Papers

Security Deep Dive Why KERI is Necessary and Sufficient

& RERI 679

https://keri.one

https://github.com/WebOfTrust

Samuel M. Smith Ph.D. sam@keri.one

Resources

‘httpsil/github.com/WebOfTrust “https:/igithub.com/MWebOfTrustikeri- TolP: (specifications OWF License) (New KERI Suite Working Group) ‘hitpsi/ftrustoverip.org/ ‘hetpsiliwik trustoverip.orgldisplayHOMEIACDC+{Authentic+Chained:Data: Container)+Task+Force

hitpsitrustoverip githubioltsig acde specification! ‘hetpsiljwiki trustoverip.orgldisplay/HOMETrust: Spanning+ Protocol+TaskForce

‘GLEIF (150) VLEI: hutps:/fwww. gleif.orglen/ler solutionsigleifs-digital strategy-for the leifintroducing the verifiable lel-viel

Provenant: https:j[provenant.net/

) - TRUST ) " h | h 1 : RI & RERI © ik B ®@poicatuse hpglth<=

Hard Problems & Solutions

Moving Data Across Trust Domains. Key Event Receipt Infrastructure (KERI) Persistent Identifiers and Issuances with Rotatable Key Composable Event Streaming Representation (CESR) State Authentic Chained Data Container (ACDC) Nearly Instantaneous Key Compromise Detectability Trust Spanning Protocol (TSP)(SPAC) Nearly Instantaneous Key Compromise Recovery Duplicity Evident Operation Reputational Root-of-Trust: No Shared Secrets GLEIF vLEI Sign Everything - No Relying Parties. True Zero-Trust Resistance to Surprise Quantum Attack Global Portability at Unlimited Scale

o s -] - o8 - o8

Minimally Sufficient Means No more than is necessary. No less than is sufficient. Every part of KERI is necessary to protect against a set of known attacks. Leaving out any part of KERI, therefore, exposes vulnerabilities. This makes KERI’s feature set necessary and sufficient. “The assertion that a statement is a "necessary and sufficient” condition of another means that the former statement is true if and only if the latter is true. That is, the two statements must be either simultaneously true or simultaneously false.” qusimipessogiinecesiy_an suiency A system using KERI is secure IFF (if and only if) all of KERI is employed. Anyone using a subset of KERI must prove that it is still “sufficiently” secure despite eliding a “necessary” protection measure.

KERI Security leverages Combined Arms “The synchronized or simultaneous application of several arms to achieve an effect on the enemy that is greater than if each arm were used against the enemy in sequence.” tumsmsmssscismeiicor-sarieniosn) (o isssoniogative st e udyat e s 025 Multiple mutually supporting threshold structures e .

Armor Preventing wounds especially fatal wounds T TP LS Jl bk, g e 7/ B . S A e Gl T g 9 A 1 o - i & ] (fl%{ 'Tf [ =+ i ’ R ! !5!’ 4 ) “ ‘}" LT N A # Each component protects a vital area from injury. Remove even one component and the adversary will target that area to the exclusion of all else.

Survivability Susceptibility: Likelihood of being attacked Vulnerability: Likelihood and extent of exploit given an attack Recoverability: Likelihood and extent of rectifying the exploit The “trap” of confusing low susceptibility with low vulnerability Most systems are vulnerable to attack many or not susceptible to attack. Susceptibility is about the economics of attack. Is the reward worth the risk?

Malicious or Compromised Controller Public AID used for verifiable issuances. (Indirect Mode) Where are the blockchain skeptics when you need them? What parts of KERI Infrastructure are controlled by a malicious AID controller? This may include the network over which a validator communicates. How to protect a validator from a malicious controller.

Inconsistency and Duplicity nconsistency: lacking agreement, s two or more things i relation to each other oy SRS wen dluplicity: acting in two different ways to different people concerning the same matter it | Internal vs. External Inconsistency Rotaton Event . ) " neracton Event Internally inconsistent log = not verifiable. Interacton Event Log verification from a self-certifying cryptographic root-of- Rolation Evert | trust protects against internal inconsistency. Rotaton Event IlractonEvnt | Externally inconsistent logs. Two different logs for the same ol Event —_— identifier, both verifiable = duplicity. Interaction Evert Duplicity detection protects against external inconsistency. KERI provides duplicity evident DKMI

KERI Ecosystem Components: Witnesses and Watchers, Advanced Indirect Mode [—— P— J— [— o i oy v prptteeors) o g i ppuatior et oyt pn ettt

Application Appiication

a anm an [a) 75 — — L7 H . ot o o & o2 o T s | O Q5 e & -7 BB & W o o s ovns oy s 4 4 r— it 2 o b s etk | Watcher Network | et ot <‘ ‘o% Vet o Q0O 8 overs sl | OO0 =S oyttt a/an key event vaidation dupiicly detnclion ey even validstion ‘Ambient Verifiability

KERI Ecosystem Components: Controller Application and Agents (" Controller | Application key pair generation key pair storage key event generation el key event signing d‘b key event validation (" Controller | . Controller Agent | . Application key pair generation key pair storage key event generation key event validation E key event signing A ; J ) Modular, decentralized, web-based infrastructure without shared governance.

KERI Ecosystem Components: Peer-to-Peer Direct Mode K i "~ Contoller | " Controller | oy vent sgnng foy cvnt generzion ¥ @ fi e event Sgning oo o’yo ey pair sorage Controller Agert | Contoler Agert | L events—— ey par storage key event validation events key event validation D) -

KERI Ecosystem Components: Witnesses and Watchers, Basic Indirect Mode Key pair generation key event vaidation ey event vaiidation Kkey pair generalion ey event generation key event receipling ey event receipling Kkey event generation key event signing Key event publcation key event publication key event sgning Controller | [ Witness Pool [ witness Pool | [ Controller Application — Application fi QD e [€0) fi 0§ = — 75 I as I Controller Agent Watcher Pool Watcher Pool [ Controller Agent events 060 events 060 events : ey pair storage key event vaidation key event vaiidation ey pairstorage key event vaidation ey event vaiidation Modular decentralized web based infrastructure without shared governance

Dead Compromised Signing Keys Post quantum surprise attack Only need regular watchers Do not need Juror pool with Judge But a Juror Pool with Judge may be useful as part of a dynamic appraisal. KERI Infrastructure is dynamically appraisable.

KERI Ecosystem Components: Witnesses and Watchers, Advanced Indirect Mode [ — P—— — [ — oy ot ginston o vaniring oy mantrcsing o gmrston ey erent iy oyt eicnon oyt siton ey g

Caroter f—— Sirasspal Carelr

Application Appiication

[a] anm an [a)

L7 [ m—] — L7

$ v ity et o oo &_\ o2 o2 ’ o o= S5 s G- B gt - ool e oens ovens ey i seroge 4 4 e i sorage st T owts b s - | Wostertiork | Vet <‘ ‘o% VatberFon Q0. 8 . Femd OO0 [ an oy vrtin =S ey avent vlidation upily detackion ey avent validation ‘Ambient Verifiability

Oty Dead EXpIOit (stale next signing keys) Exposas Compromst Icaplen Keys Keys o e | e e vl e e T E[RE e - - e o Delayed Aemats Histry R é Rt s ama | e et s ama e e Ak = | ki ) TE[EE - AN | | (o P Any already-seen copy of the original KEL protects against later successful dead exploit: First Seen Always Wins: First Seen, Only Seen, Always Seen, Never Unseen,

Watcher Mentoring New watchers can inoculate themselves from dead exploit by syncing with old watchers before “seeing” any new KELs

Advanced Watchers: Risk Assessment vs. Appraisal

Risk Assessment: Internal process whereby a Controller assesses its own infrastructure to determine likely vulnerabilities to exploit and actual exploits and compromise. Static Risk Assessment: Systemic Vulnerabilities Prior to Attack Dynamic Risk Assessment: Pre and post (mostly) evaluation and evolution of suspected attacks.

Largely forensic after the fact (lagging vs. leading indicator of compromise. “tracing the

untraceable” Appraisal: External process whereby a Validator evaluates some other Controller’s infrastructure to determine likely vulnerabilities to exploit and actual exploits and compromise. Static Appraisability: External Validator has visibility into the systemic vulnerabilities of some other Controller’s infrastructure Dynamic Appraisability: External Validator has visibility into the live state of exploit (compromise) of some other Controller’s infrastructure

IETF-Remote ATestation Procedures (RATS) https://datatracker.ietf.org/group/ratsjabout/ It prtocol nchanges i o hecas st v iy o g Party) rocio vidanco bt th o oot (and sytancompanerts [FECAS4S] o). e o 45502 h shearina f I . ot e alon IoCatues (RTS) oo whehor obing s can bl vl o conince i1 userininse f ol pors, calod Ao T Ol STovi - 23 3p L5l pocedurs GEHaloa by & o IV P cales Vot i i ks o e g S T procacres for e two siges v

• Edonce Appeisl Vi appis pocyan supply chainput, s as Endorsemens and References Vs o e Atesaion Resls rom Eidnc.

• tsaton Resuits Aprasl s Faying Partyappespocy 1 Atestaion Res'ssssoiated it an At Evidece tht ofinales o a sted Verfes The

et it Gt iy A

To mprov theconidonce i sl Component ustwortiness, roig party ey reui okl abnt

• sysiem component dnty.

" Composton of syt coponent, naing nsted corporiets,

pstigetiol

" aserioiciim orgnaton o provarance,

andachain o,

st component irty

et componentconasaion,

. araion i i st of st Vch e th oartoal i, o

• other fctors st couks s s oions, Wi o ststation macariss s s T Corputing Goup (1) Tt P o (TP TPM Softe Stack(15S),Fat ity Onine (FIOC) A aheaion s Arcrod Kepor oo v, ers .o capaable o fo o rosess et aideno o e errmivators bt St components amon e Tt o it MEALIE an o1 Aot Ao Procecure GATS) N Gtk o rouparabots

KERI and Dynamic Appraisability Duplicity Evident infrastructure dynamically (in near real-time) ensures that evidence of both live and dead compromise of key state is available to any validator. Any validator can then perform a live appraisal of key state compromise before engaging in any trust task. Live appraisal can be staged (graduated) to match the level of risk with the degree of evidence supporting the appraisal prior to committing to the trust determination. Duplicity Evident Infrastructure removes the hard reliance on trusted third parties to perform live appraisals. Itis the simplest known approach to solving the dynamic appraisability problem without relying on trusted third parties or blockchain. This is one of the primary security innovations that KERI as DKMI. Duplicity Evident(KERI) Duplicity Hiding (blockchain) Duplicity Fostering(DNS/CA)

Live Compromised Signing Keys Detectability Recoverability

KERI Ecosystem Components: Witnesses and Watchers, Advanced Indirect Mode [ — P—— — [ — oy ot ginston o vaniring oy mantrcsing o gmrston ey erent iy oyt eicnon oyt siton ey g

Caroter f—— Sirasspal Carelr

Application Appiication

[a] anm an [a)

L7 [ m—] — L7

$ v ity et o oo &_\ o2 o2 ’ o o= S5 s G- B gt - ool e oens ovens ey i seroge 4 4 e i sorage st T owts b s - | Wostertiork | Vet <‘ ‘o% VatberFon Q0. 8 . Femd OO0 [ an oy vrtin =S ey avent vlidation upily detackion ey avent validation ‘Ambient Verifiability

Live EXplOit urentsigning eys) on ST | waden | et [ ‘ [+ ‘ G Hard Problem: S s Recovery from Live Exploit % G of Current Signing Keys S - [ 2 e — £l oaploac et [f] ™ & o e T e Y oa lc|a i £l oaylosd ament 5 ‘ c: Pre-rotation provides protection from successful live exploit of current signing keys.

Live EXplOit ex signngkess Orgnal isory Exgosed Compromised o Ko Koy S | rekded oo *'M G | recer 1 c c? c J o = Preemptie AtemateHistory S e g Cama) i ’fi ¢ | | o | o =) EREoRET oo ’fij [ v | o | etdgest mq ST [ il ‘ 4 c c ¢ e Difficulty of inverting next key(s) protects against successful live exploit.

Recovery from Live Exploit Of Current Signing Keys O Recovery from Live Exploit ‘SNi#=SequenceNumber Unexploited Accountable Events Exploited Events Acsounate Dt Event e sw]_event | 1] 1] Rotaion [ 2 | 2| Interaction [ Nomhccountle vent | Fe e event 3 teracion F— O — 5| 5 [ interaction |, 6| 6 | Interaction | Siging Key Compromise Recovery Event Disputed Accountable Events| 37 romen L[] ] e | (o] o s - [+ | s | [le [msen | vt | NA| 9 | Interaction