DIF Security Contexts for Linked Data

Security v1 & v2

Terminology

Ed25519Signature2018

Linked data signature suite for ed25519, useful to working with lib sodium / nacl. See w3c-ccg.

The canonicalization algorithm is used to transform the input data into a form that can be passed to a cryptographic digest method. The digest is then digitally signed using a digital signature algorithm. Canonicalization ensures that a piece of software that is generating a digital signature is able to do so on the same set of information in a deterministic manner.

See w3c-ccg

cipherAlgorithm

The cipher algorithm describes the mechanism used to encrypt a message. It is typically a string expressing the cipher suite, the strength of the cipher, and a block cipher mode.

See w3c-ccg

cipherData

Cipher data is an opaque blob of information that is used to specify an encrypted message.

See w3c-ccg

cipherKey

A cipher key is a symmetric key that is used to encrypt or decrypt a piece of information. The key itself may be expressed in clear text or encrypted.

See w3c-ccg

digestAlgorithm

The digest algorithm is used to specify the cryptographic function to use when generating the data to be digitally signed. Typically, data that is to be signed goes through three steps: 1) canonicalization, 2) digest, and 3) signature. This property is used to specify the algorithm that should be used for step #2. A signature class typically specifies a default digest method, so this property is typically used to specify information for a signature algorithm.

See w3c-ccg

domain

Deprecated, do not use.

encryptionKey

Deprecated, do not use.

expiration

See vc-data-model.

expires

The expiration time is typically associated with a Key and specifies when the validity of the key will expire. It is considered a best practice to only create keys that have very definite expiration periods. This period is typically set to between six months and two years. An digital signature created using an expired key MUST be marked as invalid by any software attempting to verify the signature.

See w3c-ccg

initializationVector

The initialization vector (IV) is a byte stream that is typically used to initialize certain block cipher encryption schemes. For a receiving application to be able to decrypt a message, it must know the decryption key and the initialization vector. The value is typically base-64 encoded.

See w3c-ccg

iterationCount

Deprecated, do not use.

nonce

This property is used in conjunction with the input to the signature hashing function in order to protect against replay attacks. Typically, receivers need to track all nonce values used within a certain time period in order to ensure that an attacker cannot merely re-send a compromised packet in order to execute a privileged request.

See w3c-ccg

normalizationAlgorithm

Deprecated, do not use.

Also known as canonicalizationAlgorithm.

See w3c-ccg

password

A secret that is used to generate a key that can be used to encrypt or decrypt message. It is typically a string value.

See w3c-ccg

privateKey

Deprecated, do not use.

privateKeyPem

A private key PEM property is used to specify the PEM-encoded version of the private key. This encoding is compatible with almost every Secure Sockets Layer library implementation and typically plugs directly into functions intializing private keys.

You should use privateKeyJwk when possible.

See w3c-ccg.

publicKey

A public key property is used to specify a URL that contains information about a public key.

See w3c-ccg.

publicKeyBase58

You should use publicKeyJwk if possible, because JWK is a valid key format for supported key types.

See did-core.

See did-core publicKeyBase58 example

publicKeyPem

A public key PEM property is used to specify the PEM-encoded version of the public key. This encoding is compatible with almost every Secure Sockets Layer library implementation and typically plugs directly into functions intializing public keys.

You should use publicKeyJwk when possible.

See w3c-ccg.

publicKeyWif

Deprecated, do not use.

See lds-koblitz2016.

publicKeyService

The publicKeyService property is used to express the REST URL that provides public key management services.

See w3c-ccg.

revoked

See w3c-ccg.

salt

Deprecated, do not use.

signature

Deprecated, do not use.

The signature property is used to associate a signature with a graph of information. The signature property is typically not included in the canonicalized graph that is then digested, and digitally signed.

See w3c-ccg.

signatureAlgorithm

Deprecated, do not use.

signatureValue

The signature algorithm is used to specify the cryptographic signature function to use when digitally signing the digest data. Typically, text to be signed goes through three steps: 1) canonicalization, 2) digest, and 3) signature. This property is used to specify the algorithm that should be used for step #3. A signature class typically specifies a default signature algorithm, so this property rarely needs to be used in practice when specifying digital signatures.

See w3c-ccg.