papers/zoo-identity-chain/sections/07-self-issued-credentials.tex

\section{Self-Issued Credentials}


\subsection{Motivation}

Not all identity claims require external verification. A user may self-assert preferences, pseudonymous handles, or application-specific attributes. \IChain{} supports self-issued credentials that are signed by the subject's own DID keys.

\subsection{Trust Levels}

\IChain{} defines a trust hierarchy for credentials:

\begin{table}[h]
\centering
\begin{tabular}{clp{6cm}}
\toprule
\textbf{Level} & \textbf{Type} & \textbf{Description} \\
\midrule
0 & Self-issued & Signed by subject only. No external verification. \\
1 & Peer-vouched & Endorsed by $k$ peers with Level $\geq$ 1 credentials. \\
2 & Trusted issuer & Issued by a TIR-registered entity. \\
3 & Validator-issued & Threshold-signed by validator committee. \\
\bottomrule
\end{tabular}
\caption{Credential trust levels}
\label{tab:trust-levels}
\end{table}

Verifiers specify minimum trust levels in their verification policies. A DeFi protocol might require Level 3 for KYC credentials but accept Level 0 for display names.

\subsection{Vouch Chains}

Level 1 (peer-vouched) credentials use a vouching mechanism formalized in \texttt{Trust/Vouch.lean}:

\begin{definition}[Vouch Chain]
A vouch chain for credential $c$ is a directed acyclic graph $G = (V, E)$ where each node is a DID and each edge $(d_i, d_j)$ represents $d_i$ vouching for $d_j$'s claim. The credential reaches Level 1 when $|\{d_i : (d_i, \text{subject}(c)) \in E\}| \geq k$.
\end{definition}