did:key

Protocolo de Identidad

A ledger-independent DID method in which the identifier is the public key itself: a did:key DID is a multibase-encoded, multicodec-prefixed public key, and the entire DID document is derived deterministically from it by the resolver. There is no registry, no network, no ledger and no lookup — resolution is a pure local function with no I/O. The trade-off is total: because nothing is stored anywhere, keys cannot be rotated and the DID cannot be updated or deactivated. It is the baseline method supported by essentially every SSI toolchain, and the structural floor for capture risk in the entire decentralized-identity space.

Comunidad
Enlaces
Visitar Comunidad

Detalles

Licencia Open specification (W3C CCG document licence); numerous permissively licensed independent implementations across JavaScript, Rust, Python, Java, Go and Swift
Estado de Desarrollo 🟢 Activo
Propietario W3C Credentials Community Group — specification authors Manu Sporny, Dmitri Zagidulin and Dave Longley (as listed in the W3C DID Extensions methods registry)
Órgano de Gobierno W3C Community Group (Credentials Community Group)
País International (W3C Community Group process; contributors principally USA-based)
Año de Inicio 2019
Stack Language-agnostic specification; resolution is a pure function over multicodec/multibase encoding with no network dependency
Financiamiento N/A — no ongoing funding required; specification work carried out by W3C CCG participants
Última Investigación 1 jul 2026

Dominios de Caso de Uso

Evolución de Plataformas y Soberanía

Protocolo de Identidad Atributos

Orígenes Self-sovereign identity — created to provide the simplest possible conformant DID method, usable for ephemeral and pairwise identifiers, testing, and any case where no persistent infrastructure should be required
Base de Datos N/A — no storage of any kind. The DID document is computed from the identifier itself
Lenguaje de Consulta N/A — resolution is a local deterministic transformation requiring no query or network request
Formatos de Datos W3C DID Document generated deterministically; identifier is multibase-encoded multicodec public key material. Supported key types include Ed25519, X25519, secp256k1, P-256/P-384/P-521 and RSA
Soporte Móvil Library-level — implemented inside resolver libraries and wallets; no standalone application
Soporte Web N/A as infrastructure — resolution requires no web request at all; resolver libraries run in browsers, but the method depends on no web service
Aplicaciones Nativas Library-level — embedded in resolver libraries; no standalone application
Términos Free — no fees, no registration, no infrastructure
Fondos N/A
Basado En W3C DID Core 1.0; multicodec and multibase (Multiformats) for key encoding; the underlying signature algorithms themselves
Permisos Cryptographic — key control is the whole of the authorization model
Autenticación e Identidad Self-certifying in the strongest sense — the identifier is the public key, so binding between identifier and key material is definitional and requires no verification step, no registry and no third party
Modelo de Almacenamiento None — nothing is stored. The DID document exists only as a derivation performed at resolution time
Interoperabilidad Universal within the W3C DID ecosystem — supported by essentially every DID resolver, wallet and VC library; commonly used as the default method in test suites and as the fallback where no infrastructure is available
Portabilidad de Datos Complete but immutable — the DID is portable everywhere because it depends on nothing, but it can never be updated, so portability and rigidity are the same property
Gobernanza y Toma de Decisiones W3C Credentials Community Group — open participation, consensus process, public repository
Madurez del Protocolo / Estandarización Registered W3C DID method with universal implementation support, but the specification remains a W3C CCG draft rather than a Recommendation. Maturity in practice comes from ubiquity of implementation rather than formal status
Estándares de Identidad W3C DID Core 1.0; Multiformats (multicodec, multibase); registered in the W3C DID Extensions methods registry
Métodos DID Soportados did:key (defines this method)
Gestión de Claves None — no rotation, no update, no deactivation. A compromised or lost key means the identifier is permanently unusable; the only remedy is to issue a new DID. This is the method's defining limitation
Tipos de Credenciales N/A — a DID method specification; defines no credential types. Compatible with W3C Verifiable Credentials issued against identifiers of this method
Método de Verificación Deterministic derivation — the verification method is computed directly from the identifier, so verification requires no external lookup and cannot be tampered with in transit
Funciones de Privacidad Well suited to pairwise and ephemeral identifiers — since creation costs nothing and touches no registry, a fresh did:key can be generated per relationship or per interaction, avoiding correlation. Nothing is ever published
Métodos de Autenticación Cryptographic signature by the private key corresponding to the identifier
Mecanismo de Revocación None — a did:key cannot be revoked or deactivated. Revocation must be handled at the credential or relationship layer instead
Tipos de Agentes Soportados Any key-controlling entity — individuals, organizations, services and devices
Tipos de Billetera/Cliente SDK / library integration — resolver implementations across the SSI tooling ecosystem; no method-specific wallet
Mecanismos de Recuperación None — no recovery is possible by design; loss of the private key is terminal for that identifier
Cumplimiento / Regulaciones Not addressed by the specification. Its lack of rotation and revocation makes it unsuitable on its own for regimes requiring key lifecycle management
Protocolos de Intercambio de Credenciales Compatible with any protocol that resolves W3C DIDs, including DIDComm and OpenID4VC; frequently used for ephemeral holder-binding keys in credential presentation
Marco de Confianza Pure cryptography — no trust anchor exists or is needed; the identifier and the key are the same object
Modelo de Costos Free — zero marginal cost per identifier; creation is a local key generation
Resistencia a la Censura Maximal — there is no registry to block, no host to seize, no operator to compel and no network request to intercept. Resolution works offline and indefinitely