Summary
Self-sovereign does not mean self-asserted. In fact, self-sovereign identity is squarely aimed creating a model where people can bring to bear evidence from trusted parties to any interaction.
From time to time, I run across the idea that self-sovereign identity (SSI) systems like Sovrin are necessarily self-asserted. This is the myth: that SSI means that the person gets to say anything they want and the relying party just has to accept it. This is NOT what SSI means.
Sovrin is an identity metsystem based on the exchange of verifiable credentials. The verifiable credential pattern is shown in the figure below.
There are three parties: the credential issuer, the credential holder (identity owner), and the credential verifier. So, imagine that a company (issuer) has given Alice (holder) an employment credential. Alice can then present information from that credential to her bank (verifier). In this example, the information Alice is presenting to the bank is not self-asserted. Rather, Alice's employer is asserting it.
Why does the bank trust it? They might not. The verifier is free to determine whether or not to trust the credential. In making that determination, there are two kinds of evidence the bank needs. First, the bank needs to trust that the exchange process is secure. Specifically, they are interested in determining that the credential was issued to the presenter, that is hasn't been tampered with, and that it hasn't been revoked. These properties can be validated cryptographically.
Second, they are interested in who issued the credential and whether they trust the issuer. The issuer can be identified in a trustworthy way in the credential. But whether the bank trusts that it's a real employer is not a crypotographic question. They might know the employer through other means or they might need to have the employer prove things about themselves. But either way, they have to have a process for determining whether or not to trust the issuer.
In Sovrin, people hold numerous credentials from a variety of issuers, just like we do in the physical world. They use those credentials to prove things about themselves to relying parties. They may, as part of the interaction, self assert information when that's acceptable to the relying party. But they also have the means of bringing trustworthy evidence from other parties to the interaction. This is not easy to do online using current identity systems. But that changes when when people can use credentials from multiple issuers to prove things about themselves.
Photo Credit: Passport Stamp from Max Pixel (CC0)
