric to user-centric
- Decentralized ID puts the user in control of their data without adding friction.
- Organizations still manage IAM internally but rely on portable credentials externally.
- User-centric doesn’t mean complicated UX. Flows can be just as simple as federated logins.
The Trust Triangle (W3C)
- Issuer: verifies identity, issues and signs a credential.
- Holder: stores the credential in a wallet and presents it when needed.
- Verifier: checks the credential’s authenticity using the issuer’s public key from a verifiable data registry.
- Trust flows cryptographically, not through central intermediaries.
Principles of decentralized identity
- Privacy by design and user consent (GDPR-aligned).
- Data integrity: verifiers can trust that data belongs to the holder.
- Interoperability: enabled by open standards (W3C, IETF, OpenID).
- Security: no honeypots; wallet access protected by biometrics or PIN.
Credentials, schemas, and selective disclosure
- A verifiable credential (VC) is a signed JSON document with attributes, schema, and proof.
- Schemas define data structure; claims are actual values.
- Advanced cryptography (e.g., BBS signatures) enables:
- Selective disclosure (share only required fields).
- Range proofs (e.g., “age > 18” without disclosing DOB).
Binding credentials to the right holder
- Wallet binding: ensures all credentials come from the same wallet.
- Biometric binding: ties credentials to a person’s biometric proof without sharing raw biometric data.
- Balances strong assurance with privacy and UX considerations.
Decentralized identifiers (DIDs)
- Each entity—person, organization, or device—has a DID.
- DID methods include did:key, did:web, and did:cheqd (blockchain-based), among many others.
- DIDComm enables private, encrypted communication between DIDs.
Wallet options and trade-offs
- OS wallets (Apple, Google): convenient, limited customization, gate-kept.
- Government wallets (e.g., EUDI, mDL): trusted, privacy-respecting, slow to evolve.
- Custom wallets (Truvera SDK or Cloud Wallet): customizable, quick to deploy, business-controlled UX.
- Agne’s point: a “wallet” is just a place to store credentials. It can be mobile, web, or cloud based.
- Hybrid approach: local + cloud storage for convenience and backup.
Trust registries and ecosystem governance
- Define which issuers and verifiers are trusted.
- Enable ecosystem-locked credentials, where only authorized verifiers can check validity.
- Supports privacy-preserving monetization (verifiers pay issuers without seeing holder data).
- Acts as the digital equivalent of accreditation bodies in the offline world.
Blockchain’s role in decentralized identity
- The blockchain doesn’t store personal data, only public trust anchors:
- Issuer DIDs and public keys
- Revocation registries
- Ecosystem governance data
- Ensures persistence, censorship resistance, and decentralization even if a vendor disappears.
Interoperability and emerging standards
- Dock Labs supports verification from native and government wallets via W3C Digital Credentials API, OID4VP, and OID4VCI.
- Today’s integrations can still be wallet-specific; full convergence is coming.
- Goal: one verifier integration, regardless of wallet or format.
Expanding what “identity” means
- Credentials can represent more than people:
- Organizations, devices, and AI agents can also hold and present verifiable identities.
- Enables new trust use cases such as agentic commerce and delegated authority.
Practical exercise for organizations
- Identify one or two internal processes that could benefit from decentralized identity.
- Map the trust triangle (issuer–holder–verifier) and define the value proposition.
- Send results to Dock Labs for feedback (recording and contact shared in session).
