OPEN REPUTATION: PORTABLE REPUTATION AS A PRIMAL USE- CASE FOR DECENTRALIZED IDENTIFIERS https:jgithub.com/SmithsamuelM/Papersfbloblmasterjwhitepapersjopen-reputation-low-level whitepaper. pdf Samuel Smith Ph.D. sam@xaltry.com

noun:

The estimation in which a person or thing is held, especially by the community or the

public generally.

root:

Latin word reputdre, which is equivalent to re + putdre, that s, to re-think or re-consider. usage:

A considered evaluation (measure) of past behavior used to predict future behavior. qualification:

Confidence improves with contextual simularity.

betpsiiu comiSmithSamuePapscsblomasteriabicpapsrsopensepuiaton doweleveb it epaper

WHAT IS REPUTATION? WHAT IS REPUTATION AI? Contextual predictor of future behavior to enable a transaction Closed-loop automated reasoning, not just open-loop pattern recognition Means to filter and modulate transactions Curator, recommender, decision aid, 1A Contextual predictors are more powerful Behavior based predictors are more credible Transitive predictors are more portable

Computational generation of a reputation is to aggregate relevant instances of behavior. Instances of behavior = reputational events or reputes for short Reputation measures are inferred indirectly from reputes associated with an entity Contrasting Example: * Entities provide direct ratings of promptness of another entity * Collect instances of behavior of entity in context from which promptness can be inferred. Reputation from reputed behavior allows for re-scoping, re-weighting, re-combination, and re-evaluation of collected reputes Enables arbitrary levels of nesting, precision, and granularity in the data aggregation process

betpsiliu comiSmit SamusPapsrsbbimastariabitepanarslopen reautation lowlessbubitepsper it

REPUTING LEXICON Source Direct Target Repute = Reputational Event (Data) Reputee = Reputational Entity, (Identity) Target of Repute Reputer = Source of Repute

Direct Self-Repute e Source Incident Target @ Reflexive @ X Reflcted Toget Lo -

Reputation is Reflexive:

Reputer is simultaneously both a Source and a Target = Reputee

INDIRECT AND INTERMEDIATED REPUTING Reputery = Indirect Source (Implied Reputer) or Intermediate Source Indirect Target Source Direct Intermediated Toget Indirect Intermediated Target [ o) ]

Reputage: reputational event ancilliary data. Optional or infrequently used information associated with a repute separated from core repute for performance reasons.

Reputet: reputational event transaction. A cryptographically signed and validated transaction of reputes between reputees or reputeries.

Initiator = first party.

Copartent = counter party.

Arbiter = trusted third party (notary).

« i “rutats Mbcaass”, Tputds "abcerg’, "atamp": “201s-B1-19T10:30:452") Truid’; "headss”, reputee”: “2ddefs’, *stanp'; *2015-03-19710:30:457", “reputer: “Sefars” *comnen": curator”: “zbdd, { “signer: "zbcasia’, reutdr: "1asasbe”, “detail" urL": "http: /myblog. con/articlels) coment1s” ¢ ‘contents": “You are 5o auesone.” “rating" ¥ ¢ seful” I A e Iernien 5 L shederoTzaas67" {17 “htep: //ayblog. confarticlens) i i s {3, “reputage”; null, ) Iernrein “abederoazesain”

UUID: Universally Unique Identifier RFC 4122: UUID type1-5

16 byte collision resistant decentralized identifier generated with random number generator and optional name spacing data

Enables distributed applications to create unique identifiers without central authority

Prefixed namespacing allows for sorting and searching properties such as time order, lexical order, nesting etc, URI: Uniform Resource Identifier, URI: Uniform Resource Locator, URN: Uniform Resource Name RFC 3986 scheme: [ //[user| :password]€ Jhost[ :port]] [/path] [ ?query] [#£ragment] Self-Certifying Identifier: Contains fingerprint of public member of cryptographic public/private key pair Decentralized Self-Certifying Identifier: public/private key pair is generated by user not central registry Hierarchical Self-Certifiing Identifier: selfcertroot:/pathjtofrelated/data

Tree Hierarchical Deterministic Self-Certifying Identifier: parent/child/child/child

Tupleizable (routable) Identifiers: [channeljhost/process/data = (channel, host, process, data)

https://w3c-ccg.github.io/did-spec/ did:method:idstring did:rep:Qt27fThWoNZsa88VrTkep6H-4HABtr54sHON1VWI6FE= { "did": "did:rep:Qt27fThWoNZsa88VrTkep6H-4HABtr54sHONIVWI6FE=", "signer": "did:igo:Xq5Yqal6L48pfefu7IUhLBIRaU2_RxFPEALA3wYn148=#a" "friend": “did:igo:Xq5YqaL6L48pfofu7IUhLAIRAU2_RxFPOALA3WYN148=/next/door”, “name”: “John Doe", "zip": "94088" ¥

DDO https://w3c-ccg.github.io/did-spec/ DDO = DID Description Object « . deanteats “hitps:fexemple.arg/giana”, Guardian Managed DDO e rans e romEERm kB, a1 f e s xSy 1, fagonent®s "hets roanpte orgrcispae, e ar ey e Lo 1 o S aha eammp L PR S Lo, e raiart HELE Cte RGN, ettt ity ok eamecazcanr, TR 1 e e e RBPLS 1, e ey asebe 0y /X AHBEAS 0BRGN e | I T e —— fahs A A e o i 3 e Fiype: ohttpepschem. rgsperson, e Regpe s 2 BOBLIC K-\ e i e PRy s rante e Shioer n, i ¢ Limtror 1 e e e Crentor: Lo A AGEAS P MNS y 1 it easmte ToACEmSSIIEANG, R e et v At e ) ) ) n Sirvice ¢ g SR S tpas et o35 % Yoo vaoma-s0-samromsonz, e e i et e hasssanaturcans, it TCrento: "o ARG AB AN iy 1, et oA CARBAESEL y y

DID Fragment did:method: idstringtkeyindex ADID agrnt MUST be s nly as methodindepandent pitr i the DDO 1 dently aur key descrpion or other DDO componar « Sounert: (1 Ld": di:example: 21 DAKCERNSSUGHKENHY ey /1, stypes ['Cryptographickey", "EdDasSAPub sckey"] “clirver: "edzosis", "explres”: "2017-02-08T16:02:202", “pubicKeyBasesa™s “TOMAIRTT{heY. . .H2/3i255=" ni s a0 example: 21 DAKCERNOSUGOKo NHYpekey /2", Typers [CryptographLCKey “RsaBuLLKEY ) “expires: "2017-03-22100:00:007" , “publicKeyBase64": "MIIBOg. ..ngQaRyV" N ¥

DID Path

did:method: idstring/path/to/associated/resource

did:method: idstring/path/to/associated/resource#os

112,010 rference includes DID path flkowed by ragmert, rat agrmert 5 NOT & DID ragmen.

{ "did": "did:rep:Qt274ThWONZsa88VrTkep6H-4HABLr5ASHONIVWI6FE=" , "signer”: "did:igo:Xq5YqaL6L48pfafu7IUhLOIRAU2_RXFPOALA3WYN148=HE" , “friend": “did:igo:Xq5Yqal6L48pFofu7IUNLOIRAU2_RXFPOALA3WYN148=/next/door”, “name”: "John Doe", "2ip": "94088"

}

https://www.w3.org/TR/verifiable-claims-data-model/ Verifiable Claim Profile < < “agontext: [ “gcontext: “ntips://u3id.org/dentity 1, "https://3id. org/identity/ 1",

14"; “didsexample: ebfeb 712ebes ez 6e12ec21", "htths://433d. ord/seclrity V1"

“typers ["Entity", "Person'], L “nanc": “Alice Bobran, hav: http: /sexample.gou/eredent tals/3732", “enaill: "alicegerample. con', “type": [Credential”, "Proof0rAgeCredential”], “birthbate": 1985 1214 “iasuert: *https://dny. cxanple.gou" “telephone": "12345078910" “issued": "2010-01-01", b wclain: ( “1d": 1did: example: ebreb1(712ebes1e27be12ec21", "agetver": 21 . B Claim “éignaturer: ¢ “iyper: *Linkedbatasignature291s", < “cTeatedt: 12016 05 18721510:362" “Bcontext”: "nttps: //did.org/identity/v1", "Creator": "ittps://exanple. con/Jdoe/keys/1", 2107 "Nttp: //example. gou/credentials/3732", vdonain®s *3son-1d; org", stypet: ['Credentials, "Proof0iAgecredential”], “noncer: “GladTest, +15Suer™: hTeps:/Jdny. exanple. gav" v<dgnaturevaluen "443oUrpite/ “issued"; 12010-01-01", W32 UTuHDaSaY F2sykskf uByDTUBUGEC) TKa+ ToL )L i oMz BaciupCHH “clain®: ¢ 2q0pndaT rONKZbnar GY B CRTWPOSedGUacBE254 ] ¥ TBOSGAKZKBFEXTYWY “3d%: “didiexanplerebfeblf1zehco1ca7Ge12ec21”, VIGLLICBasnaA7\BRI4yZIFLCUIBTFQeRSKI=" "agedver: 21 ¥ + y »

Zero Trust Computing Security, Privacy, Agency Diffuse trust perimeter-less security model

Diffuse trust perimeter-less security principles The network is always hostile, internally & externally; Locality is not trustworthy. Every network interaction or data flow must be authenticated and authorized using best practice cryptography. Inter-host communication must be end-to-end signed/encrypted and data must be stored signed/encrypted; Data is signed/encrypted in motion and at rest. Policies for authentication and authorization must be dynamically modified based on behavior. Policies must be governed by distributed consensus.

Decentralized Identity Inverts Service Architectures Conventional (centralized): y Unconventional (decentralized): Server creates identifiers (GUID, Database primary keys) Client creates identifiers (DIDs) Server timestamps. Client timestamps event ordering relative to server event ordering relative to client Server manages keys, AuthN, AuthZ Client manages keys Perimeter Security AuthN/AuthZ is Client-to-client Signed at rest problematic Perimeter-less Security Encrypted at rest problematic Client signs at rest Server is source of truth Client encrypts at rest Server controls changes/updates to resources Client s source of truth Server’s role is 2nd party in two party transactions Client controls changesfupdates to resources between client and server. Server cannot make changes Server's role is either: Trusted 3rd party in 3 (multi) party transactions between 2 (or more) clients and server /Agent or proxy for a client in two party transaction with another client.

Heavyweight Decentaiized Identy Lightweight Decertaized denifrs Decentolzed deifirs Porabiy Verfab Cains

oot

Conet s Letger

Rowcatn

oo

s Koy eragement

g

Koy

g

Wt

Grpios sty Gragn

v st ey

Conecn bty

Tty

Grup iy

[Patney Heavyweight Reputation Lightweight poratie Evenualy Porsie Tanstie Domain Specic CrossDamn

Graph Based Self Identity/Reputation Identity = Identifiers + Attributes Identifiers = globally unique decentralized cryptonyms + aliases . Attributes = user data, proofs P 1 Facilitate attribute exchange between entities sufficient to enable (.| 7 ™\ pan— o ! transaction to proceed "t Al L AN gl Identity System Features: RV U S N Agency (own your own identity) u /ol N N N Security (impervious to fraud) u/ Y ‘/'_. NN N Privacy (least disclosure) A s /\/‘ f\"“‘/‘ Agency = portable identifiers + user controlled ) (o «L—‘ / ’7”,‘ T Security = distributed consensus + modern crypto N ,\,/\ | ,L u Privacy = granular graph based identities + layered disclosures + - zero knowledge disclosures + group identities m m FL‘ U /\4_[ httpsiligithub.comismithSamuelN/Papersbloblmasterfwhitepapersiidenticy System Essentials.pef

Graph Based Other Identity/Reputation Repute Down Repute Up =R Y . = = E{!,,f.(;,,\‘.,,f,\ T S S I O S g

L/ A . A -V\ "/Ay\— o [ P =Van ‘\é \‘<\E B/ &\ (\E i I T S P I B NS =) Vo) D N CFe Y P ad ) @ o {/»\F‘L/ E/ - oon ©s BEE O

ISSUES Data Intensive: High speed concurrent reads Multi-version Concurrency Control (MVCC) Data Stores Concurrent Log Structured Data Store (Immutable) Data Flow Routing for Distributed Stream Processing Stored in sorted order for fast block queries did:rep:ABCD123/ruid/did:rep:XYZ987/what Repeated Lookups are expensive Need lightweight cached DDO subset Signed At Rest verification without external lookups signer: did:rep:ABCD123#key/01

ISSUES Associated Repute vs Associated Reputee Associated Repute = DID/path Associated Reputee = Hierarchical DID Unknown Reputer or Reputee to be claimed later Blinded Reputer or Reputee Meta-Repute = Repute with a Reputation Reputation is not a set of verifiable claims but a set of verifiable claims can contribute to a reputation Representation of Graph Based Identity Portable Reputation Algorithms

ISSUES Survivability Paradigm vs IT Security Paradigm IT Security: Confidentiality, Integrity, Availability Survivability: Susceptibility: likelihood that the system will be the target of an attack Vulnerabililty: degree of damage resulting from an attack Recoverability: time to repair the damage of an attack Failure management: Failure avoidance, Failure Resilience, Failure Repair