[tobz]

Ha! I was working on this very concept for a hackathon at work (edX) as a way to think about the future of credentials / authenticity for students taking ad-hoc courses.

It's really cool to see others working on this sort of thing. One of the questions I saw, about identity, reminded me of an idea I had to solve this very problem.

The hardest part about putting this stuff on the blockchain is that you need to be able to prove that a transaction (containing your credential metadata) that went to address A is an address you own, that you can sign for. Like the credential proof itself, an easy way to associate ownership is to put some hashed metadata in a transaction, sent from the address you intend to prove you own.

This was the hardest part to do, IMO, in a way that is both high-assurance and low complexity. Since academic credentials are most often checked for employment, I thought that maybe using metadata that you wouldn't normally share with anyone except for an employer (like social security #) would be reasonable. Define a list of secret-ish values, define a specification for what values are valid, how to order and format that, and how to generate a hash from it. This way, third-parties are able to independently verify things so long as they can get the values from you.

If you wanted to prove to a third-party that you, in fact, are the person (bitcoin address) you say you are, you'd give them the shared bits of information, they would hash it, and then check all the bitcoin transactions and stitch together the web of trust that establishes your credentials. The intention being that you wouldn't normally be compelled to fake credentials for someone else -- take classes and then let them subsume the credit -- because it would involve more than just letting them assume your name, you'd have to give them sensitive values like SSN, etc.

Other ideas included something like a standardized format for fingerprint data, or something biometric -- very hard to easily replicate or steal -- as a way to more closer tie the person to their address.. but I couldn't seem to find anything that provided such a standard, and since giving blood or fingerprints is kind of an uneven exchange.. never went down that avenue.

I'd really love to see some sort of solution to this.

[Natanael_L]

This? https://eprint.iacr.org/2013/622.pdf

Decentralized anonymous credentials. What you said, but with Zero-knowledge proofs.

[rhyzomatic]

I must be missing something here, but why not just go with a challenge-proof type scheme? Something like

1. You want to prove to $PotentialEmployer that you own address A which has necessary credentials.

2. $PotentialEmployer sends you a random string.

3. You sign it with the private key of address A and send them the proof.

4. $PotentialEmployer verifies the signed string.

If the employer has this proof and can see in the metadata that it's your name and date of birth (or whatever), wouldn't that be enough?

[tobz]

The idea was that, for the lowest common denominator of "hmm, what was your GPA/degree/whatever?", it's easier to give bits of more-or-less secret information than to do a challenge response on the spot.

Everything was about leaving the institutions granting credentials / third parties who consume the blockchain data to handle the technical bits, while an employer or potential employee only had to know where to go and what secret values to use.

I suppose this could be wrapped up in a simple app or something, but I was going for bulletproof-ish. It's easy to remember a social security number, full name, etc. It persists through broken laptops and smartphones.