Concepts

Ecosystem roles

The ISBE wallet operates within the SSI (Self-Sovereign Identity) trust model, which involves three roles:

Role	Description	Example in ISBE
Issuer	Accredited entity that issues verifiable credentials.	A public administration issuing a certificate of registration.
Holder (credential holder)	Person who receives, stores, and presents their credentials.	The citizen using the wallet.
Verifier	Entity that requests the presentation of one or more credentials to authenticate or authorize the holder.	A digital service requesting to verify the user's identity.

The wallet implements exclusively the holder role.

Glossary

Terms from this package (new)

Term	Description
wallet	The ISBE Holder Wallet: mobile app for managing credentials. Not translated.
digital wallet	Accepted translation of wallet for non-technical contexts. In technical contexts always use "wallet".
credential holder	The person who owns and manages their own credentials. Synonym for holder.
verifiable presentation	Signed container that groups one or more VCs to present them to a verifier.
selective disclosure	Capability to share only a subset of a credential's attributes. Not available in the current implementation: the wallet always presents the complete credential.
proof of possession	Cryptographic proof demonstrating that the holder possesses the private key associated with the DID.
credential offer	Credential issuance offer encoded in a QR code or deep link.
verifier	Entity that requests credential presentation. Synonym for relying party.
presentation consent	Explicit confirmation from the user before sharing a credential.
pre-authorized code flow	OID4VCI flow where the issuer generates the authorization code without user intervention.
transaction code	tx_code in OID4VCI: additional PIN that the issuer may require to activate the credential offer.

Terms from previous packages (quick reference)

The following terms are defined in the Identity and Credentials packages. They are included here as a quick reference for the wallet.

Term	Brief description
DID	Decentralized Identifier. The holder has a DID managed locally on their device.
VC / Verifiable Credential	Verifiable credential signed by an issuer.
VP / Verifiable Presentation	Verifiable presentation containing one or more VCs.
jwt_vc_json	The only VC format currently supported in the wallet.
did:key	DID method that generates an identifier from a public key. The holder uses did:key.
did:jwk	DID variant that encodes the public key as a JWK.

Credential format

The wallet exclusively supports the jwt_vc_json format (JWT Verifiable Credentials per W3C VC Data Model). A credential in this format is a JWT with the following main fields:

{
  "iss": "did:isbe:uc:zpxbBfHYA5GN45rS1tSEBJg",
  "sub": "did:key:z6MkszZtxCmA2Ce4vUV132PCuLQmwnaDD5mw2L23fGNnsiRn",
  "vc": {
    "@context": ["https://www.w3.org/2018/credentials/v1"],
    "type": ["VerifiableCredential", "CredentialTypeName"],
    "credentialSubject": {
      "id": "did:key:z6MkszZtxCmA2Ce4vUV132PCuLQmwnaDD5mw2L23fGNnsiRn",
      "nombre": "Ada Lovelace",
      "fechaNacimiento": "1815-12-10"
    }
  },
  "iat": 1700000000,
  "exp": 1731622400
}

The iss field corresponds to the issuer's DID (a did:isbe). The sub field corresponds to the holder's DID (a did:key or did:jwk).

Holder DID

The holder's DID is generated locally on the device when the account is created. The wallet supports:

• did:key with secp256k1 — default curve.
• did:key with Ed25519 — alternative support.
• did:jwk — JWK representation of the key material.

The holder's DID is not registered on the ISBE blockchain. It is a local identifier that requires no on-chain transaction. The ISBE blockchain is only involved in resolving the issuer's DID and validating the accreditation chain.

Credential lifecycle

Credential offer (QR / deep link)
        │
        ▼
Wallet requests credential from issuer (OID4VCI)
        │
        ▼
Credential stored encrypted on device
        │
        ▼
Verifier requests presentation (OID4VP / DCQL)
        │
        ▼
User confirms presentation consent
        │
        ▼
Wallet sends signed VP to verifier

Current limitations

Selective disclosure. The wallet always presents the complete credential (jwt_vc_json). The vc+sd-jwt (Selective Disclosure JWT) and ldp_vc (Linked Data Proofs) formats are not implemented.

Revocation status verification. The wallet validates the credential signature and its expiry date (validUntil/exp), but does not verify the credentialStatus field. The status list mechanism for checking whether a credential has been revoked is not implemented in the current version.