Credential Definition

A Credential Definition is a public, on-chain schema that defines the structure, data types, and cryptographic commitments for a specific type of verifiable credential (VC) within a decentralized identity system, such as Hyperledger Indy or AnonCreds. It is published to a distributed ledger by an issuer and serves as the technical blueprint that all credentials of that type must follow. Crucially, it contains the issuer's public key for the credential type, enabling any verifier to cryptographically verify that a presented credential was issued by the claimed entity and has not been tampered with, without needing to contact the issuer directly.

The creation of a Credential Definition involves several key steps. First, the issuer generates a unique cryptographic key pair specifically for that credential type. The public key and its associated revocation registry configuration (if supported) are then anchored to a blockchain in a tamper-proof transaction. This process transforms a private schema—which only defines attribute names like "name" or "degreeDate"—into a publicly trusted definition. The on-chain record binds the issuer's identity (via their DID, or Decentralized Identifier) to the specific credential format, creating a reusable and globally referenceable trust anchor for all future credentials issued under that definition.

For verifiers, the Credential Definition is the critical piece of trust data. When receiving a verifiable credential, a verifier's agent fetches the corresponding Credential Definition from the ledger. Using the public key within it, the verifier can cryptographically verify the digital signature on the credential proof. This mechanism enables privacy-preserving verification, as the credential can be validated based on public blockchain data without querying the issuing authority. This decouples verification from issuer availability, a core tenet of self-sovereign identity (SSI).

Different credential systems implement this concept with varying terminology and technical details. In the W3C Verifiable Credentials Data Model, a similar role is played by a combination of the issuer's DID Document (which contains public keys) and the credential's JSON-LD context or JSON Schema. However, the AnonCreds-style Credential Definition is notable for its explicit, on-chain binding of a key to a specific schema, optimizing for the zero-knowledge proof capabilities of CL signatures. This design is particularly suited for selective disclosure, where a user can prove a claim (e.g., "I am over 21") without revealing the underlying data (their exact birth date).

In practice, a Credential Definition's ledger identifier (e.g., a schema ID combined with the issuer's DID) becomes a standard reference used across ecosystems. For example, a university might publish a "Bachelor of Science Degree" Credential Definition. Every digital diploma it issues references this single definition, allowing any employer or institution to instantly understand the credential's format and trust its authenticity. This system creates scalable, interoperable trust, reducing the need for bilateral agreements and manual background checks in digital interactions.

A Credential Definition is a public, on-chain record that binds a schema—which defines the data structure of a credential—to a specific issuer's cryptographic keys. This binding is the critical step that makes a credential verifiable. When an issuer creates a Credential Definition, they generate a unique public/private key pair, known as a revocation key, specifically for that credential type. The public portion of this key, along with a reference to the schema, is published to the ledger, creating an immutable link between the issuer's identity, the data format, and the cryptographic material needed for verification and revocation.

The primary function of a Credential Definition is to enable zero-knowledge proof verification. It provides the cryptographic parameters that allow a holder to prove they possess a valid credential from a known issuer without revealing the underlying attribute data. For example, a university's "Alumni Degree" Credential Definition would allow a graduate to prove they hold a degree from that institution, and that it has not been revoked, without disclosing their GPA or student ID. This process relies on the CL signature scheme, a form of BBS+ signatures, which the Credential Definition configures for a specific schema.

From a technical perspective, creating a Credential Definition is a transaction submitted to the distributed ledger (e.g., an Indy-based ledger or the AnonCreds Object Capability Ledger). This transaction contains the cred_def_id, a unique identifier derived from the issuer's DID, the schema ID, the signature type (e.g., CL), and the public key material (key_correctness_proof). Once written, this definition becomes the trusted root for all credentials of that type. Verifiers fetch the Credential Definition from the ledger to cryptographically verify any proof presented to them, ensuring the credential's integrity and origin.

A single schema can have multiple Credential Definitions associated with it, typically one per issuer. This allows different organizations to issue credentials with the same data structure (e.g., a "Driver's License" schema) while maintaining their own independent cryptographic authority and revocation registries. The Credential Definition model is foundational to SSI (Self-Sovereign Identity) architectures like Hyperledger Indy and AnonCreds, providing the mechanism for scalable, privacy-preserving, and interoperable digital trust.

A Credential Definition is a public, on-ledger object that binds a Credential Schema to a specific Issuer's cryptographic keys. It is created when an issuer decides to issue credentials of a particular type, such as a university diploma or a driver's license. The definition contains the public key used for signing credentials and cryptographic commitments (like a CL signature public key) that enable the creation of zero-knowledge proofs. This ensures that credentials can be verified without revealing the underlying attribute values or the holder's identity, a process known as selective disclosure.

The creation of a Credential Definition is a critical, one-time setup step. It cryptographically commits the issuer to a specific schema version and key pair, preventing them from later altering the structure of issued credentials or repudiating their signatures. This object is published to a verifiable data registry, typically a distributed ledger, where it can be referenced by its unique identifier (credDefId). Verifiers use this public definition to cryptographically verify that a presented credential proof was issued by the authorized entity and conforms to the expected format.

Technically, a Credential Definition in the AnonCreds model includes several key components: a reference to the schema (schemaId), the type of signature scheme (e.g., CL), a tag for issuer-specific configuration, the public verification key, and a revocation registry identifier if the credential type supports revocation. This structure enables interoperability, as any party can fetch the definition from the ledger to understand the credential's format and verify proofs, forming the trust anchor for decentralized identity ecosystems.