Docs Reference Glossary and reference

Glossary and reference

Terms used in this guide, the standards the wallet follows, and public registry addresses.

Appendix A: Glossary of Terms

Core Concepts

Assertion Method
A cryptographic key designated for signing credentials and other assertions. Most commonly used key purpose for credential issuance.
Authentication
A key purpose used to prove identity during login or authentication processes.
Controller group
People who can stand in for each other on a key. Using the key requires one person from every group. People in the same group are alternatives.
Credential Subject
The entity (person, organization, or thing) that the credential is about. Identified by a URI or DID.
Decentralized Identifier (DID)
A globally unique identifier that you control, without needing a central authority. Format: did:method:identifier.
DID Document
A JSON document containing public keys, service endpoints, and other metadata about a DID.
DID Method
The specific type of DID. This wallet uses did:web (the domain is part of the identifier) and did:key (the identifier is a public key). See how did:web works.
Holder
The entity that possesses and presents a verifiable credential (not necessarily the subject).
Issuer
The organization that creates and signs a verifiable credential. Identified by a DID.
JSON-LD Context
A specification that defines the meaning of terms in a credential’s claims.
Key Access Secret
A system-generated secret that encrypts private keys. Part of the multi-layer encryption.
Private Key
The secret half of a cryptographic key pair, used to create signatures. It stays inside the wallet’s hardened key module. A user secret is a separate second factor, not this key.
Public Key
The public part of a cryptographic key pair, shared in DID Documents for verification.
Revocation
Permanently invalidating a credential. Cannot be undone.
Selective Disclosure (SD-JWT)
A credential format that lets a holder reveal only some claims. The Company Wallet does not issue SD-JWT credentials.
Self-Sovereign Identity (SSI)
An identity model where individuals and organizations control their own identities without intermediaries.
Status List
A compressed list tracking the revocation/suspension status of many credentials efficiently.
Suspension
Temporarily invalidating a credential. Can be reinstated later.
User Secret
An optional key file you keep. It is a second factor, like the confirmation a banking app asks for, and close to a passkey: the wallet uses the private key when you provide this file. You decide where to store it. The wallet does not keep a copy. If you do not use one, your account login and the service secret protect use of the key. See Keys.
Verifiable Credential (VC)
A digital certificate with cryptographic proof of authenticity, issued by an organization to make claims.
Verifiable Presentation (VP)
A collection of credentials presented together, signed by the holder.
Verification Method
A public key listed in a DID Document, used to verify signatures.
Verifier
An entity that checks the authenticity and validity of verifiable credentials.

GS1-Specific Terms

Company Prefix
A GS1 identifier allocated to a company. In this wallet it is a license value that starts with a prefix license and is longer than that license.
GS1 Prefix
A GS1 identifier allocated to a Member Organization. In this wallet it is the license value on a prefix license.
Global Location Number (GLN)
A unique 13-digit identifier for physical or digital locations.
Global Trade Item Number (GTIN)
A unique identifier for products. Variations: GTIN-8, GTIN-12 (UPC), GTIN-13 (EAN), GTIN-14.
Member Organization (MO)
A national or regional GS1 organization that manages GS1 standards in a territory.
Prefix License
A credential certifying authority to use a specific GS1 or company prefix.

Technical Terms

AES-256-GCM
Advanced Encryption Standard with 256-bit keys and Galois/Counter Mode. Industry-standard authenticated encryption.
Data Integrity Proof
An embedded cryptographic signature in a credential’s JSON structure.
Ed25519
A modern elliptic curve digital signature algorithm. Fast, secure, and compact.
ES256
ECDSA signature algorithm using P-256 curve. Common in JWT and web authentication.
JSON Web Key (JWK)
A JSON format for representing cryptographic keys.
JSON Web Token (JWT)
A compact token format for securely transmitting information between parties.
JWT-VC
Verifiable Credential encoded as a JSON Web Token.
OAuth 2.0 / OpenID Connect (OIDC)
Authentication protocols used to secure wallet access.
PBKDF2
Password-Based Key Derivation Function 2. Strengthens passwords against brute-force attacks.
W3C
World Wide Web Consortium. Standards body for web technologies including DIDs and VCs.

Appendix B: Registry addresses

These addresses are public. No sign-in is required to read a published identifier, credential, or status list. Roles and the permission matrix are in Roles and permissions.

The wallet serves them under /api/registry. In the patterns below, your-wallet.com is this deployment’s host.

