Scale mutual trust using lightweight, short-lived, revocable, attribute-based credentials.
Credentials
An Ockam Credential is a signed attestation by an Issuer about the Attributes of Subject. The Issuer and Subject are both Ockam Identities. Attributes is a list of name and value pairs.
Issuing Credentials
Any Ockam Identity can issue credentials about another Ockam Identity.
» ockam identity create a
✔︎ Identity P8b604a07640ecd944f379b5a1a5da0748f36f76327b00193067d1d8c6092dfae
created successfully as a
» ockam identity create b
✔︎ Identity P5c14d09f32dd27255913d748d276dcf6952b7be5d0be4023e5f40787b53274ae
created successfully as b
» ockam credential issue --as a --for $(ockam identity show b)
Subject: P5c14d09f32dd27255913d748d276dcf6952b7be5d0be4023e5f40787b53274ae
Issuer: P8b604a07640ecd944f379b5a1a5da0748f36f76327b00193067d1d8c6092dfae
Created: 2023-04-06T17:05:36Z
Expires: 2023-05-06T17:05:36Z
Attributes: {}
Signature: 6feeb038f0cdc28a16fbe3ed4f69feee5ccce3d2a6ac8be83e76180e7bbd3c6e0adbe37ed73c75bb3c283807ec63aeda42dd79afd3813d4658222078cad12705
The Issuer can include specific attributes in the attestation:
» ockam reset -y
» ockam identity create a
» ockam identity create b
» ockam credential issue --as a --for $(ockam identity show b) \
--encoding hex > b.credential
» ockam credential verify --issuer $(ockam identity show a) \
--credential-path b.credential
✔︎ Credential is valid
Storing Credentials
» ockam credential store c1 --issuer $(ockam identity show a --full --encoding hex) \
--credential-path b.credential
✔︎ Credential c1 stored
Trust Anchors
Trust and authorization decisions must be anchored in some pre-existing knowledge.
Anchoring Trust in an Access Control List (ACL) of Identifiers
In the previous section about Ockam Secure Channels we ran an example of mutual authorization using pre-existing knowledge of Ockam Identifiers. In this example n1 knows i2 and n2 know i1: