DIDComm is a secure, private messaging protocol that enables encrypted, peer-to-peer communication between entities using Decentralized Identifiers (DIDs). It establishes a trusted channel where parties can exchange data, such as Verifiable Credentials and other messages, without relying on a central intermediary. The protocol uses the recipient's public key, discoverable via their DID document, to encrypt messages, ensuring that only the intended party can decrypt and read them. This foundational layer of trust is critical for building decentralized applications in identity, finance, and IoT.
LABS
Glossary
DIDComm
DIDComm is a secure, peer-to-peer messaging protocol built on decentralized identifiers (DIDs) for communication between wallets, agents, and services in Self-Sovereign Identity (SSI) ecosystems.
Chainscore © 2026
definition
DECENTRALIZED IDENTIFIER COMMUNICATION
What is DIDComm?
DIDComm is a secure, private messaging protocol built on the foundation of Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs).
The architecture of DIDComm is built around two core message types: plaintext messages (application/didcomm-plain+json) and encrypted messages (application/didcomm-encrypted+json). Plaintext messages are used for development and debugging, while encrypted messages are used in production. Encryption is performed using the recipient's public key, and messages are typically wrapped in a JWM (JSON Web Message) or JWE (JSON Web Encryption) envelope. This ensures confidentiality, integrity, and authenticity, as messages can only be decrypted by the holder of the corresponding private key linked to their DID.
A key feature of DIDComm is its support for forward secrecy and message repudiation through the use of ephemeral keys. For enhanced security, parties can perform a DID Exchange protocol to establish a peer-to-peer relationship and then create a DIDComm Mediator-style connection using rotated key material. This process moves beyond simple DID-to-DID messaging to create persistent, secure channels that protect against key compromise. These protocols are often defined in the DIF DIDComm Messaging specification and the Aries RFCs, which provide interoperability frameworks.
Practical applications of DIDComm are vast, powering the infrastructure for SSI (Self-Sovereign Identity) ecosystems. It is the communication backbone for mobile digital wallets that hold verifiable credentials, enabling scenarios like instant, privacy-preserving age verification or employee onboarding. In finance, DIDComm can secure instructions between decentralized autonomous organizations (DAOs) and their treasuries. The protocol's agent-based architecture, where software agents act on behalf of users, allows for asynchronous, offline-capable communication that mirrors real-world trust relationships.
etymology
TERM ROOTS
Etymology & Origin
This section traces the linguistic and conceptual origins of the term DIDComm, breaking down its components and the historical context of its development.
The term DIDComm is a portmanteau, a blend of two core concepts: DID (Decentralized Identifier) and Comm (Communication). It was coined to describe a secure, peer-to-peer messaging protocol built specifically for the ecosystem of self-sovereign identity (SSI) and verifiable credentials. The name directly signals its foundational purpose: enabling communication between entities that are identified and authenticated using DIDs, rather than traditional centralized usernames or email addresses.
The protocol's development is intrinsically linked to the work of the Decentralized Identity Foundation (DIF) and the W3C Credentials Community Group. Its design principles emerged from the need for a standardized, interoperable way for wallets, agents, and hubs to exchange messages containing verifiable data. DIDComm was created to solve the communication layer problem in a decentralized identity world, ensuring messages are private, integrity-protected, and can be routed without relying on a central service provider.
The "Comm" component is implemented through a layered architecture, most notably DIDComm v2, which formalizes the protocol. This architecture separates the concerns of packing (encryption/signing) messages and transporting them. It uses JSON Web Encryption (JWE) and JSON Web Signatures (JWS) as its cryptographic foundation, ensuring the protocol leverages well-established, audited standards. The evolution from earlier ad-hoc methods to this formalized protocol marks a key milestone in making decentralized identity systems practically usable for secure digital interactions.
how-it-works
TECHNICAL PRIMER
How DIDComm Works
DIDComm is a secure, peer-to-peer messaging protocol that enables decentralized applications and agents to communicate using Decentralized Identifiers (DIDs) and verifiable credentials.
DIDComm is a secure, peer-to-peer messaging protocol that enables decentralized applications and agents to communicate using Decentralized Identifiers (DIDs) and verifiable credentials. At its core, it provides a framework for two entities that possess DIDs to establish a private, encrypted communication channel without relying on a central server. This is achieved through a layered architecture, where the DID Document of each party provides the public keys and service endpoints necessary to initiate and route messages. The protocol is transport-agnostic, meaning the encrypted messages can be delivered via any suitable carrier, such as HTTP, Bluetooth, or a blockchain.
