Skip to content

Commit 5196c50

Browse files
crandmckcrandmck
authored
Merge pull request #212 from contentauth/cawg-id
Initial docs for CAWG identity
2 parents a0be81b + 113f6c3 commit 5196c50

File tree

3 files changed

+176
-0
lines changed

3 files changed

+176
-0
lines changed

‎docs/manifest/cawg-id.md‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
---
2+
id: cawg-id
3+
title: CAWG identity assertions
4+
---
5+
6+
The [Creator Assertions Working Group (CAWG)](https://cawg.io/) identity assertion enables a credential holder to prove control over a digital identity and to use that identity to document a content creator’s role(s) in a C2PA asset’s lifecycle.
7+
8+
There are two different ways to provide identity assertions:
9+
10+
- Using an [X.509 certificate](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures) to sign the identity claims. Enterprises or large organizations can use this approach to assert their identity in a particular trust ecosystem; for example, a news organization or publisher. The SDK can validate and sign these claims.
11+
- Using an [identity claim aggregator](https://cawg.io/identity/1.1/#_identity_claims_aggregation). Individuals can use this approach to document their role in creating an asset by using identity signals collected and verified by a third-party aggregator. The SDK can validate these claims only. Signing is not supported.
12+
13+
:::note
14+
The SDK can validate claims for both kinds of identity assertions, but can only sign claims for identity assertions using an X.509 certificate.
15+
:::
16+
17+
## Using an X.509 certificate
18+
19+
When providing an identity assertion by using an X.509 certificate, the value of `signer_payload.sig_type` must be `cawg.x509.cose`. The signature value must be a COSE signature as described in the [CAWG Identity Assertion technical specification](https://cawg.io/identity/1.1/#_x_509_certificates_and_cose_signatures).
20+
21+
## Using an identity claim aggregator
22+
23+
As defined in the [CAWG Identity Assertion technical specification](https://cawg.io/identity/1.1/#_identity_claims_aggregation), content creators may wish to document their role in creating an asset using identity signals such as:
24+
- Verified web sites
25+
- Social media accounts
26+
- Official ID documentation
27+
- Professional accreditations
28+
- Organizational affiliations
29+
30+
To facilitate the use of such identity signals, the content creator may use the services of a trusted third-party intermediary known as a _identity claims aggregator_ to gather these signals and to restate them on their behalf.
31+
32+
The identity claims aggregator:
33+
34+
- Collects and verifies identity attestation claims from various identity providers such as social media sites and ID verification vendors.
35+
- Creates a unique asset-specific credential that binds the identity attestation claims to a specific asset.
36+
37+
## Identity assertion
38+
39+
An identity assertion using an identity claims aggregator has this general form in JSON:
40+
41+
```json
42+
"assertions": [
43+
...
44+
{
45+
"label": "cawg.identity",
46+
"data": {
47+
"@context": [
48+
"https://www.w3.org/ns/credentials/v2",
49+
"https://cawg.io/identity/1.1/ica/context/"
50+
],
51+
"type": [
52+
"VerifiableCredential",
53+
"IdentityClaimsAggregationCredential"
54+
],
55+
"issuer": "did:web:connected-identities.identity.adobe.com",
56+
"validFrom": "2025-04-29T17:34:44Z",
57+
"verifiedIdentities": [
58+
{
59+
"type": "cawg.<type>",
60+
"username": "<string>",
61+
"uri": "<uri>",
62+
"verifiedAt": "<DateTime>",
63+
"provider": {
64+
"id": "<string>",
65+
"name": "<string>"
66+
}
67+
},
68+
...
69+
]
70+
}
71+
}
72+
]
73+
```
74+
75+
### Verified identity types
76+
77+
The following table describes the allowed values of the `type` property of `verifiedIdentities` array elements.
78+
79+
| Value | Meaning |
80+
|--------------|----------|
81+
| `cawg.document_verification` | The identity provider verified one or more government-issued identity documents presented by the content creator.
82+
| `cawg.web_site` | The content creator has proven control over a specific domain to the identity claims aggregator._
83+
| `cawg.affiliation` | The identity provider is attesting to the content creator’s membership in an organization. This could be a professional organization or an employment relationship.
84+
| `cawg.social_media` | The content creator has demonstrated control over an account (typically a social media account) hosted by the identity provider.
85+
| `cawg.crypto_wallet` | The content creator has demonstrated control over an account (typically a crypto-wallet) hosted by the identity provider.
86+
87+
:::note
88+
The above table is based on the [CAWG identity assertion technical specifications](https://cawg.io/identity/1.1/#vc-credentialsubject-verifiedidentity-type).
89+
:::
90+
91+
### Example
92+
93+
```json
94+
"assertions": [
95+
...
96+
{
97+
"label": "cawg.identity",
98+
"data": {
99+
"@context": [
100+
"https://www.w3.org/ns/credentials/v2",
101+
"https://cawg.io/identity/1.1/ica/context/"
102+
],
103+
"type": [
104+
"VerifiableCredential",
105+
"IdentityClaimsAggregationCredential"
106+
],
107+
"issuer": "did:web:connected-identities.identity.adobe.com",
108+
"validFrom": "2025-04-29T17:34:44Z",
109+
"verifiedIdentities": [
110+
{
111+
"type": "cawg.social_media",
112+
"username": "xyz",
113+
"uri": "https://www.instagram.com/xyz",
114+
"verifiedAt": "2024-10-08T18:04:08Z",
115+
"provider": {
116+
"id": "https://instagram.com",
117+
"name": "instagram"
118+
}
119+
},
120+
{
121+
"type": "cawg.social_media",
122+
"username": "xyz",
123+
"uri": "https://www.behance.net/xyz",
124+
"verifiedAt": "2024-10-22T19:31:17Z",
125+
"provider": {
126+
"id": "https://behance.net",
127+
"name": "behance"
128+
}
129+
},
130+
{
131+
"type": "cawg.social_media",
132+
"username": "J Smith",
133+
"uri": "https://www.linkedin.com/in/jsmith",
134+
"verifiedAt": "2024-10-08T18:03:41Z",
135+
"provider": {
136+
"id": "https://linkedin.com",
137+
"name": "linkedin"
138+
}
139+
},
140+
{
141+
"type": "cawg.social_media",
142+
"username": "xyz",
143+
"uri": "https://twitter.com/xyz",
144+
"verifiedAt": "2024-10-08T18:03:49Z",
145+
"provider": {
146+
"id": "https://twitter.com",
147+
"name": "twitter"
148+
}
149+
}
150+
],
151+
"credentialSchema": [
152+
{
153+
"id": "https://cawg.io/identity/1.1/ica/schema/",
154+
"type": "JSONSchema"
155+
}
156+
]
157+
}
158+
}
159+
...
160+
]
161+
```
162+

