Personal Identity in Sonr

Summary

Sonr implements decentralized identity through W3C DIDs and WebAuthn for passwordless authentication. Users create self-sovereign identities in 30 seconds using biometrics. Personal Vaults act as user agents, managing permissions and interactions. The system eliminates seed phrases while maintaining security through MPC and social recovery.

Identity Architecture

Core Components

Sonr's identity system consists of four integrated components:

1. DID Documents: W3C-compliant identifiers storing public keys and service endpoints
2. WebAuthn Credentials: Device-based authentication using biometrics or PIN
3. Personal Vaults: User-controlled agents managing permissions and data
4. MPC Key Management: Distributed key shares preventing single points of failure

Identity Model

Each Sonr identity follows this structure:

did:sonr:alice123
├── DID Document (on-chain)
│   ├── Public Keys
│   ├── Service Endpoints
│   └── Controller Info
├── WebAuthn Credentials (device)
│   ├── Private Key (hardware-backed)
│   └── Attestation Data
└── Personal Vault (distributed)
    ├── MPC Key Shares
    ├── Permissions (UCANs)
    └── User Data (IPFS)

Technical Implementation

W3C DID Specification

Sonr implements the W3C Decentralized Identifier v1.0 specification:

{
  "@context": "https://www.w3.org/ns/did/v1",
  "id": "did:sonr:alice123",
  "verificationMethod": [
    {
      "id": "did:sonr:alice123#key-1",
      "type": "JsonWebKey2020",
      "controller": "did:sonr:alice123",
      "publicKeyJwk": {
        "kty": "EC",
        "crv": "P-256",
        "x": "...",
        "y": "..."
      }
    }
  ],
  "authentication": ["did:sonr:alice123#key-1"],
  "service": [
    {
      "id": "did:sonr:alice123#vault",
      "type": "PersonalVault",
      "serviceEndpoint": "https://vault.sonr.io/alice123"
    }
  ]
}

WebAuthn Integration

Authentication uses the W3C Web Authentication API:

Key Management

Sonr uses Multi-Party Computation (MPC) for key security:

1. Key Generation: Creates key shares during registration
2. Share Distribution: Stores shares across validator nodes
3. Threshold Signing: Requires k-of-n shares to sign
4. Share Refresh: Periodically rotates shares for security

Security Model

Authentication Factors

Sonr implements multi-factor authentication:

• Something you have: Device with WebAuthn credential
• Something you are: Biometric verification
• Something you control: Access to your Vault

Privacy Features

The system protects user privacy through:

1. Selective Disclosure: Share only required attributes
2. Zero-Knowledge Proofs: Prove claims without revealing data
3. Encrypted Storage: User data encrypted in IPFS
4. Minimal On-Chain Data: Only public keys and endpoints

Recovery Mechanisms

Users recover accounts through multiple methods:

User Experience

Account Creation

Users create accounts in three steps:

1. Visit any Sonr-enabled site
2. Click "Create Account"
3. Authenticate with biometrics

No downloads, extensions, or seed phrases required.

Authentication Flow

Returning users authenticate simply:

1. Click "Sign In"
2. Approve biometric prompt
3. Access granted

The browser handles credential management automatically.

Permission Management

Users control permissions through their Vault:

// Service requests permission
{
  "action": "transfer",
  "resource": "wallet",
  "amount": "100 USDC",
  "recipient": "bob@sonr.id",
  "expires": "2024-12-31"
}

// User sees human-readable prompt
"Allow PaymentApp to send 100 USDC to bob@sonr.id?
This permission expires on Dec 31, 2024."

Integration Patterns

For Web Applications

Integrate Sonr identity using standard web APIs:

<!-- Simple authentication button -->
<button onclick="sonr.authenticate()">Sign in with Sonr</button>

For Service Providers

Services interact through the Vault API:

1. Request capabilities from user's Vault
2. Receive time-bound permissions
3. Execute authorized operations
4. Handle revocations gracefully

For Enterprise Systems

Sonr provides enterprise integration through:

• OIDC Bridge: Compatible with existing IAM systems
• SAML Support: Federation with enterprise directories
• Audit Logs: Cryptographic proof of all operations
• Compliance Tools: GDPR and regulatory compliance

Use Cases

Digital Credentials

Issue and verify credentials without central authority:

Cross-Platform Identity

Use one identity across all services:

• Gaming: Portable achievements and assets
• Social: Own your social graph
• Finance: Universal KYC/AML compliance
• Commerce: Unified payment preferences

Privacy-Preserving Services

Build applications that respect user privacy:

1. Anonymous voting with verified eligibility
2. Private messaging with authenticated senders
3. Selective disclosure for regulatory compliance
4. Decentralized reputation without surveillance

Implementation Guide

Creating a DID

Services create DIDs for users programmatically:

const identity = await sonr.createIdentity({
  displayName: "Alice Smith",
  authenticator: "platform", // Use device biometrics
  recovery: {
    social: ["bob@sonr.id", "carol@sonr.id"],
    threshold: 2,
  },
});

Verifying Identity

Verify user identity claims:

const verified = await sonr.verifyCredential({
  credential: userCredential,
  checks: ["signature", "expiration", "revocation"],
});

Managing Permissions

Grant and revoke permissions dynamically:

// Grant permission
const permission = await vault.grant({
  service: "app.example.com",
  capability: "read_profile",
  expiration: "24h",
});

// Revoke permission
await vault.revoke(permission.id);

Best Practices

For Developers

1. Use WebAuthn properly: Let browsers handle credential management
2. Request minimal permissions: Only ask for what you need
3. Handle revocations: Check permissions before operations
4. Respect user privacy: Implement selective disclosure

For Users

1. Register multiple devices: Ensure account recovery options
2. Review permissions regularly: Revoke unused authorizations
3. Use social recovery: Add trusted contacts for backup
4. Keep devices secure: WebAuthn credentials are device-bound

Next Steps

Learn how Sonr's identity system integrates with other components by exploring our architecture documentation or dive into specific implementation details in our reference guides.