Skip to main content

Architecture

TridentGold adds a citizen-held identity layer to existing source systems and service workflows. Agencies remain authoritative for their own records and decisions.

Roles and systems​

  • Authoritative source systems contain the records an agency uses to establish facts or eligibility. They remain the source of record.
  • An authorized issuer maps approved source data into a credential, signs it with protected keys, and maintains its lifecycle and status.
  • The holder receives the credential in the TridentGold app, stores it encrypted, and decides whether to respond to a request.
  • A verifier requests authentication or evidence, validates the holder-bound response, and applies its own service policy.
  • A national trust layer is intended to distribute authorized issuers, verifiers, keys, schemas, and applicable status information under an approved governance model.

Credential flow​

During issuance, the issuer authenticates the holder as required, checks its authoritative records, offers the credential, and delivers it to the app. The app checks the issuer and protects the received credential.

During presentation, a verifier sends a fresh, scoped request. The app authenticates the request, shows the requested disclosure, and—after holder consent—returns a response bound to the request and holder. The verifier checks the proof, trusted issuer, request binding, validity, and relevant status before using the result in its existing workflow.

Status checking is credential-format and deployment specific. A digital credential can be suspended, revoked, expired, or superseded without cancelling the underlying physical document or legal entitlement. Offline presentations may necessarily use status information with a defined freshness limit.

Standards direction​

The architecture is intended to use:

  • OpenID for Verifiable Credential Issuance (OID4VCI) for credential offers and issuance;
  • OpenID for Verifiable Presentations (OID4VP) with Digital Credentials Query Language (DCQL) for scoped presentation requests;
  • Self-Issued OpenID Provider v2 (SIOPv2) for holder-controlled account authentication;
  • ICAO Doc 9303 for machine-readable travel documents;
  • ISO/IEC 18013-5 and the online-presentation mechanisms associated with ISO/IEC 18013-7 for mobile driving licence credentials;
  • X.509 certificate chains and governed trust data for issuer key trust; and
  • the draft TridentGold Zero-Knowledge-Native Credential (ZKNC) format for privacy-preserving domestic claims.

ICAO 9303 travel documents and mobile driving licence credentials retain their native formats, trust rules, validity, and status models. They are not converted to ZKNC. ZKNC is intended for domestic claims that benefit from selective or zero-knowledge presentation and remains a draft format under review.

This page describes architectural direction, not a settled protocol profile. Exact versions, algorithms, schemas, trust-list records, endpoints, request profiles, and environment details become integration contracts only when they are reviewed and published for a deployment.