DID document

Ask for a full DID, or for the short name of an identifier this wallet created:

https://your-wallet.com/api/registry/did/{did}
https://your-wallet.com/api/registry/did/{did}/did.json

The wallet’s own default identifier for a company is did:web:your-wallet.com:api:registry:did:{name}. {name} is the company name in lower case, with spaces written as underscores. did:web resolution fetches:

https://your-wallet.com/api/registry/did/{name}/did.json

The same document is returned when {did} is that full DID, or when {did} is only {name}. A path on another domain still ends in did.json. See how did:web works.

Credential

The credential’s id is the address. A verifier requests that URL. Opening it in a browser goes to the verifier page for that credential. A tool that asks for JSON-LD or a VC-JWT receives the credential.

When the company has no registry base URL, a credential issued without its own id is:

https://your-wallet.com/api/registry/vc/{uuid}

When Company Registry Base URL is set in company settings, that URL is the prefix and the wallet appends the same UUID. Revocation and suspension lists stay on the deployment host.

A GS1 prefix license and a GS1 company prefix license use the license value:

https://your-wallet.com/api/registry/vc/license/gs1_prefix/{licenseValue}

A GS1 key credential uses the identifier path from the subject, for example 01/00614141123452:

https://your-wallet.com/api/registry/vc/license/gs1_key/{identifier}

A deployment can point GS1 licenses at another license registry. Product data and EPCIS credentials use the UUID address above.

Status list

There is one list for revocation and one for suspension. {purpose} is revocation or suspension:

https://your-wallet.com/api/registry/status/{purpose}/{uuid}

A credential points at one index on that list. The status entry id is the list address, then # and the index, for example https://your-wallet.com/api/registry/status/revocation/{uuid}#42.

Appendix C: Standards and Specifications

W3C Standards

DID Core Specification

  • URL: https://www.w3.org/TR/did-core/
  • Defines DID syntax, DID Documents, and resolution
  • Implemented: did:web, did:key methods

did:web Method

  • URL: https://w3c-ccg.github.io/did-method-web/
  • The domain is part of the identifier. did:web:vc.gs1.org resolves to https://vc.gs1.org/.well-known/did.json
  • A path uses colons in the identifier and slashes in the URL. See how did:web works

Verifiable Credentials Data Model 2.0

  • URL: https://www.w3.org/TR/vc-data-model-2.0/
  • Defines credential structure, proofs, and verification
  • Fully implemented in the wallet

Bitstring Status List v1.0

  • URL: https://www.w3.org/TR/vc-bitstring-status-list/
  • Efficient status tracking for revocation and suspension
  • Replaces older StatusList2021

GS1 Standards

GS1 Digital License

  • URL: https://gs1.github.io/GS1DigitalLicenses/
  • Comprehensive specification for GS1 licenses as verifiable credentials
  • Defines data models for GS1 Prefix Licenses and Company Prefix Licenses
  • Provides verification procedures and trust framework
  • Fully implemented in the GS1 plugin

GS1 Digital Link

  • URL: https://www.gs1.org/standards/gs1-digital-link
  • Web URIs for GS1 identifiers

GS1 Web Vocabulary

  • URL: https://www.gs1.org/voc/
  • Semantic definitions for GS1 data
  • Referenced by GS1 Digital License credentials

Cryptographic Standards

Ed25519

  • RFC 8032: Edwards-Curve Digital Signature Algorithm
  • 256-bit elliptic curve signatures

ES256

  • RFC 7518: ECDSA using P-256 and SHA-256
  • Used in JWT signatures

AES-256-GCM

  • NIST SP 800-38D: Authenticated encryption
  • 256-bit keys with Galois/Counter Mode

Appendix D: Security Architecture Summary

Multi-Layer Encryption

The wallet uses four independent encryption layers:

  1. Service Secret Layer
    • Managed by SSI Service
    • Encrypts Key Access Secrets
    • Combined with user secrets
  2. Key Access Secret Layer
    • Generated per-key
    • Encrypts private keys
    • Stored encrypted in database
  3. User Secret Layer (Optional)
    • Key file provided by you
    • Adds additional encryption layer
    • Never stored on server
    • If not provided, service secret is used instead
  4. Secure Vault Layer
    • Managed by external Secure Key Service Module
    • Vault-backed storage (HashiCorp Vault, Azure Key Vault, HSM)
    • Zero-knowledge design with API-based signing
    • Private keys never leave the security module
    • Enterprise compliance (SOC 2, FIPS 140-2)
    • Independent audit trail for all key operations
    • Integration: SSI Service → Key Service (auth) → Vault (key material) → Signature

Result: Multiple secrets can be required to use a key. User secrets are optional but provide additional defense-in-depth. Vault integration provides enterprise-grade key protection. Compromise of one or even two secrets does not expose private keys.

