Decentralized Identifier (DID)
A Decentralized Identifier (DID) is an identifier following a W3C standard that points to a document with public keys and works without a central registry.
A DID takes the form did:method:identifier, such as did:web:example.com or did:key:z6Mk…. The method defines how the related DID document is found: with did:web it lives on a website, while with did:key the key sits directly in the identifier. The W3C adopted DID Core as a recommendation in July 2022.
In evidence for agents, DIDs name issuers, agents or principals. A verifying party resolves the DID and obtains the key it uses to verify signatures.
Example
A mandate names did:web:mandates.example.com as its issuer. The verifying party loads the DID document from this domain, takes the public key and verifies the signature. This proves that the mandate comes from whoever controls this domain.
How it differs
A username belongs to a service; a DID belongs to its holder. Unlike an X.509 certificate, a DID needs no issuing authority; trust depends on the method, and with did:web on control over the domain.
In practice
- Use did:web for issuers with their own domain and did:key for short-lived agent keys.
- Protect the domain behind a did:web identifier as well as your signing keys.
- Provide the published key in KYA, as verification does not load DIDs from the network.
Role in KYA
For every report, KYA states where a key comes from; an issuer DID proves the origin. Because KYA makes no network requests, did:web is not loaded automatically: the verifying party provides the published key itself.
Related check: Issuer (issuer_resolution). Is the key bound to the issuer – through a DID or because the verifying party trusts it?
Frequently asked questions
What is a DID?
A Decentralized Identifier following a W3C standard: an identifier that points to a document with public keys and needs no central registry.
What is the difference between did:web and did:key?
With did:web, the DID document lives on a website and trust depends on the domain. With did:key, the public key sits directly in the identifier; it can be neither changed nor revoked.
Does KYA resolve DIDs itself?
did:key, yes, because the key is in the identifier. KYA does not load did:web automatically, as verification makes no network requests. The verifying party provides the key under “Trust of the verifying party”.
Is a DID the same as a blockchain address?
No. Some DID methods use blockchains, many do not. did:web and did:key, which often appear in agent evidence, work entirely without a blockchain.