To use Domain Linkage in Rust you have to enable the
Domain Linkage can provide proof for a connection between a DID and a domain being controlled by the same entity. This linkage can transfer trust from a domain to a DID and vice verca. For instance, if an entity trusts a domain, it can also trust the linked DID and all documents signed by verification methods included in the DID Document. A use case coud be a verifier that trusts
www.example.com and receives a Verifiable Presentation issued by
did:foo:abc being linked to
www.example.com, the verifier can trust that the Verifiable Presentation is issued by the same entity controlling
The DIF has approved a Well Known DID Configuration draft to standardize this connection by introducing the DID Configuration Resource and the Linked Domain Service Endpoint.
DID Configuration Resource
Suppose that a DID
did:foo:example with the following DID Document only containing a
and the domain
https://www.example.com represents the same entity and need be linked to increase trust in the DID.
The DID Configuration Resource is a JSON-LD object containing verifiable credentials called
Domain Linkage Credentials. Each credential represents a linkage to a single DID.
Note that one
DID Configuration Resource can include multiple
Domain Linkage Credentials effectivaly linking the same domain to multiple DIDs.
In this example, the domain
https://www.example.com needs to be linked to the DID
did:foo:abc. This means that the
DID Configuration Resource will have one
Domain Linkage Credential. This credential must have the following properties:
- It includes the DID Configuration context.
credentialSubjectmust be the DID
did:foo:abcand references the domain
- The issuer is the DID itself
- It is signed by a key material included in the DID Document, in this case
"type": ["VerifiableCredential", "DomainLinkageCredential"],
DID Configuration Resource must be made available on
https://example.com/.well-known/did-configuration.json which establishes the linkage.
Linked Domain Service Endpoint
By having a domain, one can discover what DIDs are linked to it by fetching the
DID Configuration Resource and investigating the
Domain Linkage Credentials. To enable discovery from the other direction, when having a DID and wanting to discover which domains are linked to it, a Linked Domain Service Endpoint can be added to the DID Document. The DID Document from this example will be extended as follows to enable discovery of
Note that a DID Document can have multiple
Linked Domain Services and each service can link to multiple domains.
Verifying DID and Domain Linkage
As mentioned above, the discovery of the Domain Linkage can happen from either direction. But verifying the linkage in both cases involves only verifying the DID Configuration Resource. The process is as follows:
DID Configuration Resourcefrom
- Resolve the DID Document of
- Verify the
DID Configuration Resourceand its
Domain Linkage Credentialthat references
Here you can learn more about DID Configuration Resource Verification.