Papers

&) HO Key Event Receipt Infrastructure A Trust Spanning Layer for the Internet https://keri.one https://github.com/WebOfTrust Samuel M. Smith Ph.D. sam@prosapien.com IETF Blockchain WG 2021/11/23

Resources Documentation: https:/fkeri.onefkeri-resources/ https:/farxiv.orglabs/1907.02143 (KERI White Paper) Community: (meetings, open source code, IETF internet drafts) https://github.com/WebOfTrust https://github.com/WebOfTrust/keri https://github.com/WebOfTrust/ietf-keri M bbbt o https://github.com/WebOfTrust/ietf-said https://github.com/WebOfTrust/ietf-ptel ietf-kaace, ietf-ixp, ietf-pxp TolP ACDC (Authentic Chained Data Containers): https:/jwiki.trustoverip.org/display/HOME/ACDC+%28Authentic+Chained+Data+Container%2g+Task+Force GLEIF: https:/jwww.gleif.orglen/lei-solutions/gleifs-digital-strategy-for-the-leifintroducing-the-verifiable-lei-vlei

Background References sevcantyog et [ R ———

g o 5446065 40 e e i ot 0 5T ey G

T -

e ST el s T ettt st ot g o s s

[ ———— Rl e T R T ——

[

i “

[ T ——

[N —

S s & i, . ara eSO RWGTI o)

S R —— e R ————— IV S ——)

"

g -cevne Taranen”

The Legal Entity Identifier — the LEI B LE = The LElis a life-long code owned by the respective legal entity. Nestié SA « It points to the associated - reference data. it > - The LEI is an 150 standard — el 1SO 17442, e ——— o

The LEI as a Verifiable Credential — the vLEI Trust Chain 9 LEI « Every verifiable LEI (vLEI) is created by an issuer = The issuer cryptographically signs the GLEIF credential with its private key = Anissuer s the organization or entity L Qualified VLEI Issuers that asserts information about a subject to which a credential is issued L LEgEl Entities = The vLEI Issuer is an organization L 5 qualified by GLEIF as part of a trusted Persons Representing network of partners Legal Entities = GLEIF issues vLEls to Qualified vLEI Issuers as attestation of trust. = GLEIF is the Root of Trust

The Internet Protocol (IP) is bro-ken because it has no security layer. isn vtain oot Tt onane Instead ... We use bolt-on identity system security overlays. (DNS-CA...)

DNS Hijacking I — https:fjarstechnica.comfinformation-technology/2019/01/a-dns-hijacking-wave-is-targeting-companies-at-an-almost-unprecedented-scale/

L e s ——— ) . L [ [ i e v = T T — I i | T R IR -~ e o | [T . = Seses S = [l

Spoofing domsinverficaion process from CA ensbes attackers to btain vald TLS certfcae for hiacked domains irgaLes, H, Sun, Y. Edmuncson, A, Rextord,J. and Wil P “Bamboozling certfcate suthoriieswith (5GP} vol. 27 {USENIX) Security Syrmposim, no. [USENIX) Securly 18, pp. 833649, 2018 hitpsiwwvusenlx.orglconferencefuseniseculy Bipresentationbige-ee Gavrichenkov, A, “Bresking HITPS with 5GP Hiscking,” lackat, 2015 hitpsfv blackhat comdocsfus1materalsfus-15-Gavricherkon Breaking HTTPS With £GP- Hiackingvp.pa AS path poisoning @ Vulnerability of domains: sub-prefix attacks O (a1 (k) 1owmazz0m AnyAScan 2 28% of Domains Unaffected . i - Sesen aunch T ~a " J T e it ooks ® Onlyprefix § 729 of Domains Vulnerable N + Connectity preserved lengthsless 5 2 0 2 amostany as an than /24 g \ / peram vunerable g, - Vory sty (fitering) g Lcan getto 2220240 Pariectseup o marcept & B roun As 4 i win ot i e 1P Prefix Length

End Verifiability End-to-End Verifiability [ Middle = - e Middle - - { Midde - w - - - | End I \':iMidd\s:-fl Gt Middls} w3 EM J L &= — “““"*—{Middls} If the edges are secure, the security of the middle doesn’t matter. Ambient Verifiability: any-data, any-where, any-time by any-body Zero-Trust-Computing

Secure Attribution Problem [ contrling key(s) dentfer |+ aioro = cata | identifer auorhy a Secure attribution of any communication to its source Establish authorship of data, documents, credentials = authentic data provenance Secure attribution via non-repudiable digital signatures using: (public, private) key pairs (PKI) that control self-certifying identifiers Duplicity evident appraisal of key state Key state proofs are portable verifiable data structures Dumb crypto is adoptable crypto (minimally sufficient means) Share duplicity evident verifiable public key state Keep private keys (secrets) private.

Cryptographic Root-of-Trust: Self-Certifying Identifier & Key Event Log (oo + Parses > s < e > G | peiskey ") o | . ¥ 0 [ e T S T - + fansut| - s ok G| paskey . e G+ Key Event Log Incaption Satemant Esiishwont Incepton Data ) N Subseqence bovton | Ptk | Corguaton | Sepats et et | Rotation Event Rotation Event Rotaton Event EXq5YqaL6L48p£0fuTIUNLOJRAUZ_RXFP0ALE3WYn148 did:un:EXg5YqaL6L48pf0fuTIUnLOJRAUZ_RXFPOALA3wYn148/path/ o/ resource?nane=securefreally

Self-Certifying Identifier (SCID): Issuance and Binding entropy pmres [ c:)nlro\le: \ \T / identity \ controller system TR strong sgcu rity strong generates derives verifies i overlay X e i S ) ' A . key-pair }' »{ binding |«| idenier | key-pair |«—{ strong <——\ identifier | self-certifying Self-Certifying Identifier Issuance cryptographic root-of-trust

Identity System Security Overlay Establish authenticity of IP packet’s message payload. Authenticatable Message Verifiable Payload N identifier data signature controller | g B / identity \, Lo L L) system (e [ ey-pair |« identiy system mapping |~ identfier | ‘\b'"j""g, securiy (240 L _ f overlay r N Al N The overlay’s security is contingent (_key-pair_J«—»{(bindingl}+—~ identifer on the mapping’s security. Identifier Issuance

Flaw of PKI (DNS/CA) [ controling key(s) dentfer |+ aortn | dota

(e o e Use of private keys exposes them to side-channel attack. Over-ime, exposure makes private keys weak, Thus, from time-to-time one must revoke and replace the controlling private keys for a given identifier Hence key rotation Existing PKI must re-establish the root-of-trust with each rotation thereby making it vulnerable to attack Breaks the chain-of-trust-of-control over the identifier

Solution: Key Pre-Rotation Full Sequence — G e duply evdent s verifiable data structure Lo | c c c Inception Event |, [ ww—— o Rotation Event |, et sy | com | ertdgst et ) Iteraction Event Sdgesto) 1 | ¢ | ¢t | C Interaction Event Rosion worewn| 1|t | et i ) Rotation Event Jaet 2 | @ [T @ Rotation Event |_ | oton BV Jo——— Rosion Interaction Event _ orown| 1| ot | e Gt | TRl H : 5 Rotation Evnt ezl 0 L C | € K€ Interaction Event ek - eroon|Su | comen | reddest et Interaction Event dgests 4 | € | C° c ) Digest of next key(s) makes pre-rotation post-quantum secure 0.1, Bernstein: hitpsicryp tofhashicolisioncost 20090517.pd-

Delegated Self-Addressing SCID Dot 3 Ty — _— — ] peme Random Seed Stretch *Private Key | Public: L ¥ 2 > y | > Generaion { Public ey + " ogen [ Inospion Configurati 2. oo Conuron 2 T oot oampr ( ooty g || Key Event Logs g S Incepton Data Inception Event Inception Event I | Dataion | Putoley | Cotaunten | St Rotaton Event Rosin et Rotation Event | Rotation Event | Rotation Event Rotation Event EXq5YqaL6L48p£0fuTIUALOJRAUZ_RXFPOAL43wYnlds did:un:EXq5YqaL6L48pf0fu7IUhLOJRaU2_RxFPOAL43wYnl48/path/to/resource?name=securefreally

Identifier Delegation: Scaling & Protection i~ S [ I o gmw o mel o B e e e Veuaan—| zrn Lo, [ pme ] e

Trust Basis N\ | controller | \fi B \/ Vfi / \ ) Y \ verifes bidng 19BN g \ 7 system PR _/ security \ - [ validator | Y overlay p N . / | key-pair < bnong——>| identifer | AN S N - S

Autonomic Trust Basis Cryptographic Proofs TN manages _ | controller |- U 7\ J N\ ° i N proves source-of uth genertes / 7 \ | keyeventlog | ) / " verfies stong | strong s bidng doice bindng ) . /e A [ validator / AN / R | eppar e ——| idenifer |

Administrative Trust Basis DNS/Certificate Authorities | controller | generates N < g source-of-truth ( / - database " \ verifies. b strong R N windng i . / wigrs mnages | validator | N 27N\ ) i . | keypair | [ identtier | [ aoministrator | ) —_ asserts g

Algorithmic Trust Basis Shared Distributed Ledgers yd N | controller }\ / \ J N\ 4 N registers source-of-truth generates / g\ | shared ledger =+ \ / v verifes strong strong X tindng binding X\ —_— manages | validator i b - / registers \ o \ L ) / \ % / \ ) | key-pair -7;1.5;% ——>| identfier | [ algoritm | \

KERI is not Identity Proofing? KERI Identifiers are pseudonymous = high entropy pseudo random strings of characters EXq5YqaL6L48pf0fu7IUhLOJRaU2_RxFPOAL43wYnl4s A given KERI Identifier may be associated with a natural person or legal entity via identity proofing The advantage of KERI is that this association need only be made once at inception. The association persists in spite of change of control of the identifier via rotation of its keys. KERI provides persistent control of its pseudonymous identifiers in spite of key rotations. KERI uses pre-rotation, a forward blinded commitment to a rotation key to replace signing keys. Rotation keys are one-time only. KERI provides recovery of control of an identifier in spite of signing key compromise.

What is KERI? Key Event Receipt Infrastructure: Decentralized Key Management Infrastructure

KERI fixes the security flaw (authenticity) in PKI (Public Key Infrastructure). The flaw in PKI s key rotation.

Authorship is established in PKI with asymmetric (public, private) signing key pairs. KERI solves the key rotation problem for control over an identifier KERI uses portable verifiable data structures called key event logs (KELs) to provide duplicity evident proof of the controlling key state for pseudonymous cryptographic self.certifying identifiers (SCIDs). With KERI, key state is cryptographically verifiably bound to self-certifying identifiers In contrast conventional PKI uses assertions made by trusted entities to bind key state to identifiers KERI solves the secure attribution problem with zero trust.

Every statement associated with an identifier may be non-repudiably and securely attributed to the controller

of the identifier via a signature made with the keys determined by cryptographically verifiable key state.

Identity System Security Overlay N7 N

Spanning Layer (Gvors) (Feub) (50 ) Neix AT \ — y, =T N—— ((wrsp, (@) wes) \ /) Tungenrd | \ HTPET? SR>/ [_L]w @) ] o) () (wir) N wr/ *—g/r ) N —— [GP uoP/ [ ) T — P (7] [ (W) VAT S D = o ~\ Pyl oge s achivergvebiooso et i otecurerk rcraperaion