What is a digital identity?

Parts of a digital identity

Most digital identities combine:

• Attributes: name, date of birth, ID number.
• Proofing: evidence that someone verified those attributes, for example against the National ID.
• Credentials: something you hold or are, such as a private key or fingerprint, used to prove you are the person.

Weak and strong identities

A mobile number proven by an OTP shows control of a SIM, not who someone is. A certificate issued after identity proofing, with a key kept in secure hardware, ties a person to what they sign. The difference matters most when a document is disputed.

In Nepal

The National ID system, with its NIN and the National ID card, is the base for identity proofing. The older citizenship certificate is still widely used. Under the Electronic Transactions Act, certificates from licensed authorities give digital signatures a legal footing.

Privacy

Good systems share the minimum. A business that needs to know whether details are genuine can ask for match or no match instead of a full record. Keys that stay on the device mean there is no central store of signing secrets to breach.

An example: an employer onboarding staff

An employer hires fifty people in a month. On paper, each hire brings photocopies, the HR clerk checks them against originals and everything goes into a file. With a digital identity, the employer asks each hire to verify their National ID details, and the employee then signs the appointment letter, the confidentiality clause and the policy acknowledgement on their phone.

What the employer gets is a record that ties each signature to a verified person, not a scan of something anyone could have signed. What the employee gets is a certificate that can be reused for later documents. See HR documents and digital signatures in Nepal for the documents most employers sign first.

Levels of assurance

Not every service needs the same strength. Reading a library catalogue needs almost nothing. Opening a bank account needs proof that a real person with a specific National ID is behind the request. Signing a large loan needs more: a key only that person controls, and evidence that ties the signature to the document.

Thinking in levels helps you choose. A mobile number and an OTP is a low level, a National ID match is a medium level for attributes, and a certificate with a key in secure hardware is a high level for signing. Match the level to the harm if the identity turns out to be false.

Identity in a signing flow

Walk through a signature. First the person is proofed, for example by a National ID match. Next the certifying authority issues a certificate that names them. Then they create a key on their phone. When they sign, the biometric releases the key, the key signs the document hash and the certificate travels with the signature.

Each step is part of the identity. Weaken any of them, say by letting someone else enrol a fingerprint on the phone, and the signature no longer shows what it appears to show. That is why guidance to signers matters as much as the cryptography.

Digital identity with ePahichan

ePahichan ties an identity checked against the National ID to a certificate from a licensed certifying authority, with the signing key held in the phone’s secure hardware and unlocked by fingerprint or face.