English

xChk: Bring Your Own Identity -- Heterogeneous Assurance with Verifier-Determined Sufficiency

Cryptography and Security 2026-07-15 v1 Computers and Society

Abstract

We present xChk, a reference identity provider for Bring Your Own Identity (BYOI): users enroll via heterogeneous proofs (government KYC, corporate SSO, WebAuthn/FIDO2, professional networks, live verification, longitudinal activity, behavioral signals) and disclose them as portfolio claims in standard OAuth 2.0 / OpenID Connect (OIDC) tokens, while each relying party applies its own sufficiency policy - the IdP transports claims and may evaluate an RP-supplied evidence policy for consent, but does not adjudicate access. Enrollment depth varies by modality (some paths are user-initiated; org KYB and officer binding are operator-assisted). xChk also supports human-in-the-loop attestation for high-risk actions: humans can initiate attestations directly (browser UI / POST /api/attestations), and AI agents acting under those principals can trigger the same gateway via scope-gated authorize/attest - hash-chained human approvals on a shared verification graph (humans via OIDC; agents via API keys). A production deployment at https://in.xchk.io ships both initiation paths with bilateral RP evaluation at consent; one documented relying party (https://crabbyed.com, Appendix B) exercises Login with xChk.

Keywords

Cite

@article{arxiv.2607.13369,
  title  = {xChk: Bring Your Own Identity -- Heterogeneous Assurance with Verifier-Determined Sufficiency},
  author = {Sean MacGuire},
  journal= {arXiv preprint arXiv:2607.13369},
  year   = {2026}
}

Comments

19 pages, 4 figures. Reference implementation at https://in.xchk.io; one documented RP (crabbyed.com, Appendix B)