A did:key for ML-DSA-87
did:key:z + base58btc( varint(0x1212) ‖ public key ). 0x1212 is the draft multicodec
for mldsa-87-pub, the same codepoint ysdk.org's manifest and schema record. About 3,550 characters.
YOS identity · did:key issuer
A post-quantum identity, minted here, kept by you.
ydid issues did:key identifiers for ML-DSA-87 (FIPS 204) entirely inside this browser tab. There is no account and no server behind this page: the key pair is generated on this device, the DID is derived from the public half, and the private half exists only in this tab until you download it.
This origin cannot make a network request at all — its Content-Security-Policy says connect-src 'none'.
A key that cannot be sent cannot leak in transit.
The door
ydid is behind the estate's soft wall. Say the shared word to open the issuer.
What you get, and what stays with you
Custody files, unencrypted in v1
A JOSE AKP JWK (public key + 32-byte seed) and the raw key bytes, written to your disk through a
blob: URL. No passphrase, no key derivation, no Argon2 of any kind in v1 — the file holds the
private key in the clear and the page says so before you download.
Sign, then prove it
Sign a YSDK manifest into a { manifest, proof } envelope with your key, then check it on
/verify/, where a fresh demo key also runs the sign → verify → tamper roundtrip live.
What v1 does not do
- It does not resolve or register anything. did:key needs no registry; there is no directory here and no lookup service.
- It does not encrypt your key file. v1 has no passphrase and no KDF. Custody is yours: an unencrypted file on a shared drive is a leaked identity.
- It does not recover a lost key. There is no escrow and no reset. Lose the file, lose the identity.
- It has not been audited. The signer is
@noble/post-quantum0.7.1, self-hosted; no third party has reviewed this page. - It ships no service worker. v1 is online-only by choice, so no cache can ever serve a stale signer.
- Multicodec 0x1212 is a draft codepoint. The value used is recorded in every artifact so a future migration can find it.