This document is also available in these non-normative formats: Turtle and JSON-LD
Copyright © 2025 World Wide Web Consortium. W3C® liability, trademark and permissive document license rules apply.
This document describes the Security Vocabulary, i.e., the vocabulary used to ensure the authenticity and integrity of Verifiable Credentials and similar types of constrained digital documents using cryptography, especially through the use of digital signatures and related mathematical proofs .
Alternate versions of the vocabulary definition exist in Turtle and JSON-LD.
This document is merely a W3C-internal document. It has no official standing of any kind and does not represent consensus of the W3C Membership.
Comments regarding this document are welcome. Please file issues directly on GitHub, or send them to public-vc-comments@w3.org (subscribe, archives).
In general, the terms — i.e., the properties and classes — used in the VCDM are formally specified in
Recommendation Track documents published by the W3C Verifiable Credentials
Working Group or, for some deprecated or reserved terms, in Reports published by the W3C Credentials Community Group. In each case of such external
definition, the term's description in this document contains a link to the relevant specification. Additionally, the
rdfs:definedBy property in the RDFS representation(s) refers to the formal specification.
In some cases, a local explanation is necessary to complement, or to replace, the definition found in an external
specification. For instance, this is so when the term is needed to provide a consistent structure to the RDFS
vocabulary, such as when the term defines a common supertype for class instances that are used as objects of
specific properties, or when RDF Graphs are
involved. For such cases, the extra definition is included in the current document (and the rdfs:comment property
is used to include them in the RDFS representations).
xsd datatypes).This specification makes use of the following namespaces:
sechttps://w3id.org/security#credhttps://www.w3.org/2018/credentials#dchttp://purl.org/dc/terms/dctermshttp://purl.org/dc/terms/owlhttp://www.w3.org/2002/07/owl#rdfhttp://www.w3.org/1999/02/22-rdf-syntax-ns#rdfshttp://www.w3.org/2000/01/rdf-schema#xsdhttp://www.w3.org/2001/XMLSchema#vshttp://www.w3.org/2003/06/sw-vocab-status/ns#schemahttp://schema.org/jsonldhttp://www.w3.org/ns/json-ld#The following @context files make use of the terms defined in this specification:
The following are property definitions in the sec namespace.
Verification method
See the formal definition of the term.
VerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/cid/v1Controller
See the formal definition of the term.
The property's value should be a URL, i.e., not a literal.
VerificationMethodControlledIdentifierDocument@contexts:https://w3id.org/security/multikey/v1,https://w3id.org/security/jwk/v1,https://www.w3.org/ns/did/v1,https://www.w3.org/ns/cid/v1Proof sets
See the formal definition of the term.
ProofGraph@contexts:https://www.w3.org/ns/credentials/v2,https://w3id.org/security/data-integrity/v2Domain of a proof
See the formal definition of the term.
xsd:stringProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Challenge of a proof
See the formal definition of the term.
xsd:stringProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Previous proof
See the formal definition of the term.
ProofProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Proof purpose
See the formal definition of the term.
VerificationRelationshipProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Proof value
See the formal definition of the term.
multibaseProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Proof creation time
See the formal definition of the term.
xsd:dateTimeProof@context:https://w3id.org/security/data-integrity/v2Expiration time for a proof or verification method
See the formal definitions here and here.
expires as a shortened term in JSON-LD. Since this shortened term and its mapping to this property are in significant use in the ecosystem, the inconsistency between the short term name (expires) and the property identifier (...#expiration) is expected and should not trigger an error.xsd:dateTimeProofVerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/cid/v1Nonce supplied by proof creator
See the formal definition of the term.
xsd:stringProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Authentication method
See the formal definition of the term.
VerificationRelationshipVerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/did/v1,https://www.w3.org/ns/cid/v1Assertion method
See the formal definition of the term.
VerificationRelationshipVerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/did/v1,https://www.w3.org/ns/cid/v1Capability delegation method
See the formal definition of the term.
capabilityDelegation as a shortened term in JSON-LD. Since this shortened term and its mapping to this property are in significant use in the ecosystem, the inconsistency between the short term name (capabilityDelegation) and the property identifier (...#capabilityDelegationMethod) is expected and should not trigger an error.VerificationRelationshipVerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/did/v1,https://www.w3.org/ns/cid/v1Capability invocation method
See the formal definition of the term.
capabilityInvocation as a shortened term in JSON-LD. Since this shortened term and its mapping to this property are in significant use in the ecosystem, the inconsistency between the short term name (capabilityInvocation) and the property identifier (...#capabilityInvocationMethod) is expected and should not trigger an error.VerificationRelationshipVerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/did/v1,https://www.w3.org/ns/cid/v1Key agreement protocols
See the formal definition of the term.
keyAgreement as a shortened term in JSON-LD. Since this shortened term and its mapping to this property are in significant use in the ecosystem, the inconsistency between the short term name (keyAgreement) and the property identifier (...#keyAgreementMethod) is expected and should not trigger an error.VerificationRelationshipVerificationMethod@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2,https://www.w3.org/ns/did/v1,https://www.w3.org/ns/cid/v1Cryptographic suite
See the formal definition of the term.
cryptosuiteStringDataIntegrityProof@contexts:https://w3id.org/security/data-integrity/v2,https://www.w3.org/ns/credentials/v2Public key multibase
See the formal definition of the term.
multibaseMultikey@contexts:https://w3id.org/security/multikey/v1,https://www.w3.org/ns/cid/v1Secret key multibase
See the formal definition of the term.
multibaseMultikey@contexts:https://w3id.org/security/multikey/v1,https://www.w3.org/ns/cid/v1Public key JWK
See the formal definition of the term.
rdf:JSONJsonWebKey@contexts:https://w3id.org/security/jwk/v1,https://www.w3.org/ns/cid/v1Secret key JWK
See the formal definition of the term.
rdf:JSONJsonWebKey@contexts:https://w3id.org/security/jwk/v1,https://www.w3.org/ns/cid/v1Revocation time
See the formal definition of the term.
xsd:dateTimeVerificationMethod@contexts:https://w3id.org/security/jwk/v1,https://www.w3.org/ns/cid/v1,https://w3id.org/security/multikey/v1Digest multibase
See the formal definition of the term.
digestSRI and digestMultibase.multibase@context:https://www.w3.org/ns/credentials/v2The following are class definitions in the sec namespace.
Controlled Identifier Document
See the formal definition of the term.
controllerDigital proof
See the formal definition of the term.
previousProofdomain, challenge, previousProof, proofPurpose, proofValue, created, nonceexpirationAn RDF Graph for a digital proof
proofVerification method
See the formal definition of the term.
verificationMethod, authentication, assertionMethod, capabilityDelegationMethod, capabilityInvocationMethod, keyAgreementMethodrevokedcontroller, expirationVerification relationship
See the formal definition of the term.
rdf:PropertyproofPurposeA Data Integrity Proof
See the formal definition of the term.
ProofcryptosuiteMultikey Verification Method
See the formal definition of the term.
VerificationMethodpublicKeyMultibase, secretKeyMultibase@contexts:https://w3id.org/security/multikey/v1,https://www.w3.org/ns/cid/v1JSON Web Key Verification Method
See the formal definition of the term.
VerificationMethodpublicKeyJwk, secretKeyJwk@contexts:https://w3id.org/security/jwk/v1,https://www.w3.org/ns/cid/v1ED2559 Verification Key, 2020 version
See the formal definition of the term.
VerificationMethodEd25519 Signature Suite, 2020 version
See the formal definition of the term.
ProofProcessing error
See the formal definition of the term.
The following are datatype definitions in the sec namespace.
