[Paper Review] A Survey on Decentralized Identifiers and Verifiable Credentials

Carlo Mazzocca, Abbas Acar+4 more|arXiv (Cornell University)|Feb 4, 2024

Access Control and Trust4 citations

TL;DR

This paper presents a comprehensive survey on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs), analyzing their technical foundations, implementations, use cases across diverse domains—including IoT, healthcare, and finance—and regulatory frameworks. It identifies key challenges in revocation, privacy, and accountability, and outlines future research directions for advancing self-sovereign identity systems.

ABSTRACT

Digital identity has always been considered the keystone for implementing secure and trustworthy communications among parties. The ever-evolving digital landscape has gone through many technological transformations that have also affected the way entities are digitally identified. During this digital evolution, identity management has shifted from centralized to decentralized approaches. The last era of this journey is represented by the emerging Self-Sovereign Identity (SSI), which gives users full control over their data. SSI leverages decentralized identifiers (DIDs) and verifiable credentials (VCs), which have been recently standardized by the World Wide Web Community (W3C). These technologies have the potential to build more secure and decentralized digital identity systems, remarkably contributing to strengthening the security of communications that typically involve many distributed participants. It is worth noting that the scope of DIDs and VCs extends beyond individuals, encompassing a broad range of entities including cloud, edge, and Internet of Things (IoT) resources. However, due to their novelty, existing literature lacks a comprehensive survey on how DIDs and VCs have been employed in different application domains, which go beyond SSI systems. This paper provides readers with a comprehensive overview of such technologies from different perspectives. Specifically, we first provide the background on DIDs and VCs. Then, we analyze available implementations and offer an in-depth review of how these technologies have been employed across different use-case scenarios. Furthermore, we examine recent regulations and initiatives that have been emerging worldwide. Finally, we present some challenges that hinder their adoption in real-world scenarios and future research directions.

Motivation & Objective

• To provide a holistic overview of Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) as foundational technologies for self-sovereign identity (SSI).
• To analyze existing implementations of DIDs and VCs, highlighting their features and trade-offs for developers.
• To explore real-world applications beyond SSI, including IoT, edge computing, and cloud systems.
• To examine global regulatory initiatives and standards, such as GDPR and KYC/AML compliance, in the context of decentralized identity.
• To identify open challenges and propose future research directions for improving security, privacy, and scalability in DID and VC systems.

Proposed method

• Conducting a systematic review of academic and industry literature on DIDs and VCs, focusing on technical specifications, standards, and deployment patterns.
• Analyzing 15+ open-source implementations of DID and VC stacks, evaluating their support for standards like W3C DID and VC specifications.
• Categorizing and evaluating use cases across sectors (e.g., healthcare, finance, IoT) based on trust model, data sensitivity, and decentralization level.
• Surveying global regulatory and governmental initiatives, including EU’s eIDAS 2.0 and national digital identity programs.
• Evaluating cryptographic mechanisms for VC revocation, including the Revocation List 2020 specification based on bitstring compression.
• Assessing privacy-preserving techniques and compliance mechanisms for regulatory requirements like KYC and AML within DID-based systems.

Figure 1: Illustrative organization of the survey.

Experimental results

Research questions

• RQ1 How are DIDs and VCs technically implemented across different software stacks, and what are their key differences in functionality and performance?
• RQ2 What are the primary application domains for DIDs and VCs beyond self-sovereign identity, and how do they address unique trust and scalability challenges?
• RQ3 How do existing standards and regulations, such as GDPR and AML, interact with the privacy-by-design principles of DIDs and VCs?
• RQ4 What are the current limitations and open challenges in VC revocation mechanisms, and how effective are proposed solutions like Revocation List 2020?
• RQ5 What cryptographic and protocol-level innovations are needed to enable privacy-preserving yet compliant identity systems in regulated environments?

Key findings

• The Revocation List 2020 mechanism enables efficient, compressed storage of revoked VCs using bitstrings, with potential for significant size reduction—e.g., a 16KB bitstring with few revocations can be compressed to a few hundred bytes.
• Current VC revocation solutions remain limited, with only one non-standardized specification (Revocation List 2020) widely adopted, highlighting a critical gap in the ecosystem.
• DID and VC systems can support a broad range of entities beyond individuals, including IoT devices, edge nodes, and cloud services, enabling decentralized trust in distributed systems.
• Regulatory compliance, such as KYC and AML, remains a major challenge due to the tension between privacy-preserving design and mandatory user screening, requiring new cryptographic solutions.
• Existing implementations vary significantly in standards compliance, performance, and support for advanced features like key rotation and multi-factor authentication via OTPs.
• The survey identifies a lack of standardized, privacy-preserving mechanisms for accountability and revocation, indicating a need for further research in zero-knowledge proofs and decentralized audit systems.

Figure 2: Timeline of digital identity evolution.