The workflow begins with connection establishment. One party, the inviter, creates an out-of-band invitation containing their DID and a service endpoint. The other party, the invitee, uses this information to resolve the inviter's DID Document, create their own DID, and send a connection request. Once both parties have exchanged and verified each other's DID Documents, they perform a key exchange to derive a shared secret. This process establishes a secure, pairwise DIDComm channel, identified by the unique DIDs of the participants, which is used for all subsequent confidential interactions.
All messages within an established channel are secured using the Authenticated Encryption with Associated Data (AEAD) paradigm. The core DIDComm message is a JSON structure containing a header (with message type, ID, and sender/recipient DIDs) and a body. This plaintext JSON is then encrypted into a JWM (JSON Web Message) or JWE (JSON Web Encryption) format, resulting in the final DIDComm encrypted message. This encryption ensures confidentiality, integrity, and authenticity of the communication, as only the intended recipient, who holds the private key corresponding to their DID, can decrypt and verify the message.
Beyond simple messaging, DIDComm enables complex interactions through protocols. These are predefined sequences of message types that accomplish specific tasks, such as issuing a verifiable credential (issue-credential), presenting proof (present-proof), or negotiating a connection (connections). Agents discover mutual support for a protocol during feature discovery. This modularity allows for interoperable, trustless workflows where parties can prove attributes, negotiate agreements, and coordinate actions entirely through encrypted, machine-readable messages, forming the backbone of decentralized identity ecosystems and SSI (Self-Sovereign Identity).
key-features
PROTOCOL ARCHITECTURE
Key Features of DIDComm
DIDComm is a secure, peer-to-peer messaging protocol built on decentralized identifiers (DIDs) and verifiable credentials. Its core features enable privacy-preserving, interoperable communication for decentralized applications.
01
End-to-End Encryption
All DIDComm messages are secured with end-to-end encryption (E2EE) using the recipient's public key from their DID document. This ensures that only the intended recipient, who holds the corresponding private key, can decrypt and read the message content, providing strong confidentiality.
02
DID-Based Addressing
Messages are addressed using Decentralized Identifiers (DIDs) instead of traditional usernames or IP addresses. This decouples identity from centralized registries, allowing entities to communicate based on cryptographically verifiable, self-sovereign identities that they control.
03
Forward Secrecy & Repudiation
The protocol supports forward secrecy through key rotation, preventing compromise of past messages if a long-term key is leaked. It also enables repudiation, where a sender can cryptographically prove they did not send a message, protecting against forgeries.
04
Transport Agnostic
DIDComm is a transport-agnostic application-layer protocol. The encrypted messages (JWM/JWE envelopes) can be delivered over any transport mechanism—HTTP, Bluetooth, QR codes, or carrier pigeons—without compromising security, enabling universal interoperability.
05
Protocol-Based Interaction
Communication follows defined protocols (e.g., for issuing a credential or proving a claim), which are machine-readable sequences of message types. This creates predictable, automated, and verifiable interactions between agents, forming the basis for complex workflows.
06
Trust Establishment via DIDs
Trust is established by resolving a peer's DID to their public DID Document. This document contains the keys and service endpoints needed for secure communication, eliminating the need for pre-shared secrets or a central certificate authority.
examples
PRACTICAL APPLICATIONS
DIDComm Use Cases & Examples
DIDComm enables secure, decentralized communication between digital identities. These examples illustrate its core utility for private messaging, credential exchange, and automated workflows.
01
Verifiable Credential Exchange
DIDComm is the standard protocol for peer-to-peer presentation and verification of credentials. A user's wallet can securely request a credential (like a proof of age) from an issuer and later present it to a verifier, all via encrypted DIDComm messages. This enables selective disclosure and eliminates the need for centralized verification services.
- Example: A user proves they are over 21 to access a service without revealing their birthdate or other personal data.
- Protocols Used: Issue Credential, Present Proof.
02
Secure Agent-to-Agent Messaging
At its core, DIDComm provides end-to-end encrypted communication between software agents acting on behalf of DIDs. Messages are encrypted to the recipient's public key, ensuring privacy and integrity. This forms the foundation for all other use cases.
- Mechanism: Uses authcrypt (authenticated encryption) or anoncrypt for privacy-preserving routing.
- Example: Two digital wallets exchanging messages to negotiate a connection or coordinate a transaction without a central server.
03
Decentralized Identity Wallets
Mobile and web identity wallets use DIDComm as their primary communication layer. They act as user-controlled agents that manage keys, store credentials, and communicate with other entities (issuers, verifiers, other wallets) in a secure, interoperable manner.
- Key Functions: Establishing DIDComm connections, receiving credential offers, responding to proof requests.
- Interoperability: Wallets from different vendors can interact because they adhere to the same DIDComm protocols.
