Authentication vs. authorisation
Authentication asks whether you are who you claim to be. Authorisation asks whether you are allowed to do the thing you are attempting. Many systems blur the two, which is why a valid login does not always mean a valid permission.
Public key infrastructure (PKI)
A system of certificates and trusted authorities that ties a public key to a person, device or organisation. Most web security and many government ID schemes rest on it, and so do some wallets.
Decentralised identifiers (DIDs)
A web standard for identifiers that the owner controls rather than a platform. A DID can be resolved to the public keys needed to verify that person or organisation without asking a central registry.
Verifiable credentials
A standard format for digitally signed claims, such as a degree, a licence or a membership. The holder keeps the credential and shows it to a verifier, who can check the issuer's signature.
Selective disclosure
Revealing only the part of a credential that is needed, for example proving you are over 18 without handing over your birth date or home address.
Self-sovereign identity
An approach in which individuals hold their own credentials in a wallet app and decide whom to show them to. Its promise is control and privacy; its challenge is recovery when a device is lost.
Biometrics and liveness checks
Fingerprint or face matching links a person to a credential, and liveness checks try to confirm that a real person is present rather than a photo or recording. Biometric data is hard to change if leaked, so it needs strong protection.
