Papers

SEDI Policy and Technology Trade Space Comprehensive Solutions vs. Incremental Solutions How to best protect citizens from exploitation with citizen-sourced, state-endorsed digital identity Samuel M. Smith, Ph.D. sam@kerisuite.org. https://github.com/SmithSamuelM/Papers 2025/10/01

Survivable Systems: AUVs, Ships, Critical Infrastructure —— TET s .? = e “» &"" = > . " 1."'7 ! - v 3 = e = = RIS S | 5 s ) jo? MW‘%% 'M‘f* 7, ey L= s = !'*! T2 ‘ L ’lf) et . .fl.' y fifi

Design Spiral to Explore a Trade Space oty ] i e LS \fla o [ (=S aptcnes et g PN { //m N\ —l I Senust' 4l y “"‘5&2‘4,‘ szt et oviio Naval Architecture Design Spiral In harsh trade spaces, incorrect a priori decisions often result in highly suboptimal designs. One must first thoroughly explore the harsh tradeoffs. The PAC trilemma forms a harsh trade space.

PAC Theorem — Trilemma An interaction between two parties may be two of the three, private, authentic, and confidential at the highest degree, but not all three at the highest degree. Authentic / Tradespace o / éb R e ) S, s ® Trade-offs required! ()§

Layered Security Overlays Authenticity Authenticty — < ‘\ | stc w | 008 3o 9, "\ 008 seip 4 ™~ . st B N o o 1o RIS LY SIS ] @ g LA - ] My H 3 $ it = 5 & © | 8 S0ty Layered Security Overiay Spiral Setups may be application dependent & hence overlay ordering dependent Each setup requires one OOBA factor to protect against MITM attack. Privacy Setups may be costly, especially those with repeated OOBAs Layered Security Overlay Spiral Interactive setups are not as scalable as non-interactive setups Trade-offs required

hips:owasp orghvin-projectop len/

• 20112021 Broken Access Control moves up rom the it positon; 945 of applicaions were fasfe for some form of broken access control The 34 Common Wealness Enumarations (GWES) mappod to Broken Access Conrol had mara oceurronces in applcations than any other category. (Rocursive Privlege Escalaton Aitacks)

• 402:2021-Cryptographi Fallures shift up ono posiion 0 42, proviously known as Sonsiive Data EXposuro, which was broad symplom rathar than a 0ot cause. T renowed focus here i on aiues relatad 1 cryplography which often Ieads fo senilive dala exposura o system compromisa. (Key Managemen, Stae Crypto)

• A03:2021-injectlon sides down o the third postion. 54% of he applications were tested or some form of njection, an the 33 CWES mapped it this category have the second most occurrancas in appiicallons. Gross-sita Scriping i now part of his category in his edilon.

• A04:2021 Insocure Deslgn Is a now category for 2021, wih a focus on s rolatec 0 dosign laws.ffwo genuinaly want o move ol as an ndusry, f cals for mors use ofthraat modeing, Secure dasign paters and princples, and rearancs archigctures. (Archilscturs flaws, Trust boundary vioatons)

• R05:2021-Securiy Misconfiguraion moves up fom 6.1 the prevous edflion: 90% of application were tested for some form of misconfiguration, Wih more shis Into highly confiurablo softwaro, s not surprising to 500 this catogory movo up. The formar catagory for XML Extrnal Entis 0OKE) s now part o s catogory.

• A06:2021-Vulnerable and Outdated Components was previously iied Using Components with Known Vulnerables and is #2 i the Top 10 community survy, but alsc had nough data 1o maks the Top 10 via data analyss. This calegory moves up fom #0 in 2017 and is @ know issus thal we iruggle 0 last and assess rsk I {she only tegory not o have any Common Vulnerabilty and Exposures (CVES) mappe o e incluced CWES, 50 a defaut explot and impact weightsof .0 are acired o their scores.

