FirmaRED Protocol

[alejodsarmiento-lgtm]

Instructions for Pull Requests

Please read these instructions thoroughly in order to ensure that your pull request is processed in a timely manner. This document contains detailed instructions for registering a DID Method. If your pull request concerns some other change to the repository, you may delete all of the text in this text box and write up a more relevant description.

There is a DID Method Registration form below that MUST be included in a DID Method Registration Request. The form includes check boxes that you are expected to fill out when you submit your request.

Once you submit your request, your pull request will be reviewed by the registry editors. Changes regarding the required criteria may be requested. If there are no objections or changes requested, your DID method will be registered after a minimum of 7 days.

DID Method Registration Process

In order to register a new DID method, you must add a JSON file to the ./methods directory.

Here is an example registration entry:

{
  // These fields are required
  "name": "example",
  "status": "registered",
  "specification": "https://w3c-ccg.github.io/did-spec/",
  // These fields are optional
  "contactName": "W3C Credentials Community Group",
  "contactEmail": "",
  "contactWebsite": "",
  "verifiableDataRegistry": "DID Specification"
}

Your Pull Request will be automatically validated, please ensure that all of the automated tests pass (no errors reported) or your submission will not be reviewed. Common reasons for failed validation includes invalidly formatted JSON files and missing mandatory fields.

----- DID METHOD REGISTRATION FORM: DELETE EVERYTHING ABOVE THIS LINE ------

DID Method Registration

As a DID method registrant, I have ensured that my DID method registration complies with the following statements:

• The DID Method specification defines the DID Method Syntax.
• The DID Method specification defines the Create, Read, Update, and Deactivate DID Method Operations.
• The DID Method specification contains a Security Considerations section.
• The DID Method specification contains a Privacy Considerations section.
• The JSON file I am submitting has passed all automated validation tests below.
• The JSON file contains a contactEmail address [OPTIONAL].
• The JSON file contains a verifiableDataRegistry entry [OPTIONAL].

[swcurran]

I used a translator to get an English version of the spec, and my comments are based on the accuracy of the translation.

The spec states that the DID is did:cuil:<cuil>, where the <cuil> is the government-issued CUIL of the person. The spec also states that the "CUIL is not in the DID Doc", but if the CUIL is in the DID, it is in the DIDDoc. I'm guessing the intention is that the DID method-specific part of the DID (<cuil>) is not supposed to be the CUIL itself, but some sort of derived value. However, that is not what the translation of the spec says.

Clarification is required -- or an update to the Security and Privacy to say that the CUIL is in the DID Doc.

[ottomorac]

Hola @alejodsarmiento-lgtm ,

Buen dia. Haciendo antencion a los cambios solicitados por @swcurran sugiero que realices las adiciones que el sugiere. Te facilito ademas algunos ejemplos de DID methods que tienen la documentacion mas completa segun el menciona.

Puedes ver ejemplos aqui:

• https://docs.cheqd.io/product/architecture/adr-list/adr-001-cheqd-did-method#verification-method
• https://identity.foundation/didwebvh/v1.0/#did-method-operations
• https://github.com/iden3/did-iden3/blob/main/did-iden3-method.md#basic-operations

Saludos,

Otto

[ottomorac]

/ai-review

[github-actions]

🤖 AI Preliminary Specification Review

This is an advisory, automated review of the DID Method specification(s) referenced in this pull request, checked against the registration checklist. It does not replace review by the registry editors.

✅ All reviewed submissions passed the preliminary checklist review. A registry editor will still perform the final review.

methods/did-cuil.json — method did:cuil

Specification: https://firmared.com/did-spec/cuil/v1

Preliminary verdict: ✅ PASS

The did:cuil specification is a legitimate DID Method spec with defined syntax, full CRUD operations, and security/privacy considerations. Content is largely in Spanish but substantive; a few advisory concerns exist around thinness of prose and the potential privacy sensitivity of using national fiscal identifiers.

	Item	Level	Status	Notes
✅	M1. Specification is reachable and is a DID Method specification	MUST	pass
✅	M2. DID Method Syntax is defined	MUST	pass
✅	M3. CRUD operations are defined	MUST	pass
⚠️	M4. Security Considerations section is present and substantive	MUST	warn	Section 5 (Seguridad) exists and covers post-quantum keys, ZK privacy, blockchain anchoring, and key custody, but it is presented as brief feature cards rather than prose paragraphs describing concrete threats/mitigations, so it is somewhat thin.
✅	M5. Privacy Considerations section is present and substantive	MUST	pass
✅	M6. Method name is indicative and non-generic	MUST	pass
⚠️	M7. No unreasonable legal, security, moral, or privacy harms	MUST	warn	The method derives DIDs deterministically from a national fiscal identifier (CUIL), which raises correlation/enumeration concerns; the spec mitigates via ZK commitments and never publishing the CUIL, but deterministic did:cuil:{cuil} identifiers are inherently enumerable. Not a clear-cut harm, flagged for editor attention.
✅	M8. Human-readable description of the addition	MUST	pass
⚠️	S1. contactEmail present	OPTIONAL	warn	The JSON entry uses a 'contact' field (protocol@firmared.com) rather than the 'contactEmail' field named in the checklist; a contact email is nonetheless provided.
⚠️	S2. verifiableDataRegistry present	OPTIONAL	warn	The JSON entry has no 'verifiableDataRegistry' field, though the spec mentions Ethereum and Bitcoin anchoring plus HTTPS-published DID Documents.
⚠️	S3. Intellectual-property posture is clear	SHOULD	warn	No explicit IP/copyright/licensing statement is present in the specification; absence is a warning only.

[chongkan]

@alejodsarmiento-lgtm I read a bit on this and the firmared.com website. Seems you are leveraging the Fiscal IDs and I think you may be interested in the did:pki and did:x509 methods, they leverage the x509 certs, and the did:pki leverages specifically the Firma Digital certificates and the did:pki has support for Argentina. I haven't been able to test in full for Argentina signatures but you could test with yours.

We have tested for CR and Spain so far, the others are still pending full testing.

Let me know if you have any questions. Spanish is my mother.native language. I am from Costa Rica.