Skip to content

Draft EVES-008: On-Chain Identity & Revocation Management #36

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
siyovush-hamidov wants to merge 6 commits into from
Closed

Draft EVES-008: On-Chain Identity & Revocation Management #36

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
ff7c1d4
Draft EVES-008: On-Chain Identity & Revocation Management
siyovush-hamidov Feb 27, 2026
7b69cc1
Update authors and clean up template instructions in EVES-008
siyovush-hamidov Feb 27, 2026
3243e22
fix: resolve markdownlint CI errors for MD013, MD022, MD032 and MD060
siyovush-hamidov Feb 27, 2026
73cce6f
docs: add EVES-008 specification
siyovush-hamidov Feb 27, 2026
ebf475a
fix: add trailing newline to EVES-008
siyovush-hamidov Feb 27, 2026
419f8a3
fix: vale conflicts
siyovush-hamidov Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,9 @@
.history/
*.vsix
.ionide
.DS_Store
.DS_Store

# Vale downloaded styles
.github/styles/Google/
.github/styles/proselint/
.github/styles/write-good/
2 changes: 1 addition & 1 deletion EVES/EVES-007/eves-007.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@

##### Smart Contract Example Mappings

| Blockchain | Namespace | Chain ID | Example URN |
| Blockchain | Namespace | Chain ID | Example URN |

Check warning on line 48 in EVES/EVES-007/eves-007.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Acronyms] Spell out 'URN', if it's unfamiliar to the audience.

Raw Output:
{"message": "[Google.Acronyms] Spell out 'URN', if it's unfamiliar to the audience.", "location": {"path": "EVES/EVES-007/eves-007.md", "range": {"start": {"line": 48, "column": 69}}}, "severity": "INFO"}

Check failure on line 48 in EVES/EVES-007/eves-007.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Namespace'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Namespace'?", "location": {"path": "EVES/EVES-007/eves-007.md", "range": {"start": {"line": 48, "column": 29}}}, "severity": "ERROR"}

Check failure on line 48 in EVES/EVES-007/eves-007.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Blockchain'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Blockchain'?", "location": {"path": "EVES/EVES-007/eves-007.md", "range": {"start": {"line": 48, "column": 3}}}, "severity": "ERROR"}
|-------------------------|-----------|-------------------|--------------------------------------------------------------------------------------|
| **Tezos (Ghostnet)** | `tezos` | `NetXnHfVqm9iesp` | `urn:blockchain:tezos:NetXnHfVqm9iesp:contract:KT1PCaD2kmgCHy15wQ1gpqZUy9RLxyBVJdTF` |
| **Ethereum (Mainnet)** | `eip155` | `1` | `urn:blockchain:eip155:1:contract:0xABC123456789...` |
Expand Down
79 changes: 79 additions & 0 deletions EVES/EVES-008/eves-008.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
---
eves-identifier: 008
title: ENVITED-X On-Chain Identity & Revocation Management
author: "`Sid Lamichhane` (@sid030sid); `Siyovush Hamidov` (@siyovush-hamidov); `Baki Berkay Uzel` (@bakiberkay); `Felix Hoops` (@flhps); `Carlo van Driesten` (@jdsika)"

Check failure on line 4 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Berkay'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Berkay'?", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 4, "column": 87}}}, "severity": "ERROR"}

Check warning on line 4 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Parens] Use parentheses judiciously.

Raw Output:
{"message": "[Google.Parens] Use parentheses judiciously.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 4, "column": 27}}}, "severity": "INFO"}
discussions-to: https://github.com/ASCS-eV/EVES/issues/

Check warning on line 5 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Acronyms] Spell out 'EVES', if it's unfamiliar to the audience.

Raw Output:
{"message": "[Google.Acronyms] Spell out 'EVES', if it's unfamiliar to the audience.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 5, "column": 44}}}, "severity": "INFO"}

Check warning on line 5 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Acronyms] Spell out 'ASCS', if it's unfamiliar to the audience.

