China RealDID: Verifiable Credentials Anchored in Legal Identity

Abstract

Verifiable credentials (VCs) and decentralized identifiers (DIDs) enable selective disclosure but lack legal anchoring: without a trusted identity root, verifiers cannot distinguish a genuine holder from a fabricated identity. State identity systems provide biometric-grounded verification but impose three costs: verifiers must collect subjects'full personally identifiable information, infrastructure concentrates on a single API, and the state observes every transaction. We present China RealDID, a three-layer architecture -- CTID (centralized legal identity), RealDID (decentralized anchor on an open permissioned blockchain), and VCs with SD-JWT-based selective disclosure -- evaluated against five adversary classes and six security goals. The central mechanism is a content-blind government relay: the state authenticates participants and counter-signs every credential but cannot read the payload, encrypted by the issuer to the holder's public key. We describe the VC lifecycle, triple-signature chain, open template registry, and the architecture's metadata-level privacy limits, including the credential graph at the relay and presentation linkability from single-DID reuse. The design yields an asymmetric, state-bounded trust model: the state cannot impersonate or read contents; the user cannot fabricate identity or evade metadata observation. We analyze alignment with China's Personal Information Protection Law and the EU's GDPR, including the tension between immutable registries and erasure rights, and discuss generalizability through cross-border deployments with Singapore and Hong Kong.