Physical Secret Separation

Critical secrets are stored in different locations:

  • Service secrets: Application configuration
  • Key access secrets: SSI Service database (encrypted)
  • Private keys: Security Module database (encrypted)
  • User secret key files: Your secure storage (not stored on server)
  • Vault secrets: Secure vault or HSM

An attacker must compromise multiple independent systems to access keys.

Threat Protection

Protected against:

  • Database compromise (keys encrypted)
  • Single secret theft (multiple required)
  • Insider threats (multi-controller keys)
  • Network eavesdropping (key files never transmitted)
  • Lost user secret key files (can rotate keys)

Best practices required for:

  • User secret key file management (store securely with backups)
  • Multi-controller keys for high-value operations
  • Regular key rotation
  • Audit log monitoring

Appendix E: Credential Schema Examples

Basic Credential Structure

The wallet issues Verifiable Credentials Data Model 2.0. A single status entry is an object. The issuer includes the company name, so it is an object. The index is a string.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2"
  ],
  "type": ["VerifiableCredential", "BusinessLicense"],
  "id": "https://your-wallet.com/api/registry/vc/550e8400-e29b-41d4-a716-446655440000",
  "issuer": {
    "id": "did:web:your-wallet.com:api:registry:did:issuer",
    "name": "Example Issuer"
  },
  "validFrom": "2026-01-27T10:00:00Z",
  "validUntil": "2027-01-27T10:00:00Z",
  "credentialSubject": {
    "id": "did:web:company.com",
    "licenseNumber": "BL-2026-001234",
    "companyName": "Acme Corporation",
    "authorizedFor": "Manufacturing",
    "jurisdiction": "European Union"
  },
  "credentialStatus": {
    "id": "https://your-wallet.com/api/registry/status/revocation/6ba7b810-9dad-11d1-80b4-00c04fd430c8#94567",
    "type": "BitstringStatusListEntry",
    "statusPurpose": "revocation",
    "statusListIndex": "94567",
    "statusListCredential": "https://your-wallet.com/api/registry/status/revocation/6ba7b810-9dad-11d1-80b4-00c04fd430c8"
  },
  "proof": {
    "type": "DataIntegrityProof",
    "cryptosuite": "eddsa-rdfc-2022",
    "created": "2026-01-27T10:00:05Z",
    "verificationMethod": "did:web:your-wallet.com:api:registry:did:issuer#key-1",
    "proofPurpose": "assertionMethod",
    "proofValue": "z3FXQ..."
  }
}

GS1 Prefix License Example

This is a prefix license as the wallet issues it. The id is the registry address of the license value. A leading zero on that value is also stored with the zeros removed, as alternativeLicenseValue. The organization name and party GLN use the gs1: names.

{
  "@context": [
    "https://www.w3.org/ns/credentials/v2",
    "https://ref.gs1.org/gs1/vc/license-context",
    "https://raw.githubusercontent.com/european-epc-competence-center/jsonld-context/refs/heads/main/context/render-method"
  ],
  "type": ["VerifiableCredential", "GS1PrefixLicenseCredential"],
  "id": "https://your-wallet.com/api/registry/vc/license/gs1_prefix/0400",
  "issuer": {
    "id": "did:web:your-wallet.com:api:registry:did:global_office",
    "name": "GS1 Global Office"
  },
  "validFrom": "2026-01-01T00:00:00Z",
  "credentialSubject": {
    "id": "did:web:gs1de.org",
    "organization": {
      "gs1:organizationName": "GS1 Germany GmbH",
      "gs1:partyGLN": "4000001000005"
    },
    "licenseValue": "0400",
    "alternativeLicenseValue": "400"
  },
  "credentialStatus": {
    "id": "https://your-wallet.com/api/registry/status/revocation/6ba7b810-9dad-11d1-80b4-00c04fd430c8#12",
    "type": "BitstringStatusListEntry",
    "statusPurpose": "revocation",
    "statusListIndex": "12",
    "statusListCredential": "https://your-wallet.com/api/registry/status/revocation/6ba7b810-9dad-11d1-80b4-00c04fd430c8"
  },
  "credentialSchema": {
    "id": "https://id.gs1.org/vc/schema/v1/prefix",
    "type": "JsonSchema"
  }
}