Data Integrity Proof

A Data Integrity Proof is a cryptographic signature attached directly to a JSON-LD document as a proof property, rather than wrapping the whole document in a JWT or COSE envelope. It's the W3C's answer to "how do I sign linked data itself, so the signature survives even if the document gets reformatted": the signature is computed over a canonicalized (deterministically-ordered) form of the underlying RDF graph, not over the raw JSON bytes.

A Data Integrity Proof block typically looks like this:

"proof": {
  "type": "DataIntegrityProof",
  "cryptosuite": "eddsa-rdfc-2022",
  "created": "2026-05-01T10:30:00Z",
  "verificationMethod": "did:example:issuer#key-1",
  "proofPurpose": "assertionMethod",
  "proofValue": "z3FXQ..."
}

The spec itself (developed within the W3C VC Working Group, with editors including Manu Sporny and Dave Longley) defines the shape; the actual signing algorithm is pluggable via named cryptosuites, eddsa-rdfc-2022 for Ed25519, ecdsa-rdfc-2019 for ECDSA, and bbs-2023 for BBS+ selective-disclosure signatures (the BBS cryptosuite work was driven substantially through the DIF/W3C BBS working group). Earlier, pre-standardization suite names like Ed25519Signature2020 and BbsBlsSignature2020 came from the "Linked Data Proofs" lineage that Data Integrity formalized and superseded.

Solidus status

Solidus's BBS+ signatures are UNAUDITED, audit targeted H2 2026 via NLnet NGI Zero, none exists today, and everything here runs on public testnet with no mainnet. With that stated: Solidus's own documentation shows exactly the Data Integrity shape, a proof block with type, created, verificationMethod, proofPurpose, and proofValue fields, using the earlier suite names Ed25519Signature2020 and BbsBlsSignature2020 rather than the newer eddsa-rdfc-2022/bbs-2023 cryptosuite names. Solidus didn't design the spec or either cryptosuite; it wrote a signer conforming to that documented shape.

But, same gap as the JSON-LD entry, stated with the same directness: the credential format Solidus's testnet issuer actually serves today is vc+sd-jwt (confirmed live via curl -s https://capture-api.solidus.network/.well-known/openid-credential-issuer, checked 2026-07-17), secured by a JOSE/JWS signature, not a Data Integrity proof block. So Data Integrity Proof is documented in Solidus's spec material but is not what the live, shipped issuance path produces right now.