Re: [GNAP] About the use case called "Self sovereign identity (SSI)"

[Francis Pouatcha <[e-mail]>]

Hello Denis,

in your use case description,
- the RS ist the concert gateman
- now AS/GS is AC-Tickets

- AS/GS issue a conditioned token (Please allow Alice to this concert only
if she is older than 18 and a resident of Bamberg)
- Human RS is given an "option" to check these claims at the gate (or not).

- Check is negative: Alice is younger than 18, but has bought a concert
ticket from the ticket website (legal contract). Who is liable?

Best regards
/Francis

On Fri, Aug 21, 2020 at 8:48 AM Denis <[e-mail]> wrote:

> Hello Francis,
>
> This WG has not been formed to address SSI (Self sovereign identity). This
> use case can be solved without using an AS and a RS
> and without using a "Self Sovereign Identity (SSI)" approach.
>
> -          Alice visits the website of AC-Tickets.
>
> -          Alice looks up and finds "Bamberg Symphony", the concert she
> wants to attend.
>
> -          Alice is informed that she can get a discount price if she is
> a resident of Bamberg.
>
> -          Alice fills a form and enters the requested information.
>  She indicates that she is a resident of Bamberg and so she gets the
> discounted price.
>
> -          Alice makes the payment using 3D secure.
>
> -          Alice gets back a QR code on her phone that will be scanned
> when entering the concert hall.
>
> -          Alice goes to the concert at Bamberg Symphony.
>
> -          At the entrance gate, Alice presents her QR code which
> includes a unique identifier for this concert, the date and time of the
> concert,
>  her seat number reservation, her family name and her first name and the
> fact that the ticket price is a discounted price available only
>  for the residents of Bamberg.
>
> -          If the person controlling the QR-codes at the gate has some
> doubt that Alice is indeed a resident of Bamberg,
>  she asks Alice to present her ID card or her passport which includes her
> home address and even more important her picture.
> ("On the Internet, nobody knows you're a dog". Peter Steiner's cartoon,
> as published in The New Yorker on July 5, 1993).
>
> This is simple, efficient and easy to implement right now.
>
> This is roughly how train reservations are working on the French web site
> oui.sncf. Some one over 60 can request a discounted railway ticket .
> If the train controller has some doubt that the bearer of the discounted
> railway ticket is really over 60 after scanning the QR code, he will ask
> the person to show an identity card or a passport at the platform entrance
> or while in the train. Not only the year of birth will allow to make sure
> that the individual is indeed over 60 but in addition the name on the identity
> card or the passport will be checked against the name on the railway
> ticket and that picture matches with the face of the person in front of
> the train controller.
>
> Anyway, IMHO, I don't believe that this use case should be solved using
> GNAP.
>
> Denis
>
> PS. This use case has been posted here:
>
> https://github.com/ietf-wg-gnap/general/wiki/SSI-integration#alice-purchasing-a-concert-ticket-without-disclosing-her-identity
>
>

-- 
Francis Pouatcha
Co-Founder and Technical Lead
adorsys GmbH & Co. KG
https://adorsys-platform.de/solutions/