• A07:2021-Identlfcailon and Authentication Fallures was previously Broken Authertication and i siing down from the second positon, and now includes CWES. thatara moro related to identfication falluros. This catogory Isstll an ntogralpart of the Top 10, bu th Incroasod avallbilty of sandarcized ramoworks soms 1o bo helping. (Shared secrets anyone, ecursive priiege escalaton attacks)

• A0B:2021-Software and Data Integrity Fallures s a now category for 2021, focusing on making assumptions relatd to sofware updates, cr

iical daa, and CICD. pipelnes without veriying integrity. O of the highest weighted impacs from Common Vulnerabiy and Exposures/Common Vulnerabiy Scoring System (CVE/ CUSS) data mapped t e 10 CWES I this category. Insecure Deseralzaion rom 2017 Is now a part o this lrgor catogory.

• 208:2021-Security Logging and Monioring Failures was praviously Insuficient Logging & Moritring and s added from th incusiry survey (43), moving up from 10 proviously. This category is expanded to nclude more types o faiures, is challenging o test or and sn' wel represented in the CVEIGYSS data, However, ailures in tis category can directly impaci isbilty, incident lering, and forensics

• A10:2021-Server-Side Request Forgory i added from the Top 10 communiy survey (1. The data shows relativey low Incidence rate with above average tesiing coverage, along with above-average ralings fo Exploll and Impact polental. This categary represens the scenario where th secury communly membars are taling s his i important, oven though i ot lustrated inthe daa ai tistim. (recursive privlege escalation atacks)

OWASP GenAl Secuty Project htpsiigenai.owasp.org

Survivable Security Survivability: Susceptibility - Likelihood of being attacked I Vulnerability - Likelihood of success and extent of harm given an attack ‘x Recoverability - Likelihood and extent of recovery from a successful attack - A system may be highly vulnerable but not highly susceptible to attack s & In IT security, susceptibility stems from the return on investment (ROI) of an attack ¥ The “trap” of confusing low susceptibility with low vulnerability ‘Susoeptbilty e s SRR A Y TN Bl 0\ A St N ey - PR (T Pl Ty .- o " el P B4 = A e - i T L e, P _— P > ,:& = & D % Layered Sunivabiy Overlay Spiral / p

Security First, Always [NOIMORE] HALFIMEASURES] Minimally Sufficient Means Adoptable White Magic Crypto

Why key compromise is the hard problem for SEDI Invalid to assume that compromise of the issuer key is impossible. Key compromise enables verifiable forged issuances (impersonation fraud of the issuer, identity theft of every issuee) Unanchored forged issuances are not detectable (in general) and therefore preclude specific recovery. Cannot ensure a timely recovery from forged issuances when those forged issuances are undetectable by the issuer. Anon (ZKP) signatures are unlinkable to specific forged issuances, and hence, specific forged issuances are undetectable by the issuer. Cannot ensure a focused recovery of specific forged issuances that are unlinkable and hence undetectable by the issuer. e s forgery perssts troughout h espan ofsranchoredong erm ssances,evn e th rotation of compromised eys. Unanchered ong e norposteqantu afesgned suancesa vlnssbl o the sapese quantum ke compromise amagddon Given unanchored anjorulinkablesuances th oty vy o ensur ullrcovery roma ikl o potenial ey compromise’s revoke anrelsue alsssances made withkey o potentaly compromised ers Prophactic keyrotaton bounds the tme rame ofpoetial ey comproise by muliplying he frequency and hence cast of revoking and replacing all issuances at each rotation. Government issuances to millions of citizens exponentially increase the ROI of attackers and, hence, the susceptibility of key compromise Revoking and reissuing millions or tens of millions of Government issuances due to likely or potential key compromise is impractical. As a government, how can you practically recover from a likely or potential key compromise with millions of issuances? Anchored ssances ar nksbleand therebyenabl hedetection ofspcifc ogeryand th spcic recovryof orged ssances Specficrecoueys iable and pracia saluton toth had problem of key compromis for SEDI