Datatype for cryptosuite Identifiers
See the formal definition of the term.
xsd:stringcryptosuite@context:https://w3id.org/security/data-integrity/v2Datatype for multibase values
See the formal definition of the term.
xsd:stringproofValue, publicKeyMultibase, secretKeyMultibase, digestMultibase@context:https://w3id.org/security/multikey/v1The following are definitions for individuals in the sec namespace.
Proof generation error
See the formal definition of the term.
ProcessingErrorMalformed proof
See the formal definition of the term.
ProcessingErrorMismatched proof purpose
See the formal definition of the term.
ProcessingErrorInvalid proof domain
See the formal definition of the term.
ProcessingErrorInvalid challenge
See the formal definition of the term.
ProcessingErrorInvalid verification method URL
See the formal definition of the term.
ProcessingErrorInvalid controlled identifier document id
See the formal definition of the term.
ProcessingErrorInvalid controlled identifier document
See the formal definition of the term.
ProcessingErrorInvalid verification method
See the formal definition of the term.
ProcessingErrorInvalid relationship for verification method
See the formal definition of the term.
ProcessingErrorAll terms in this section are reserved. Implementers may use these properties, but should expect them and/or their meanings to change during the process to normatively specify them.
The following are reserved property definitions in the sec namespace.
Allowed action (reserved)
See the formal definition of the term.
Capability chain (reserved)
See the formal definition of the term.
Capability action (reserved)
See the formal definition of the term.
Caveat (reserved)
See the formal definition of the term.
Delegator (reserved)
See the formal definition of the term.
Invocation target (reserved)
See the formal definition of the term.
Invoker (reserved)
See the formal definition of the term.
All terms in this section are deprecated, and are only kept in this vocabulary for backward compatibility.
New applications should not use them.
The following are deprecated property definitions in the sec namespace.
Blockchain account ID (deprecated)
See the formal definition of the term.
xsd:stringEthereum address (deprecated)
See the formal definition of the term.
xsd:stringBase58-encoded Public Key (deprecated)
See the formal definition of the term.
xsd:stringPublic key PEM (deprecated)
See the formal definition of the term.
xsd:stringHex-encoded version of public Key (deprecated)
See the formal definition of the term.
xsd:stringJson Web Signature (deprecated)
See the formal definition of the term.
The following are deprecated class definitions in the sec namespace.
Cryptographic key (deprecated)
ecdsa-sep256k1, 2019 version (deprecated)
See the formal definition of the term.
ecdsa-sep256k1, 2020 version (deprecated)
See the formal definition of the term.
ecdsa-secp256k1 verification key, 2019 version (deprecated)
See the formal definition of the term.
Keyecdsa-secp256k1 recovery signature, 2020 version (deprecated)
See the formal definition of the term.
ecdsa-secp256k1 recovery method, 2020 version (deprecated)
See the formal definition of the term.
Merkle Proof (deprecated)
See the formal definition of the term.
X25519 Key Agreement Key, 2019 version (deprecated)
See the formal definition of the term.
ED2559 Verification Key, 2018 version (deprecated)
See the formal definition of the term.
JSON Web Key, 2020 version (deprecated)
See the formal definition of the term.
JsonWebSignature2020JSON Web Signature, 2020 version (deprecated)
See the formal definition of the term.
BBS Signature, 2020 version (deprecated)
See the formal definition of the term.
BBS Signature Proof, 2020 version (deprecated)
See the formal definition of the term.
BLS 12381 G1 Signature Key, 2020 version (deprecated)
See the formal definition of the term.
BLS 12381 G2 Signature Key, 2020 version (deprecated)
See the formal definition of the term.
xsd datatypes).The diagram uses boxes, ellipses, and connecting lines with different "styles" (border color, end marker, line type) to differentiate their semantic meaning: "Property", "Class", and "Datatype" are identified by the shape of the graph node (e.g., an ellipse signifies a "Class"); "Superclass", "Domain Of", "Range", "Type", and "Contains" relationships are identified by the style of the connecting line. These style names are used in the explanation text that follows, below.
