papers/lux-trust-kernel/sections/05-i-chain-decentralized-identity.tex

\section{I-Chain: Decentralized Identity}
\label{sec:ichain}
%% ===================================================================

The I-Chain implements the \texttt{did:lux:*} method as specified in
\cite{lux-id-did-specification}. Within the trust kernel, the I-Chain serves
as the root of all identity assertions.

\subsection{DID Document Structure}

\begin{definition}[Lux DID]\label{def:did}
A Lux DID has the form \texttt{did:lux:<method-specific-id>} where the
method-specific identifier is derived from the subject's initial public key:
\[
    \mathsf{msid} = \mathsf{Base58}(\mathsf{RIPEMD160}(\mathsf{SHA256}(\mathsf{pk}_0)))
\]
The DID document contains verification methods (public keys), authentication
relationships, service endpoints, and a controller field.
\end{definition}

Each DID document is registered on the I-Chain as an immutable record. Updates
produce new versions linked to the previous version by hash, forming a verifiable
history chain.

\subsection{Verifiable Credentials}

The I-Chain supports W3C Verifiable Credentials with Lux-specific extensions:
\begin{itemize}
    \item \textbf{Credential issuance}: an issuer signs a credential binding a
          claim to a subject DID and registers the credential hash on the I-Chain.
    \item \textbf{Credential verification}: a verifier checks the issuer's
          signature and confirms the credential hash exists on-chain with status
          $\textsc{active}$.
    \item \textbf{Credential revocation}: the issuer submits a
          \textsc{RevokeCredential} transaction; the credential's on-chain status
          changes to $\textsc{revoked}$.
\end{itemize}

\subsection{ZK Selective Disclosure}

Credentials may be presented with zero-knowledge selective disclosure. The holder
generates a ZK proof that demonstrates possession of a credential satisfying a
predicate (e.g., ``age $\geq$ 18'') without revealing the full credential.

\begin{definition}[Selective Disclosure Proof]\label{def:zksd}
Given a credential $C$ with attributes $\{a_1, \ldots, a_k\}$ and a predicate
$\phi$ over a subset of attributes, the holder produces a proof $\pi$ such that:
\[
    \mathsf{Verify}(\pi, \phi, \mathsf{issuer\_pk}, \mathsf{holder\_did}) = \top
    \iff \phi(a_{i_1}, \ldots, a_{i_m}) = \top
\]
where $\{i_1, \ldots, i_m\} \subseteq \{1, \ldots, k\}$ and no information
about attributes outside the predicate is revealed.
\end{definition}

\subsection{Credential Revocation via Accumulator}

The I-Chain maintains a cryptographic accumulator for credential revocation.
Adding a credential hash to the revocation accumulator constitutes revocation.
Verification requires a non-membership witness: the holder proves their credential
is \emph{not} in the revocation set without downloading the full revocation list.

%% ===================================================================