04
SSI Ecosystem Interoperability
DIDComm is the glue of the Self-Sovereign Identity (SSI) ecosystem, enabling different components to work together. Issuers, verifiers, holders, and hubs (cloud agents) all use standardized DIDComm messages to create a decentralized trust network.
- Role of Protocols: Standardized protocols like DID Exchange and Discover Features ensure agents can discover each other's capabilities and establish connections.
- Impact: Breaks down vendor lock-in and enables a composable identity landscape.
05
IoT & Machine-to-Machine Communication
DIDComm can provide secure, identifiable communication for Internet of Things (IoT) devices and autonomous agents. Each device can have a DID and use DIDComm to authenticate itself and share data with authorized entities, enabling decentralized machine ecosystems.
- Use Case: A smart meter (with a DID) securely transmitting usage data to a utility company's verifier agent.
- Benefit: Provides a cryptographic foundation for device identity and data provenance beyond traditional PKI.
06
Mediated & Cloud Agent Architecture
Not all agents (like mobile wallets) are always online. Mediators or Cloud Agents act as always-online message relays using DIDComm. A mobile wallet can connect to a cloud agent, which holds encrypted messages on its behalf until it comes online, ensuring reliable asynchronous communication.
- Key Concept: DIDComm message packing (JWM) allows encryption for multiple recipients, enabling the relay to forward messages without being able to read them.
- Enables: 24/7 availability for services needing to reach intermittently connected user agents.
PROTOCOL COMPARISON
DIDComm vs. Traditional Messaging
A technical comparison of decentralized identity messaging (DIDComm) against traditional, centralized messaging protocols like HTTPS or SMTP.
| Feature / Attribute | DIDComm (v2) | Traditional Messaging (e.g., HTTPS/SMTP) |
|---|---|---|
Architectural Model | Peer-to-Peer (P2P), Agent-based | Client-Server, Hub-and-Spoke |
Identity Foundation | Decentralized Identifiers (DIDs) & Verifiable Credentials | Centralized Accounts (Usernames, Email Addresses) |
Message Security | End-to-End Encrypted (E2EE) by design using DID Keys | Transport Layer Security (TLS), often point-to-point |
Sender Authentication | Cryptographic proof via digital signatures | Relies on Certificate Authorities (CAs) or platform auth |
Trust Model | Trust-over-IP, Verifiable & Portable | Trust in central intermediaries (platforms, CAs) |
Interoperability | Protocol-level, based on open W3C standards | Platform-specific APIs and gateways |
Message Routing | DID-based, can use mediators or relays | IP/DNS-based, requires stable network endpoints |
Data Portability | High; identity and relationships are user-controlled | Low; data siloed within service provider platforms |
security-considerations
DIDCOMM
Security & Privacy Considerations
DIDComm (Decentralized Identifier Communication) is a secure, private messaging protocol built on decentralized identity principles. Its security model is fundamentally different from traditional systems, relying on cryptographic proofs rather than trusted intermediaries.
01
End-to-End Encryption by Default
All DIDComm messages are encrypted at the layer of the protocol using the recipient's public key, ensuring only the intended party can decrypt them. This is achieved through Authenticated Encryption (e.g., using XChaCha20Poly1305 or A256GCM) and is a core, non-negotiable feature, unlike many transport-layer security (TLS) systems where intermediaries may have access.
02
Sender Authentication & Non-Repudiation
Messages are cryptographically signed by the sender's private key, providing verifiable proof of origin (authentication) and preventing the sender from later denying they sent the message (non-repudiation). This is implemented using JSON Web Signatures (JWS) or similar, binding the signature to the DID and its associated public key in the DID Document.
03
Minimal Data Disclosure & Selective Disclosure
DIDComm enables data minimization by allowing parties to share only the specific, verifiable credentials needed for an interaction (selective disclosure). Instead of sending a full identity document, you can prove you are over 21 without revealing your birthdate, name, or address, using zero-knowledge proofs or BBS+ signatures.
04
Decentralized Trust & No Single Point of Failure
Trust is rooted in cryptographic key material and verifiable data registries (like blockchains), not centralized servers. This eliminates single points of compromise for identity data. Compromising one user's keys does not affect the security of the entire network, unlike a breached centralized database.
05
Forward Secrecy & Key Rotation
DIDComm supports key rotation and key agreement protocols (like Elliptic Curve Diffie-Hellman - ECDH) to establish ephemeral session keys. This provides forward secrecy: if a long-term private key is compromised, past communication sessions secured with ephemeral keys remain protected.
06
Privacy-Preserving Routing & Mediators
Messages can be routed through DIDComm mediators (relays) without the mediator being able to read the encrypted payload. This allows agents operating behind firewalls or NATs to communicate while preserving content confidentiality. Advanced routing schemes can obscure metadata to enhance sender/receiver unlinkability.
