Skip to content

Commit af37b3f

Browse files
authored
fix: change 'owner' to 'controller' to follow W3C Spec (decentralized-identity#75) (decentralized-identity#81)
BREAKING CHANGE: JWTs that refer to the `did:ethr:...#owner` key in their header may be considered invalid after this upgrade, as the key id is now `did:ethr:...#controller`
1 parent a1ec9bf commit af37b3f

File tree

5 files changed

+209
-209
lines changed

5 files changed

+209
-209
lines changed

README.md

+13-13
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ distinct identifier than the generic one.
3737

3838
## DID Document
3939

40-
The did resolver takes the ethereum address, checks for the current owner, looks at contract events and builds a simple DID document.
40+
The did resolver takes the ethereum address, checks for the current controller, looks at contract events and builds a simple DID document.
4141

4242
The minimal DID document for a an ethereum address `0xb9c5714089478a327f09197987f16f9e5d936e8a` with no transactions to the registry looks like this:
4343

@@ -46,13 +46,13 @@ The minimal DID document for a an ethereum address `0xb9c5714089478a327f09197987
4646
'@context': 'https://w3id.org/did/v1',
4747
id: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a',
4848
publicKey: [{
49-
id: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#owner',
49+
id: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#controller',
5050
type: 'Secp256k1VerificationKey2018',
51-
owner: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a',
51+
controller: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a',
5252
ethereumAddress: '0xb9c5714089478a327f09197987f16f9e5d936e8a'}],
5353
authentication: [{
5454
type: 'Secp256k1SignatureAuthentication2018',
55-
publicKey: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#owner'}]
55+
publicKey: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#controller'}]
5656
}
5757
```
5858

@@ -64,19 +64,19 @@ The DID document is built by using read only functions and contract events on th
6464

6565
Any value from the registry that returns an ethereum address will be added to the `publicKey` array of the DID document with type `Secp256k1VerificationKey2018` and an `ethereumAddress` attribute containing the address.
6666

67-
### Owner Address
67+
### Controller Address
6868

69-
Each identity always has an owner address. By default it's the same as the identity address, but check the read only contract function `identityOwner(address identity)` on the deployed version of the EthrDIDRegistry contract.
69+
Each identity always has a controller address. By default it's the same as the identity address, but check the read only contract function `identityOwner(address identity)` on the deployed version of the EthrDIDRegistry contract.
7070

71-
The Identity owner will always have a `publicKey` with the id set as the DID with the fragment `#owner` appended.
71+
The Identity controller will always have a `publicKey` with the id set as the DID with the fragment `#controller` appended.
7272

7373
An entry is also added to the `authentication` array of the DID document with type `Secp256k1SignatureAuthentication2018`.
7474

7575
### Enumerating contract events for an identity
7676

7777
The `EthereumDIDRegistry` contract publishes 3 types of events for each identity.
7878

79-
- `DIDOwnerChanged`
79+
- `DIDOwnerChanged` (indicating a change of controller)
8080
- `DIDDelegateChanged`
8181
- `DIDAttributeChanged`
8282

@@ -169,7 +169,7 @@ generates a `PublicKey` entry like this:
169169
{
170170
id: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74#delegate-1",
171171
type: "Secp256k1VerificationKey2018",
172-
owner: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74",
172+
controller: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74",
173173
publicKeyHex: '02b97c30de767f084ce3080168ee293053ba33b235d7116a3263d29f1450936b71'
174174
}
175175
```
@@ -184,7 +184,7 @@ A `DIDAttributeChanged` event for the identity `0xf3beac30c498d9e26865f34fcaa57d
184184
{
185185
id: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74#delegate-1",
186186
type: "Ed25519VerificationKey2018",
187-
owner: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74",
187+
controller: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74",
188188
publicKeyBase64: "uXww3nZ/CEzjCAFo7ikwU7ozsjXXEWoyY9KfFFCTa3E="
189189
}
190190
```
@@ -200,7 +200,7 @@ generates a `PublicKey` entry like this:
200200
{
201201
id: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74#delegate-1",
202202
type: "X25519KeyAgreementKey2019",
203-
owner: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74",
203+
controller: "did:ethr:0xf3beac30c498d9e26865f34fcaa57dbb935b0d74",
204204
publicKeyBase64: "MCowBQYDK2VuAyEAEYVXd3/7B4d0NxpSsA/tdVYdz5deYcR1U+ZkphdmEFI="
205205
}
206206
```
@@ -242,7 +242,7 @@ import { getResolver } from 'ethr-did-resolver'
242242
// You can also set an address for your own ethr-did-registry contract
243243
const providerConfig = { rpcUrl: 'https://rinkeby.infura.io/ethr-did', registry: registry.address }
244244

