ssi icon indicating copy to clipboard operation
ssi copied to clipboard

Optimize DID resolution in proof verification

Open clehner opened this issue 3 years ago • 0 comments

Currently, when verifying a VC or VP, the issuer/holder id is usually resolved twice: once to verify that the proof's verification method has the appropriate verification relationship with the issuer in its DID document, and then again when verifying the proof, to dereference the verification method and get the key material to perform verification. With did:web, this results in two HTTPS requests. Other DID+VC implementations perform similarly. While resolving a did:key may be fast and cheap, HTTP(S) requests are more expensive and may be slow: https://github.com/w3c-ccg/vc-http-api/issues/173. It may therefore be desirable to have verification do only one DID resolution when possible. This could be accomplished in one of two ways:

  1. Cache/memoize DID resolution during verification. i.e. in the verify function, and/or outside it, wrap the resolver in a new struct, e.g. MemoizedResolver, that implements and memoizes DIDResolver. Since the DIDResolver trait methods take an immutable reference to the DIDResolver trait object, either those trait functions would have to be changed to use mutable references, or the MemoizedResolver would need to use interior mutability, e.g. with RefCell. Caching resolution results would also be useful if verifying the proof requires verifying additional proofs, e.g. fetching a verifying a revocation list / status list credential.
  2. Refactor verification to require only one DID resolution when the verification method is defined in the issuer's DID document. We have the beginnings of this in #253 in the get_verification_methods function. The ProofSuite functions in src/ldp.rs could be changed to take a VerificationMethodMap argument instead of dereferencing the VM id on its own.

Also: https://github.com/spruceid/didkit/issues/39

clehner avatar Aug 23 '21 13:08 clehner