‎scripts/fetch-readme.js‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,11 @@ const readmes = [
179179
repo: 'contentauth/c2pa-rs',
180180
path: 'docs/usage.md',
181181
},
182+
{
183+
dest: resolve(__dirname, '../docs/rust-sdk/docs/cawg-id.md'),
184+
repo: 'contentauth/c2pa-rs',
185+
path: 'docs/cawg-identity.md',
186+
},
182187
{
183188
dest: resolve(__dirname, '../docs/rust-sdk/docs/release-notes.md'),
184189
repo: 'contentauth/c2pa-rs',

‎sidebars.js‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,10 @@ const sidebars = {
4545
type: 'doc',
4646
id: 'manifest/manifest-validation',
4747
},
48+
{
49+
type: 'doc',
50+
id: 'manifest/cawg-id',
51+
},
4852
{
4953
type: 'doc',
5054
id: 'manifest/manifest-examples',
@@ -231,6 +235,11 @@ const sidebars = {
231235
id: 'rust-sdk/docs/supported-formats',
232236
label: 'Supported media formats',
233237
},
238+
{
239+
type: 'doc',
240+
id: 'rust-sdk/docs/cawg-id',
241+
label: 'Using CAWG identity assertions',
242+
},
234243
{
235244
type: 'doc',
236245
id: 'rust-sdk/docs/release-notes',

0 commit comments

Comments
 (0)