Executive Summary: As decentralized identity (DID) platforms gain traction, their underlying infrastructure becomes a prime target for cyber adversaries. The ceramic-p2p-node, a core component of the Ceramic Network, is designed to enable self-sovereign identity (SSI) by anchoring DIDs to a peer-to-peer (P2P) ledger. However, our analysis reveals critical security vulnerabilities that could undermine trust in DID ecosystems. This report examines these flaws in the context of escalating SIM swapping and identity theft threats—such as those recently exposed in the SK Telecom breach—and evaluates risks to user authentication, data integrity, and long-term identity resilience. We present actionable recommendations for developers, enterprises, and users to mitigate exposure.
Decentralized identity (DID) platforms promise self-sovereign control over digital identities, decoupling authentication from centralized authorities like telecom providers or social networks. Ceramic Network, built on IPFS and a Libp2p-based P2P network, exemplifies this vision through its ceramic-p2p-node, which manages DID resolution, stream updates, and data replication across nodes. While this architecture enhances resilience and censorship resistance, it also introduces novel attack surfaces—particularly in node-to-node communication, key storage, and identity anchoring.
Recent high-profile breaches, including the SK Telecom cyberattack (May 2025), underscore the real-world stakes. In that incident, attackers exfiltrated IMSI, IMEI, and authentication keys—critical identifiers used in SIM-based authentication. Such breaches highlight the dangers of linking identity systems to vulnerable infrastructure (e.g., telecom networks), and the urgent need for DID platforms to decouple authentication from SMS-based or SIM-dependent mechanisms.
The ceramic-p2p-node relies on Libp2p for node communication and IPFS for content addressing. However, it lacks robust hardware-backed key storage (e.g., HSMs or secure enclaves). Private keys used to sign DID documents are often stored in software keystores, making them susceptible to extraction via malware or side-channel attacks. In the event of a node compromise—such as a supply-chain attack or insider threat—the attacker gains the ability to forge identity assertions, impersonate users, and rewrite DID streams.
This risk is amplified in mobile or edge deployments, where devices may be physically accessible or run untrusted code. Without multi-party computation (MPC) or threshold signatures, the system remains vulnerable to single-point breaches.
The Libp2p-based gossip protocol underpinning ceramic-p2p-node is theoretically robust but practically fragile under adversarial conditions. Key risks include:
While Ceramic implements RFCs for stream validation, these defenses are reactive. Dynamic peer scoring and proof-of-work (PoW) for node admission remain optional, leaving room for exploitation.
The July 2025 report on SIM swapping attacks demonstrates how SMS-based second factors are increasingly compromised. Ceramic’s DID system, while designed to be agnostic to authentication methods, often defaults to email or SMS recovery flows. This creates a dangerous dependency on telecom infrastructure—precisely the vector exploited in the SK Telecom breach.
Moreover, many DID wallets and identity hubs integrate with mobile devices, which themselves are vulnerable to SIM cloning. Without app-based MFA (e.g., FIDO2, TOTP), users remain exposed to account takeover, even if their DID credentials are cryptographically sound.
Ceramic uses Streams and Anchors to represent DIDs and their state transitions. While the system verifies signatures on each update, it does not mandate:
This creates a risk of "forking identity"—where two divergent versions of a DID document coexist, enabling spoofing and denial-of-authentication attacks.
Ceramic’s logging and monitoring capabilities are minimal. Node operators lack visibility into:
This opacity hinders incident response and regulatory compliance (e.g., under eIDAS 2.0 or GDPR). In the event of identity theft, users and regulators cannot reliably trace the source of compromise.
autonat for NAT traversal and validation.