Authentication in TLS is predominately carried out with X.509 digital certificates issued by certificate authorities (CA). The centralized nature of current public key infrastructures, however, comes along with severe risks, such as single points of failure and susceptibility to cyber-attacks, potentially undermining the security and trustworthiness of the entire system. With Decentralized Identifiers (DID) alongside distributed ledger technology, it becomes technically feasible to prove ownership of a unique identifier without requiring an attestation of the proof's public key by a centralized and therefore vulnerable CA. This article presents DID Connect, a novel authentication scheme for TLS 1.3 that empowers entities to authenticate in a TLS-compliant way with self-issued X.509 certificates that are equipped with ledger-anchored DIDs instead of CA-issued identifiers. It facilitates the exchange of tamper-proof and 3rd-party attested claims in the form of DID-bound Verifiable Credentials after the TLS handshake to complete the authentication with a full identification of the communication partner. A prototypical implementation shows comparable TLS handshake durations of DID Connect if verification material is cached and reasonable prolongations if it is obtained from a ledger. The significant speed improvement of the resulting TLS channel over a widely used, DID-based alternative transport protocol on the application layer demonstrates the potential of DID Connect to become a viable solution for the establishment of secure and trustful end-to-end communication links with decentrally managed digital identities.

翻译：TLS协议中的认证主要依赖于证书颁发机构（CA）签发的X.509数字证书。然而，现有公钥基础设施的集中化特性带来了严重风险，例如单点故障和易受网络攻击，这可能导致整个系统的安全性和可信度受到削弱。借助去中心化标识符（DID）与分布式账本技术，无需依赖集中式且易受攻击的CA对证明的公钥进行认证，即可在技术层面实现唯一标识符所有权证明。本文提出DID Connect——一种针对TLS 1.3的新型认证方案，允许实体以符合TLS规范的方式，使用配备账本锚定DID的自签发X.509证书（而非CA签发的标识符）进行身份认证。该方案在TLS握手完成后，通过交换基于DID的可验证凭证（即不可篡改且经第三方认证的声明），实现对通信伙伴的完整身份识别。原型实现表明：当验证材料被缓存时，DID Connect的TLS握手时长与现有方案相当；当从账本获取验证材料时，其延迟增加幅度在合理范围内。与应用程序层广泛使用的基于DID的替代传输协议相比，DID Connect构建的TLS信道在速度上具有显著提升，这证明了其作为建立安全可信端到端通信链路（采用去中心化管理数字身份）的可行方案的潜力。