Authentication

did:web Verification

To further increase trust and bind declarations to verifiable identities, Liccium supports the did method as a way to bind verifiable declarations to real-world domain ownership. The did method allows a declaring party to prove control over both a domain and a cryptographic key.

By publishing a DID document at https://yourdomain.com/.well-known/did.json, the public key used in the declaration becomes discoverable and verifiable – ensuring transparency and accountability.

What is did?

The did method is part of the W3C DID specification. It allows a declaring party to:

• Generate a cryptographic key pair (public/private)
• Use the private key to sign Liccium declarations
• Make the public key discoverable via a URL based on their domain

This ensures that the party controlling the key also controls the corresponding domain – a vital signal for authenticity and traceability.

Example

If your DID is:

Code
 
did:web:example.com

Then your public key must be accessible at:

Code
 
https://example.com/.well-known/did.json

DID Document Structure

The DID document is a JSON file that includes your public key and other metadata.

Example

Code(json)
 
{
  "@context": "https://www.w3.org/ns/did/v1",
  "id": "did:web:your-domain.com",
  "verificationMethod": [
    {
      "id": "did:web:your-domain.com#0",
      "type": "JsonWebKey2020",
      "controller": "did:web:your-domain.com",
      "publicKeyJwk": {
        "kty": "RSA",
        "n": "sXchYzQFKeYj6rNb1CzCBB4piOnD8VwDFlbs2qQoG5RYW8GKvH6XzZmgEyJBSbL7aVo3zY0Q8rMCYMg8Sfd1i6xhViOwLZCRkKrQqPIYTWfppW95OfgMRi1rsyWB64TxLfvhCbiD3l4r9rfZKZx7ehFs50B2iXkC8UMKiS6w-CF8",
        "e": "AQAB",
        "x5t#S256": "WjZhI8mwlIPbyrwffu6Zhv79yy2_lh9Pbz08qa3l25c"
      }
    }
  ],
  "authentication": [
    "did:web:your-domain.com#0"
  ],
  "assertionMethod": [
    "did:web:your-domain.com#0"
  ]
}

This file enables any third party to:

• Retrieve your public key from your domain
• Validate that the key used to sign the declaration matches what's published
• Confirm that the declaring party has control over both the domain and the cryptographic key

Why did?

• No blockchain dependency – identities are linked to real-world web domains.
• Human-readable – the DID resolves directly to a trusted HTTPS location.
• Compatible with Liccium's VC and certificate authentication model.

Binding to Declarations

The declaration must be signed using the private key corresponding to the public key in your DID document.

In addition, if you're using:

• A Verifiable Credential: it must be issued to the subject identified by the DID.
• A Qualified Certificate: the public key in the certificate must match the DID's key.

This cryptographic binding enables Liccium to validate declarations without requiring a central authority, relying instead on domain-based proof and standard public key infrastructure.