DIDCOMM
Technical Deep Dive
DIDComm is a secure, peer-to-peer messaging protocol built on Decentralized Identifiers (DIDs) and Verifiable Credentials. It provides a framework for encrypted, authenticated communication between any two entities that control a DID, enabling trust in decentralized systems.
DIDComm is a secure, peer-to-peer messaging protocol that enables encrypted and authenticated communication between entities using Decentralized Identifiers (DIDs). It works by using the public keys listed in a DID's DID Document to encrypt messages for the recipient and to verify signatures from the sender. A typical flow involves an agent wrapping a plaintext message into a DIDComm Message, which is then packaged into an encrypted DIDComm Envelope using the recipient's public key before transmission over any transport layer (e.g., HTTP, Bluetooth). This ensures confidentiality, integrity, and authenticity without relying on a central server.
Core components:
- Plaintext Messages: JSON-LD structured data defining the interaction.
- Encrypted Envelopes (JWM/JWE): The encrypted packaging for secure transit.
- Agents: Software that sends, receives, and processes messages on behalf of a DID controller.
ecosystem-usage
DECENTRALIZED IDENTITY
Ecosystem & Adoption
DIDComm is a secure, peer-to-peer messaging protocol for decentralized identity ecosystems, enabling verifiable credentials and private interactions between digital wallets.
01
Core Protocol
DIDComm is a secure messaging protocol built on W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs). It enables encrypted, authenticated communication directly between two parties, known as agents, without relying on a central server. The protocol uses DID Documents to discover public keys and service endpoints for routing messages, ensuring privacy and data sovereignty.
02
Agent-to-Agent Architecture
Communication occurs between software agents (e.g., mobile wallets, cloud agents) acting on behalf of identity holders. This architecture supports:
- Peer-to-peer routing via mediators or relays.
- Asynchronous messaging for offline interactions.
- Multiple encryption layers (e.g., anoncrypt for confidentiality, authcrypt for authenticated encryption). Agents handle key management, message packing/unpacking, and protocol coordination.
03
Verifiable Credential Exchange
A primary use case is the secure issuance, presentation, and verification of Verifiable Credentials. The flow involves:
- Credential Offer: An issuer proposes a credential.
- Credential Request: A holder requests the credential.
- Credential Issuance: The issuer sends the signed VC.
- Proof Presentation: The holder presents a Verifiable Presentation to a verifier. This enables trusted digital interactions like KYC, diplomas, and access permissions.
04
Adoption & Standards
DIDComm is specified by the Decentralized Identity Foundation (DIF) and is a core component of major SSI ecosystems. Key implementations and adopters include:
- Aries Framework (Hyperledger): Open-source toolkits for building interoperable agents.
- Indy Catalyst: Agent implementations for the Hyperledger Indy blockchain.
- W3C CCG: Collaboration on standards for DID Communication. Its design ensures transport agnosticism, working over HTTP, Bluetooth, or QR codes.
05
Privacy & Security Features
The protocol embeds strong privacy by design principles:
- End-to-end encryption: Messages are encrypted for the recipient's key.
- Sender authentication: Messages can be signed to prove origin.
- Minimal metadata leakage: Routing is separated from content.
- Forward secrecy: Supported through key rotation protocols.
- Selective disclosure: Holders can reveal specific credential attributes without exposing the entire document.
06
Real-World Applications
DIDComm enables practical decentralized identity solutions:
- Digital Driver's Licenses: Issued by governments, stored in a mobile wallet.
- Employee Credentials: For secure, remote workplace access.
- Healthcare Credentials: Patient-controlled health records and vaccination proofs.
- Supply Chain Provenance: Verifiable credentials for product origin and handling.
- Decentralized Finance (DeFi): On-chain credential verification for compliant transactions.
DIDCOMM
Frequently Asked Questions (FAQ)
DIDComm is a secure, peer-to-peer messaging protocol built on Decentralized Identifiers (DIDs) and Verifiable Credentials. These questions address its core mechanisms, use cases, and technical foundations.
DIDComm is a secure, encrypted messaging protocol that enables direct, private communication between entities using Decentralized Identifiers (DIDs). It works by establishing a secure channel where the sender encrypts a message specifically for the recipient's DID, using keys resolved from their DID Document. The core process involves message packing, which can be encrypted (JWM/JWE), signed (JWS), or both, ensuring confidentiality, integrity, and authenticity. Messages are routed peer-to-peer or via mediators, without relying on a central server that can surveil or censor the communication.
further-reading
DIDCOMM PROTOCOL
Further Reading & Specifications
DIDComm is a secure, peer-to-peer messaging protocol built on Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) for trusted data exchange.
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall