KERI: 2 Universal DKMI A, e vt
Background Reading
Girault, M., “Self-certified public keys,” EUROCRYPT 1991: Advances in Cryptology, pp. 490-497, 1991 Kaminsky, M. and Banks, E., “SFS-HTTP: Securing the Web with Self-Certifying URLS,” MIT, 1999 Matzieres, D. and Kaashoek, M. F., “Escaping the Evils of Centralized Control with self-certifying pathnames,” MIT Laboratory for Computer Science, 2000 Matzieres, D., “Self-certifying File System,” MIT Ph.D. Dissertation, 2000/06/01 Smith, S. M., “Open Reputation Framework,” vol. Version 1.2, 2015/05/13. Smith, S. M. and Khovratovich, D., “Identity System Essentials,” 2016/03/29 Smith, S. M., “Decentralized Autonomic Data (DAD) and the three R's of Key Management,” Rebooting the Web of Trust RWOT 6, Spring 2018
hetps:/jgithub.comiSmithSamuelM/Papers/blobjmasteriwhitepapers/DecentralizedAutonomicData.pdf Smith, S. M., “Key Event Receipt Infrastructure (KERI) Design and Build,” arXiv, 2019/07/03
Human Basis of Trust I know you or I know of you therefore I trust you On the internet | can’t really know who you are. therefore | can’t trust you
Decentralized Control Authority Assymetric PKI: Public-Private Key Pairs with Digital Signatures CSPRNG Cryptographic Strength Pseudo Random Number Generator Collision Resistant Random Seed (Entropy) Available to Anyone Seed -> Private Key -> One Way Function -> Public Key Authority comes from collision resistance Inherently decentralized Sole Sovereign over random seed Only one who can make verifiable signed statements associated with the Public Key
Cryptographic Root-of-Trust Trust who said it not what was said Consistent attribution is the root-of-trust (integral non-repudiable statements) Duplicity detection 1 trust that controller of private key made a set of statements Build trust in what was said via consistent history of consistently attributable statements.
Self-Certifying Identifier/Namespace Use public key in identifier Use public key as prefix in namespace Decentralized Root of Trust Signed Statements that include self-certifying identifier Self-Certifying Namespace Provenanced chain of transformations with verifiable control over transformation End-wise Verifiable (primary root-of-trust) Other roots of trust may add to but not replace self-certification All decentralized infrastructure has self-certifying identifiers as primary root-of-trust Decentralized key management is therefore essential to protecting infrastructure
AUTONOMIC NAMESPACE Self-Certifying Self-Managing Self-Administering Extensible
KEY MANAGEMENT Rotation Reproduction Recovery
KEY MANAGEMENT Best Practice: One-use: One-time One-place One-way
Key Rotation Key rotation is useful when the controller of a self-certifying identifier needs to maintain persistent control over that identifier indefinitely despite exploits of the private key(s). Otherwise in the event of exploit, the controller could just abandon the exploited identifier and create a new identifier with a new (public, private) key pair.
Key Rotation After rotation the public key associated with the identifier is not changed, but merely the private key(s) that is authoritative is changed. Otherwise the identifier loses its value as an identifier. After rotation the original private key has been revoked and replaced with the new private key(s) specified in the rotation operation. The initial rotation operation must be signed at the very least with the original private key. The new public key is then included in the identifier’s key rotation history. The latest rotation entry provides the current authoritative key pair. In order to verify an attestation belonging to a self-certifying identifier the verifier must lookup and validate the key rotation history for that identifier.
Nomenclature self-certifying identifier: includes public key digital signature: unique non-repudiable (cypher suite known) digest: collision resistant hash of content signed digest: commitment to content controller: controlling entity of identifier message: serialized data structure event: actionable message key event: key management operation
More Nomenclature inception event: unique self-signed event that creates identifier and controlling key(s) rotation event: self-signed uniquely ordered event from a sequence that changes the set of controlling keys verifier: cryptographically verifies signature(s) on an event message. witness: entity that may receive, verify, and store key events for an identifier. Each witness controls its own identifier used to sign key event messages, controller is a special case of witness. receipt: event message or reference with one or more witness signatures
Even More Nomenclature key event log: ordered record of all self-signed key event messages key event receipt log: ordered record of all key event receipts for a given set of witnesses validator: determines current authoritative key set for identifier from at least one key event (receipt) log. judge: determines current authoritative key set for identifier from the key event receipt logs from a set of witnesses. pre-rotation: commitment to next rotated key set in previous rotation or inception event
Online or Pair-wise or One-to-One: Ato B Entity Entity A B Controller of Identifier A A Ev:nt SBtream Validator of dentifier A to
Event Generator Event Validator \ - v KELKERLOfA | A Re°§'f°' i"ea"‘ KELIKERL of A Key Event Log Key Event Log Key Event Receipt Log Key Event Receipt Log
Online or Pair-wise or One-to-one: B to A Entity Entity A B Validator of dentifer B BEvan Steam Controler of Identifier B o < Event Generator . Event Validator % ) % KELIKERL of A B RE":‘{Z: Stream o[ KELKERL ofA Key Event Log Key Event Log Key Event Receipt Log Key Event Receipt Log
Offline or Any-wise or One-to-many e | i T [ T H == B
Offline Trustworthy Service Service provided by N designated witnesses and at least one judge. Service provides a correct or at least a complete KERL to any validator that requests it. Service availability means at least one correct or complete KERL is extant key state validation mechanism not distributed consensus
Complete or Correct Witnesses only signs and stores first received and verified version of an event at a given location in full event sequence. Witnesses provide an immutable KERL of all receipts from any witnesses for the version of each event in its log. M of N Designated Witnesses Complete if KERL has M+1 receipts for event Correct if M is a majority of N
Complete or Correct Witnesses only signs and stores first received and verified version of an event at a given location in full event sequence. Witnesses provide an immutable KERL of all receipts from all witnesses for the version of each event iniits log. M non-faulty of N Designated Witnesses Complete if KERL has M+1 receipts for event Complete is Correct if M is a majority of N Scales with 2N vs BA distributed consensus that scales with N2
Variants Single Key Sequence for Rotation and Signing Single Interleaved Key Sequence for Double Rotation and Signing Single Key Sequence for Rotation with multiple Delegated Key Sequence(s) for Signing Dual Key Sequence for Separate Rotation and Signing
Architecture Controlle of dentfer A Witness of dentifer A Judge of dentifer A Valdator of dentifer A Identifier Mapper PuslicKey A Public Key A Identifier Mapper Event Verfer Event Verfer Public Key A State Engine ‘State Engine Public Key A Event Generator I RemeRL A J Event Verfior Stae Engine KELIKERL oA KELKERLofA Stae Engine \—'—‘ oo I ey Event Receipl Log Koy Even Recei Log KELIKERL of A I KELIKERL of A eyEeniog oot ey Event RacaptLog Event Validator Key Event Reosipi Log Receipt Engine: i Event Valdator Receipt Engine.
State Verifier Engine KERI Core — State Verifier Engine Current State Current Signatores Next Signatores [ o | SN [Digest | Threshod | Signers | Threshod | Signers | Taly | Winesses | EventMessage & S — . Event Message —t— Event Processing L J [ Hash ¢ . Next State l | Curtent Signatores Next Sgnatories | D | SN [Digest| Throshold | Sgners | Threshold | Signers | Taly | Wimesses | EventMessage
Generic Inception g,=(C.1,,icp,C".K,.C,, M, W, )o C, =[C',...,CL'1 Wy =Wy s Wy ],
Generic Rotation &= <C’Zk’n(8k71)’r°t= K1+1’61+1v wa(zv?n{dam}flélv51>6l )?,:[xu,...,xorll V= [H E,:[en,.“,eq,‘]] 5 :[so,...,ssl,l]l G/ =0an O i Ogun ++O g