245-
// getResolver will return an object with a key/value pair of { "ethr": resolver } where resolver is a function used by the generic did resolver.
245+
// getResolver will return an object with a key/value pair of { "ethr": resolver } where resolver is a function used by the generic did resolver.
246246
const ethrDidResolver = getResolver(providerConfig)
247247
const didResolver = new Resolver(ethrDidResolver)
248248

@@ -278,6 +278,6 @@ This allows you to resolve ethr-did's of the formats:
278278

279279
For each network you can specify either an `rpcUrl`, a `provider` or a `web3` instance that can be used to access that particular network.
280280

281-
These providers will have to support and `eth_call`, `eth_getLogs` to be able to resolve DIDs specific to that network.
281+
These providers will have to support and `eth_call`, `eth_getLogs` to be able to resolve DIDs specific to that network.
282282

283283
You can also override the default registry address by specifying a `registry` attribute per network.

doc/did-method-spec.md

+33-33
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@
66

77
## Preface
88

9-
The ethr DID method specification conforms to the requirements specified in
10-
the [DID specification](https://w3c-ccg.github.io/did-core/), currently published by the
11-
W3C Credentials Community Group. For more information about DIDs and DID method specifications,
9+
The ethr DID method specification conforms to the requirements specified in
10+
the [DID specification](https://w3c-ccg.github.io/did-core/), currently published by the
11+
W3C Credentials Community Group. For more information about DIDs and DID method specifications,
1212
please see the [DID Primer](https://github.com/WebOfTrustInfo/rebooting-the-web-of-trust-fall2017/blob/master/topics-and-advance-readings/did-primer.md)
1313

1414
## Abstract
@@ -37,18 +37,18 @@ ARTIS sigma1 | `artis_s1` | 0x03c301 | `0xdca7ef03e98e0dc2b855be647c39abe
3737
Since each Ethereum transaction must be funded, there is a growing trend of on-chain transactions that are
3838
authenticated via an externally created signature and not by the actual transaction originator. This allows for
3939
3rd party funding services, or for receivers to pay without any fundamental changes to the underlying
40-
Ethereum architecture. These kinds of transactions have to be signed by an actual key pair and thus cannot be used
41-
to represent smart contract based Ethereum accounts. ERC1056 proposes a way of a smart contract or regular key pair
40+
Ethereum architecture. These kinds of transactions have to be signed by an actual key pair and thus cannot be used
41+
to represent smart contract based Ethereum accounts. ERC1056 proposes a way of a smart contract or regular key pair
4242
delegating signing for various purposes to externally managed key pairs. This allows a smart contract to be
4343
represented, both on-chain as well as off-chain or in payment channels through temporary or permanent delegates.
4444

4545
For a reference implementation of this DID method specification see [3].
4646

47-
### Identity Ownership
48-
By default, each identity is controlled by itself. Each identity can only be controlled by a single
49-
address at any given time. By default, this is the address of the identity itself. The owner can
47+
### Identity Controller
48+
By default, each identity is controlled by itself. Each identity can only be controlled by a single
49+
address at any given time. By default, this is the address of the identity itself. The controller can
5050
replace themselves with any other Ethereum address, including contracts to allow more advanced
51-
models such as multi-signature ownership.
51+
models such as multi-signature controllership.
5252

5353
## Target System
5454

@@ -64,15 +64,15 @@ The target system is the Ethereum network where the ERC1056 is deployed. This co
6464

6565
- No transaction fee on identity creation
6666
- Uses Ethereum's built-in account abstraction
67-
- Multi-sig wallet for identity owner
67+
- Multi-sig wallet for identity controller
6868
- Decoupling claims data from the underlying identity
6969
- Decoupling Ethereum interaction from the underlying identity
7070
- Flexibility to use key management
7171
- Flexibility to allow third-party funding service to pay the gas fee if needed
72-
- Supports any EVM-compliant blockchain
72+
- Supports any EVM-compliant blockchain
7373

7474
## JSON-LD Context Definition
75-
Note, this DID method specification uses the `Secp256k1VerificationKey2018`,
75+
Note, this DID method specification uses the `Secp256k1VerificationKey2018`,
7676
`Secp256k1SignatureAuthentication2018` types and an `ethereumAddress` instead of
7777
a `publicKeyHex`.
7878

@@ -91,7 +91,7 @@ The definition of the ethr DID JSON-LD context is:
9191

9292
The namestring that shall identify this DID method is: `ethr`
9393

94-
A DID that uses this method MUST begin with the following prefix: `did:ethr`. Per the DID specification, this string
94+
A DID that uses this method MUST begin with the following prefix: `did:ethr`. Per the DID specification, this string
9595
MUST be in lowercase. The remainder of the DID, after the prefix, is specified below.
9696

9797
## Method Specific Identifier
@@ -137,36 +137,36 @@ transactions to the ERC1056 registry looks like this:
137137
'@context': 'https://w3id.org/did/v1',
138138
id: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a',
139139
publicKey: [{
140-
id: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#owner',
140+
id: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#controller',
141141
type: 'Secp256k1VerificationKey2018',
142-
owner: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a',
142+
controller: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a',
143143
ethereumAddress: '0xb9c5714089478a327f09197987f16f9e5d936e8a'}],
144144
authentication: [{
145145
type: 'Secp256k1SignatureAuthentication2018',
146-
publicKey: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#owner'}]
146+
publicKey: 'did:ethr:0xb9c5714089478a327f09197987f16f9e5d936e8a#controller'}]
147147
}
148148

149149
### Read (Resolve)
150150

151151
The DID document is built by using read only functions and contract events on the ERC1056 registry.
152152

153-
Any value from the registry that returns an Ethereum address will be added to the `publicKey` array of the DID
153+
Any value from the registry that returns an Ethereum address will be added to the `publicKey` array of the DID
154154
document with type `Secp256k1VerificationKey2018` and an `ethereumAddress` attribute containing the address.
155155

156-
#### Owner Address
156+
#### Controller Address
157157

158-
Each identity always has an owner address. By default it is the same as the identity address, but check the
158+
Each identity always has a controller address. By default it is the same as the identity address, but check the
159159
read only contract function `identityOwner(address identity)` on the deployed version of the ERC1056 contract.
160160

161-
The identity owner will always have a `publicKey` with the id set as the DID with the fragment `#owner` appended.
161+
The identity controller will always have a `publicKey` with the id set as the DID with the fragment `#controller` appended.
162162

163163
An entry is also added to the `authentication` array of the DID document with type `Secp256k1SignatureAuthentication2018`.
164164

165165
#### Enumerating Contract Events to build the DID Document
166166

167167
The ERC1056 contract publishes three types of events for each identity.
168168

169-
- `DIDOwnerChanged`
169+
- `DIDOwnerChanged` (indicating a change of controller)
170170
- `DIDDelegateChanged`
171171
- `DIDAttributeChanged`
172172

@@ -199,22 +199,22 @@ A `DIDDelegateChanged` event is published that is used to build a DID document.
199199
uint validTo,
200200
uint previousChange
201201
);
202-
202+
203203

204204
The only 2 `delegateTypes` that are currently published in the DID document are:
205205

206206
- `veriKey` which adds a `Secp256k1VerificationKey2018` to the `publicKey` section of the DID document.
207207
- `sigAuth` which adds a `Secp256k1SignatureAuthentication2018` to the `publicKey` section of document. An entry
208208
is also added to the `authentication` section of the DID document.
209209

210-
Note, the `delegateType` is a `bytes32` type for Ethereum gas efficiency reasons and not a `string`. This
210+
Note, the `delegateType` is a `bytes32` type for Ethereum gas efficiency reasons and not a `string`. This
211211
restricts us to 32 bytes, which is why we use the short hand versions above.
212212

213213
Only events with a `validTo` in seconds greater or equal to the current time should be included in the DID document.
214214

