Uniqueness (or not) of attribute names


#1

Are attribute names expected to be globally unique?

The reasons I ask it that then way matching of claim proof is done (_showMatchingClaimProof in sovrin_client.cli.cli.SovrinCli) seems to assume so. The method goes through available claims and then tries to match attributes in a first-come-first-served manner. So it might take an attribute which is not relevant. Here is an example where the attribute status is used in two different claims. A first claim was issued to Alice and it include a status attribute. Later a show proof request Job-Application is sent to Acme and here is part of the output:

The Proof is constructed from the following claims:

Claim [1] (Customer-Balance-Cert v0.1 from TestAgent)
      customer_number: 73825912
      amount: 50
    * status: Paid

Claim [2] (Transcript v1.2 from Faber College)
      student_name: Alice Garcia
    * ssn: 123-45-6789
    * degree: Bachelor of Science, Marketing
      year: 2015
      status: graduated

Is there a way to force the proper matching?


#2

Hi Fabien - that’s an excellent question. There is an expectation is that the Sovrin Foundation will publish some standards on this. However, due to the open nature of Sovrin it is not going to be something which can be policed. And in any event you may have multiple claim definitions containing name and address for example.

A way to address this will be for a trust framework to create a claim definition, and then to provide an attribute or claim of membership to its member organisations. So you could have a global bank trust framework that standardises the way a bank creates a customer summary claim definition for example. Included in that claim would be the fact that it comes from a bank which is part of this trust framework.

This means that you could request from the customer a claim containing name and address and also the trust framework membership attribute. This would allow the agent to look up the relevant attribute correctly to create the proof, and avoid the agent accidentally pulling name and address attributes from a claim written by a sports club.

In any case, the relying party will always be able to look up the issuer of the proof and determine whether to trust the issuer or not.


#3

Thanks @AndyTobin
It seems to me (through the debugging I’ve done) that the existing code-base does not currently support this. So I’m wondering whether it’s on code road-map and which way you plan to go.


#4

Hi @fabienpe - correct, it’s not there at the moment. Lots happening in the agent sphere at the moment as you know. I’m not close enough to the agent roadmap myself but will check with the team.


#5

Just a short note that both schema and attribute uniqueness is a key requirement of interoperability. I have not sync’d up with the architecture team on this but there are several classic ways to handle it. The most prevalent are:

  • Give the schema a URI and every attribute a fragment ID relative to that URI.
  • Give the schema a URI and every attribute its own unique URI.

I myself would vote for giving every Sovrin schema a DID and then every attribute in that schema a DID fragment ID relative to the schema DID. See the DID specification for more about DID fragments.