ssi
ssi copied to clipboard
Optimize DID resolution in proof verification
Currently, when verifying a VC or VP, the issuer/holder id is usually resolved twice: once to verify that the proof's verification method has the appropriate verification relationship with the issuer in its DID document, and then again when verifying the proof, to dereference the verification method and get the key material to perform verification. With did:web
, this results in two HTTPS requests.
Other DID+VC implementations perform similarly.
While resolving a did:key
may be fast and cheap, HTTP(S) requests are more expensive and may be slow: https://github.com/w3c-ccg/vc-http-api/issues/173. It may therefore be desirable to have verification do only one DID resolution when possible. This could be accomplished in one of two ways:
- Cache/memoize DID resolution during verification. i.e. in the verify function, and/or outside it, wrap the resolver in a new struct, e.g. MemoizedResolver, that implements and memoizes DIDResolver. Since the DIDResolver trait methods take an immutable reference to the DIDResolver trait object, either those trait functions would have to be changed to use mutable references, or the MemoizedResolver would need to use interior mutability, e.g. with RefCell. Caching resolution results would also be useful if verifying the proof requires verifying additional proofs, e.g. fetching a verifying a revocation list / status list credential.
- Refactor verification to require only one DID resolution when the verification method is defined in the issuer's DID document. We have the beginnings of this in #253 in the
get_verification_methods
function. TheProofSuite
functions insrc/ldp.rs
could be changed to take aVerificationMethodMap
argument instead of dereferencing the VM id on its own.
Also: https://github.com/spruceid/didkit/issues/39