The diagram is roughly divided into three sections — lower left, lower right, and upper. To make this description easier to understand, these sections will be respectively referred to as the "Proof", "Verification Method", and "Verification Relationship" sections. Shapes in the three sections are connected by lines of different styles; additionally, one box, labeled as "multibase" and shaped as "Datatype", bridges the two lower sections ("Proof" and "Verification Method").
Each of these sections has an ellipse at the top, labeled as "Proof", "VerificationMethod", and "VerificationRelationship", respectively. The Verification Method section includes an additional ellipse, labeled as "ControllerDocument", side-by-side with the ellipse labeled as "VerificationMethod".
The left side of the section contains another ellipse, labeled as "ProofGraph", and connected with a line styled as "Contains" to the "Proof" ellipse. A separate box, styled as "Property" and labeled as "proof", is connected with a line styled as "Range" to the "ProofGraph" ellipse.
There are two more ellipses in this section, labeled as "Ed25519Signature2020" and "DataIntegrityProof", and each connected to the "Proof" ellipse with lines styled as "Superclass". The "DataIntegrityProof" ellipse is also connected to a box, styled as "Property" and labeled as "cryptosuite", with a line styled as "Domain Of". The "cryptosuite" Property box is connected to a shape, styled as "Datatype" and labeled as "cryptosuiteString", with a line styled as "Range".
The right side of the section contains a column of labeled boxes, all styled as "Property". The labels, from top to bottom, are "previousProof", "domain", "challenge", "nonce", "created", and "proofValue". The "Proof" ellipse is connected to all of these boxes with lines styled as "Domain Of". The "previousProof" box is also connected to the "Proof" ellipse, with a line styled as "Range". The "proofValue" box is connected to a shape, styled as "Datatype" and labeled as "multibase", with a line styled as "Range". Finally, the same "multibase" "Datatype" shape is connected to another box, styled as "Property" and labeled as "digestMultibase", with a line styled as "Range".
The left side of this section contains a column of three labeled boxes, all styled as "Property". The labels, from top to bottom, are "controller", "expires", and "revoked". Each of these is connected to the "VerificationMethod" ellipse, with a line styled as "Domain Of". The "controller" "Property" box is also connected to the "ControllerDocument" ellipse, while the "expires" "Property" box is also connected to the "Proof" ellipse (in the Proof section); both of these extra connecting lines are styled as "Domain Of".
There is also a distinct box, styled as "Property" and labeled as "verificationMethod". This "verificationMethod" box is connected to the "VerificationMethod" ellipse, with a connecting line styled as "Range".
The middle of this section contains three more ellipses, labeled as "Multikey, "Ed25519VerificationKey2020", and "JsonWebKey". Each of these is connected to the "VerificationMethod" ellipse, with a line styled as "Superclass".
Two boxes, styled as "Property" and labeled as "secretKeyMultibase" and "publicKeyMultibase", are connected to the ellipse labeled as "Multikey" with a line styled as "Domain Of". Each of these boxes is also connected to the "multibase" "Datatype" shape in the Proof section, with lines styled as "Range".
Finally, two boxes, styled as "Property" and labeled as "secretKeyJwk" and "publicKeyJwk", are connected to the "JsonWebKey" ellipse, with a line styled as "Domain Of". Both boxes are also connected to a shape, styled as "Datatype" and labeled as "rdf:JSON", with lines styled as "Range".
The left side of the section contains a single box, styled as "Property" and labeled as "proofPurpose". This box is connected to the "VerificationRelationship" ellipse, with a line styled as "Range". It is also connected to the "Proof" ellipse in the Proof section, with a line styled as "Domain Of".
The right side of the section contains a column of labeled boxes, all styled as "Property". The labels, from top to bottom, are "verificationMethod", "authentication", "assertionMethod", "capabilityDelegation", "capabilityInvocation", and "keyAgreement". Each of these boxes is connected to the "VerificationMethod" ellipse in the Verification Method section, with a line styled as "Range". Finally, each of these boxes is also connected to the "VerificationRelationship" ellipse, with a line styled as "Type".