Add a proof item to each DIDDoc version

[swcurran]

• A proof item is included in each DIDDoc that contains a DID Controller signature over that entire DIDDoc (minus the proof item), plus the the proof item from the previous DIDDoc
  • The signature must be from one of controllers of the previous version of the DIDDoc.
    • In the initial document, there is no signature from the previous DIDDoc.
  • How is the DIDDoc canonicalized when creating the signature?
  • Is the signature from the previous DIDDoc included in the DIDDoc?
• Include metadata about the DIDDoc in the DIDDoc
  • versionId (required). Must be 0 for the initial DIDDoc and incremented per DIDDoc update.
  • created — a locally defined (by the DID controller) time when the initial DIDDoc was created.
  • updated — a locally defined (by the DID controller) time when this DIDDoc was created.

Fundamental to this is #7 — how do we ensure signatures across the JSON data is verifiable?

[swcurran]

~Do we use a Data Integrity proof?~. A DI does not include the canonicalization. Suggestions are:

• JSON Canonicalization Scheme (JCS),
• RDF Dataset Canonicalization

[swcurran]

Plan defined to do that and put the proof into the history of the DIDDoc. That leaves it out of the DIDDoc (no JSON-LD context change needed) and simplifies the processing needed to produce the proof.

[andrewwhitehead]

At the moment the prototypes use a detached DI proof, but there's an issue there with the @context not being defined. We might want to look at cutting the serialized proof down to just the cryptosuite and proof value, or for version one, always using eddsa-jcs-2022 (for instance). Doing RDF normalization of the DID document is also a step we might want to avoid in the interest of efficiency.

[swcurran]

Is this a DI that needs to be raised with them? It seems like a bad idea from the spec. perspective to limit the functionality because of something like that.

[brianorwhatever]

Plan is to have a DI proof of the new document state added to every log line

[swcurran]

Resolved by #20