Midnight DID Method Traits
This document summarizes how the Midnight DID method aligns with the DID Method Traits maintained by the Decentralized Identity Foundation.
Core Identifier Traits
| Trait | Status | Notes |
|---|---|---|
| Deterministic / namespaced | ✔ | did:midnight:{network}:{64-hex} derived from contract address; avoids collisions across networks. |
| Self-certifying | △ | DID value is not derived from controller key; security anchored in on-chain contract + wallet-local controller signatures. |
| Ledger anchored | ✔ | All CRUD operations interact with Midnight ledger smart contract. |
| Method-specific syntax | ✔ | Defined in Midnight DID Method §2; conforms to RFC3986 and W3C-DID requirements. |
CRUD Lifecycle Traits
| Trait | Status | Notes |
|---|---|---|
| Create | ✔ | Contract deployment creates DID state. |
| Read / Resolve | ✔ | packages/did/src/ledger-to-domain.ts reconstructs DID Document from ledger state. |
| Update | ✔ | Individual contract circuits handle adds/updates/removals with controller-signature authorization. |
| Deactivate | ✔ | Deactivation operation prevents further updates. |
| Recover | ✔ | Dedicated recoveryAuthorityPublicKey authorizes recoverControllerKey to rotate the active controller key. Threshold/social recovery and recovery-authority rotation remain outside this method version. |
Verification Method Traits
| Trait | Status | Notes |
|---|---|---|
| Key rotation / revocation | ✔ | Add/Update/RemoveVerificationMethod + relation ops. |
| Key type diversity | △ | Restricted to explicit JWK profiles (RFC7517) (OKP/Ed25519/X25519/BLS12381G1/BLS12381G2, EC/Jubjub/P-256/secp256k1). publicKeyMultibase/Multikey is unsupported in this method version. |
| Multi-controller keys | ✖ | The contract stores one active controller public key plus a recovery authority public key. Multi-controller or threshold custody remains outside the current method surface. |
| Relative key IDs | ✔ | Fragment identifiers supported (#key-1). |
Service Endpoint Traits
| Trait | Status | Notes |
|---|---|---|
| Service entry support | ✔ | service array with id, type, serviceEndpoint. |
| Endpoint formats (CID-1.0) | ✔ | Strings, objects, and arrays; JSON stored on-ledger. |
| Relative service IDs | ✔ | Fragment/relative URIs required. |
| Absolute external IDs | ✖ | Non-DID absolute URIs disallowed. |
Controller / Authorization Traits
| Trait | Status | Notes |
|---|---|---|
| Single controller | ✔ | Contract enforces single controller equal to DID. |
| Multi-controller | ✖ | Not supported on-chain. Recovery uses a dedicated authority that can only rotate the active controller key and does not act as a second active controller. |
| Delegated updates | ✔ | Wallet-local controller signatures authorize updates without revealing the controller secret to proof servers. |
| On-chain access control | ✔ | Circuits verify wallet-local controller signatures against controllerPublicKey; recovery verifies a narrow recovery signature against recoveryAuthorityPublicKey. |
Operational Traits
| Trait | Status | Notes |
|---|---|---|
| Batch operations | ✖ | This method version defines no batch circuit: each API mutation submits one circuit call. Multi-step application workflows finalize independently, and Midnight transactions cannot merge multiple non-empty contract-call sections into one atomic transaction. |
| Network portability | ✔ | Works on undeployed/devnet/testnet/mainnet/preview/preprod. |
| Privacy guidance | ✔ | Spec discourages PII on-chain; ZK witness protects updates. |
| Service discovery | ✔ | Indexers/resolvers dependent on Midnight network (Midnight DID Method §10). |
Status icons: ✔ Supported · △ Partial support / restriction · ✖ Not supported.