Bridging IndiaStack with W3C Standards
India possesses the world's largest digital identity project: Aadhaar. However, Aadhaar was designed as a central database verification system. To enable a truly portable, privacy-preserving identity ecosystem, we need to bridge this central root of trust with decentralised standards.
The bridge is the Decentralised Identifier (DID).
What is a DID?
A DID is a new type of identifier that enables verifiable, decentralised digital identity. Unlike a bank account number or an Aadhaar number, a DID is not issued by a central authority. It is generated by the user and anchored to an immutable registry.
A typical DID in the AssureLocker ecosystem looks like this: did:web:ind.id.assurelocker.com:holder:1a2b3c4d5e...
- did: The URI scheme.
- web: The DID Method — W3C
did:web, resolvable over HTTPS with standard tooling (no proprietary resolver). - ind.id.assurelocker.com: The resolution host — the ind subdomain is the jurisdiction (ISO 3166-1 alpha-3), served from that region.
- holder: The actor type (holder, issuer, or verifier).
- 1a2b3c...: The unique identifier string.
The Anchoring Process
AssureLockeruses Aadhaar as the "source of truth" to bootstrap a DID. Here is how the anchoring works:
- Authentication: The user authenticates via Aadhaar OTP (eKYC).
- Key Generation: A unique cryptographic key pair is generated on the user's device (often secured by FIDO2/Passkeys).
- DID Creation: AssureLockercreates a DID Document that links the user's public key to a unique DID.
- Registry Anchoring: The DID (or a hash of the DID Document) is recorded in an immutable registry, making it immutable and globally resolvable.
Crucial Detail:The Aadhaar number is never stored in the registry. The registry only contains the DID and the public key. The link between the Aadhaar identity and the DID is a "Verifiable Credential" held privately by the user.
Why Aadhaar-Anchored DIDs?
Using DIDs instead of raw identifiers solves three critical problems:
1. Portability
Once a DID is established and anchored, the user can use it to interact with any service provider in the AssureLocker network without ever needing to perform a full Aadhaar eKYC again.
2. Privacy-Preserving Verification
Because the verifier checks the DID in the registry, they don't need to ping a central government database for every transaction. This reduces the footprint of the user across the internet.
3. Key Management
By anchoring the DID to a public key, we enable passwordless authentication. A user “proves” their identity by signing a challenge with their private key, which the verifier validates against the public key linked to the DID in the registry.
The Future of Identity in India
Aadhaar-anchored DIDs represent the next evolution of IndiaStack. By moving from "Identity as a Database Check" to "Identity as a Cryptographic Proof," we enable a more secure, faster, and more private financial ecosystem for everyone.