Raw Output:
{"message": "[Google.Acronyms] Spell out 'ASCS', if it's unfamiliar to the audience.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 5, "column": 36}}}, "severity": "INFO"}
status: Draft
type: Process
created: 2026-02-27
requires: ["EVES-001"]
replaces: None
---

## Abstract

This specification defines the core decentralized identity (DID) architecture and operational lifecycle for the ENVITED-X ecosystem.

Check warning on line 15 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Acronyms] Spell out 'DID', if it's unfamiliar to the audience.

Raw Output:
{"message": "[Google.Acronyms] Spell out 'DID', if it's unfamiliar to the audience.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 15, "column": 61}}}, "severity": "INFO"}

Check warning on line 15 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Parens] Use parentheses judiciously.

Raw Output:
{"message": "[Google.Parens] Use parentheses judiciously.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 15, "column": 60}}}, "severity": "INFO"}
It introduces the application of the `did:ethr` method on the EVM-compatible `Tezos` `Etherlink` layer, describes an IPFS-backed approach for managing Credential Revocation Sets (`CRSet`), and details a Gas Station relay service to provide frictionless setup for ecosystem participants.

Check warning on line 16 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Acronyms] Spell out 'IPFS', if it's unfamiliar to the audience.

Raw Output:
{"message": "[Google.Acronyms] Spell out 'IPFS', if it's unfamiliar to the audience.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 16, "column": 118}}}, "severity": "INFO"}

Check warning on line 16 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Acronyms] Spell out 'EVM', if it's unfamiliar to the audience.

Raw Output:
{"message": "[Google.Acronyms] Spell out 'EVM', if it's unfamiliar to the audience.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 16, "column": 63}}}, "severity": "INFO"}

Check warning on line 16 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.WordList] Use 'app' instead of 'application'.

Raw Output:
{"message": "[Google.WordList] Use 'app' instead of 'application'.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 16, "column": 19}}}, "severity": "WARNING"}

Check warning on line 16 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Google.Parens] Use parentheses judiciously.

Raw Output:
{"message": "[Google.Parens] Use parentheses judiciously.", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 16, "column": 1}}}, "severity": "INFO"}

## Motivation

The ENVITED-X Data Space requires a robust, scalable, and verifiable on-chain identity architecture:

1. **DID Method Verification**: The legacy `SimpulseID` implementation lacked resolvable DID documents on `Tezos` deployments, hindering direct on-chain verification by smart contracts.
2. **Revocation Scalability**: Maintaining extensive Credential Revocation Sets (`CRSet`) purely via EVM smart contracts (or blob transactions) incurs unpredictable costs and storage constraints on Layer 2.
3. **Frictionless Setup**: Requiring Trust Anchors or new Companies to obtain cryptocurrency funds solely to interact with a base registry (for example, delegating authority) creates a significant adoption bottleneck.

Check failure on line 24 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'cryptocurrency'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'cryptocurrency'?", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 24, "column": 79}}}, "severity": "ERROR"}

By standardizing these three pillars—DID Method, Revocation Mechanics, and Sponsored Setup—this document ensures a cohesive, interoperable trust framework.

## Specification

### 1. Decentralized Identifier (DID) Method Selection

The ENVITED-X ecosystem mandates the use of the **`did:ethr`** method, conforming to the [ERC-1056 Smart Contract standard](https://eips.ethereum.org/EIPS/eip-1056).

- **Deployment Layer**: Developers MUST deploy contract instances on EVM-compatible networks, specifically targeting the `Tezos` `Etherlink` L2.
- **Key Management**: The DID identifier remains permanent, while the controller can rotate the `identityOwner` independently of the address via `changeOwner`.
- **Delegation Separation**: Identifiers MUST differentiate between overarching Identity Owners and explicit Delegates (for example, ephemeral hot wallets holding explicit authorization strictly for signing Verifiable Credentials for a limited validity period).
- **Service Endpoints**: Ecosystem actors MUST use the native `setAttribute` feature of the ERC-1056 registry to declare ecosystem services, fundamentally facilitating the `CRSet` mechanism.

### 2. IPFS-Based Credential Revocation Set (`CRSet`)

To avoid excessive on-chain storage while retaining decentralized verifiability, the ecosystem maintains Credential Revocation Sets via IPFS.

#### Workflow Implementation

1. **Storing Revocations**: Using the structure proposed in the `CRSet` protocol, the `Issuer` MUST generate a Bloom Filter Cascade (BFC) reflecting current revoked Verifiable Credentials and store it on IPFS.
2. **CID Declaration**: The issuer MUST publish the calculated Content Identifier (`CID`) as a service endpoint within the `did:ethr` document.
3. **Verification**: A `Verifier` (for example, ENVITED-X backend or another smart contract system) MUST resolve the DID document of the issuer, retrieve the active `CID` from the service entry, fetch the BFC from IPFS, and assess the credential status entirely off-chain.

#### Actor Roles & Control

- **Trust Anchor**: Exercises top-level governance, typically via an M-of-N multi-signature wallet, controlling which overarching Entity/Company identities receive trust.
- **Company**: Holds the overarching organizational DID.
- **Admin**: Entities holding explicit permission (delegated by the Company or Trust Anchor) to update the `CRSet` via the IPFS `CID` linkage in the registry.
- **User (Holder)**: Retains Verifiable Credentials, using them specifically in `OID4VP` processes, passing the `credentialStatus` attribute during presentation.

### 3. Gas Station Relay Service for Setup

To establish frictionless adoption, the ENVITED-X backend implements a Gas Station relay service designed explicitly to handle Company/User setup operations without requiring the initializing party to hold native network tokens.

#### Relay Workflow

1. **Read State**: The Company frontend performs a read operation, requiring no transaction fees, to fetch the current `nonce` of their identity from the deployed `EthereumDIDRegistry`.
2. **Signature Construct**: The frontend constructs an EIP-712 / `keccak256` hash representing the intended `changeOwner` / delegation operation and the user signs it locally.
3. **Relay Execution**: The frontend transmits the signed payload (for example, via `POST /api/onboard`) to the Backend Relay Service.
4. **Validation and Payment**: The Backend Relay Service splits the signature (`v, r, s`), verifies validity against the expected payload, pays the network computational fee, and invokes the `changeOwnerSigned()` function on the ERC-1056 logic contract.

*Note: The team evaluated ERC-4337 (Account Abstraction) but rejected it due to lack of immediate, native compatibility with the canonical `did:ethr` registry without writing intermediary adapter software.*

## Backwards Compatibility

This specification enforces the replacement of undocumented identity mechanics with strict adherence to `did:ethr` standards.
Current infrastructure attempting to query `SimpulseID` generic identifiers or expecting on-chain BFC arrays demands adapter software to index the IPFS `CIDs` referenced within the DID documents.

## References

- [ERC-1056: Ethereum Lightweight Identity](https://eips.ethereum.org/EIPS/eip-1056)

Check failure on line 76 in EVES/EVES-008/eves-008.md

View workflow job for this annotation

GitHub Actions / runner / vale 

[vale] reported by reviewdog 🐶
[Vale.Spelling] Did you really mean 'Ethereum'?

Raw Output:
{"message": "[Vale.Spelling] Did you really mean 'Ethereum'?", "location": {"path": "EVES/EVES-008/eves-008.md", "range": {"start": {"line": 76, "column": 14}}}, "severity": "ERROR"}
- [did:ethr Method Specification](https://github.com/decentralized-identity/ethr-did-resolver)
- [OID4VCI & OID4VP Overview](https://openid.net/sg/openid4vc/)
- [IPFS Content Addressing](https://docs.ipfs.tech/concepts/content-addressing/)
Loading