215215
#### Non-Ethereum Attributes
216216

217-
Non-Ethereum keys, service endpoints etc. can be added using attributes. Attributes only exist on the
217+
Non-Ethereum keys, service endpoints etc. can be added using attributes. Attributes only exist on the
218218
blockchain as contract events of type `DIDAttributeChanged` and can thus not be queried from within solidity code.
219219

220220
event DIDAttributeChanged(
@@ -225,10 +225,10 @@ blockchain as contract events of type `DIDAttributeChanged` and can thus not be
225225
uint previousChange
226226
);
227227

228-
Note, the name is a `bytes32` type for Ethereum gas efficiency reasons and not a `string`. This restricts us to
228+
Note, the name is a `bytes32` type for Ethereum gas efficiency reasons and not a `string`. This restricts us to
229229
32 bytes, which is why we use the short hand attribute versions below.
230230

231-
While any attribute can be stored, for the DID document we currently support adding to each of these sections of
231+
While any attribute can be stored, for the DID document we currently support adding to each of these sections of
232232
the DID document:
233233

234234
- Public Keys
@@ -255,7 +255,7 @@ generates a public key entry like the following:
255255

256256
##### Base64 encoded Ed25519 Verification Key
257257

258-
A `DIDAttributeChanged` event for the identity `0xf3beac30c498d9e26865f34fcaa57dbb935b0d74` with the name
258+
A `DIDAttributeChanged` event for the identity `0xf3beac30c498d9e26865f34fcaa57dbb935b0d74` with the name
259259
`did/pub/Ed25519/veriKey/base64` and the value of `0xb97c30de767f084ce3080168ee293053ba33b235d7116a3263d29f1450936b71`
260260
generates a public key entry like this:
261261

@@ -272,8 +272,8 @@ The name of the attribute should follow this format:
272272

273273
`did/svc/[ServiceName]`
274274

275-
A `DIDAttributeChanged` event for the identity `0xf3beac30c498d9e26865f34fcaa57dbb935b0d74` with the name
276-
`did/svc/HubService` and value of the URL `https://hubs.uport.me` hex encoded as
275+
A `DIDAttributeChanged` event for the identity `0xf3beac30c498d9e26865f34fcaa57dbb935b0d74` with the name
276+
`did/svc/HubService` and value of the URL `https://hubs.uport.me` hex encoded as
277277
`0x68747470733a2f2f687562732e75706f72742e6d65` generates a service endpoint entry like the following:
278278

279279
{
@@ -297,22 +297,22 @@ Two cases need to be distinguished:
297297
- In case no changes were written to ERC1056, nothing needs to be done, and the private key which belongs to the
298298
Ethereum address needs to be deleted from the storage medium used to protect the keys, e.g., mobile device.
299299
- In case ERC1056 was utilized, the owner of the smart contract needs to be set to `0x0`. Although, `0x0`is a valid
300-
Ethereum address, this will indicate the identity has no owner which is a common approach for invalidation,
300+
Ethereum address, this will indicate the identity has no owner which is a common approach for invalidation,
301301
e.g., tokens. Other elements of the DID Document may be revoked explicitly by invoking the relevant smart contract
302302
functions as defined by the ERC1056 standard. This includes the delegates and additional attributes. Please find a
303303
detailed description in the [ERC1056 documentation](https://github.com/ethereum/EIPs/issues/1056). All these functions
304304
will trigger the respective Ethereum events which are used to build the DID Document for a given identity as
305-
described in [Enumerating Contract Events to build the DID Document](#Enumerating-Contract-Events-to-build-the-DID-Document).
305+
described in [Enumerating Contract Events to build the DID Document](#Enumerating-Contract-Events-to-build-the-DID-Document).
306306

307307
## Reference Implementations
308308

309309
The code at [https://github.com/decentralized-identity/ethr-did-resolver](<>) is intended to present a reference implementation
310-
of this DID method.
310+
of this DID method.
311311

312312
## References
313313

314314
**[1]** <https://w3c-ccg.github.io/did-core/>
315315

316-
**[2]** <https://github.com/ethereum/EIPs/issues/1056>
316+
**[2]** <https://github.com/ethereum/EIPs/issues/1056>
317317

318318
**[3]** <https://github.com/decentralized-identity/ethr-did-resolver>

0 commit comments

Comments
 (0)