EUDID Wallet Comparison “0n the Concrete Security of BBS/BBS+ Signatures” 20250927 Proves BBS+ does not satisfy SUF for EUDID. https:leprint.iacr.orgl2025/1093.pdf solutions in secure hardware and the lack of support in currently available secure hardware (WSCDS). htpsitedigratiderticywaliet gtubiofeud-docsrchitecture-anc- T ot

KERI’s Paradigm Shift: Security First AIlID Privacy Systems (including EUDID), except KER/ACDC, assume that “unlinkability” is an end in and of itself. Yet, these same systems include exceptions, such as payments, where linkability is necessary to prevent fraud. This exposes a flaw in the assumption that unlinkability is, in fact, the desired goal. Therefore, the axiomatic assumption that the goal is privacy first, as unlinkability, cannot be true. KERIJACDC postulates that the end goal is not unlinkability, but rather unexploitability through the strongest security. Because there are no significant exceptions to this goal, the axiomatic assumption that unexploitability is indeed the goal i likely true. Unexploitable vs Unlinkable Decorrelation vs Deidentification Accountability vs Anonymity Shift from fixing leaks to fixing exploitation! Strongly incentivize decorrelation instead of “wack-a-mole” attempts at removing all points of correlation. Decorrelation comes from inverting the economics of correlation. Exploitation protection comes from comprehensive retroactive anti-assimilation incentives

Impossible Goal Eliminate impersonation fraud, of me, to me, and by me: (no more identity theft because the ROl is negative). What is the value of achieving this goal? To citizens? To private industry? Togovemments? What exploitation of citizens using their digital identity remains once identity theft is eliminated? Tracking? Exploitation by whom? Rate and rank harm by who does the tracking. Coverment? Foreign? Federal? State? Local? Private Industry? Attention theft? Hackers? What is the net benefit of fraud-free vs. non-fraud-free ecosystems?

KERI/ACDC Security Properties All exploits must begin with the compromise of (asymmetric) private signing keys Any exploit that compromises private key(s) must be nearly instantaneously detectable Detected private key compromise must be automatically recoverable using quantum-safe one-time-use pre-rotated keys Controller Key state may be made highly available via its own witness pool Private key compromise and hence exploitation may be made exponentially more difficult through a combination of three threshold structures: multi-signature, MFA witness pools, and delegated identifiers Validators are protected from dead (stale) key compromise via the first-seen policy enforced by their own watcher network Validators are protected from live key compromise via duplicity evident property with respect to the controller’s key state Reconciliation policies must enable exploited controllers to recover from a live key compromise Validators may be protected from malicious eclipse attacks on key state via the duplicity-evident watcher network Issuances (Entitlements or AuthZ) are similarly protected by anchoring to the key state Unbounded term issuances are verifiable despite key rotation when anchored to the key state High-stakes issuances may gain extra protection by interleaving anchoring with waiting periods that force in-stride detectability and blockage of live exploit attempts. Everything must be provable via verifiable data structures, no trusted third parties, no shared secrets, no platform lock-in Infrastructure must be highly portable, with no shared governance between the controller’s witness network and the validator’s watcher network. Similarly, between the Issuer’s registrar and the validator’s observer.

Unique features of KERI/ACDC that require Issuer linkability Near-instantaneous detection key compromise given an impersonation fraud attack Near-instantaneous recovery from key compromise and defeat of impersonation fraud attack =no external attacker impersonation fraud. Global detectabilty of cuplcty by mallcousIsuers due o Watcher Network = o malicous suer mpersoration raud Delegated identifiers = vertical and horizontal scaling of signing infrastructure Multi-threshold protection from key compromise attack Multi-signature AIDs MFA witness pools Delgated dentier chains Secure practical, dynamically revocable delegated chains of authority (ACDCs) that persist across key rotations = secure guardianship = secure organizational identity = secure authorization chains Highly available citizen-sourced identities via citizen witness pools. Verifiable reputation via ACDC chained evidence dossiers Multple rootsoftrust for reputation Strongest Identity assurance amortized over the lifespan of unbounded term (persistence) AIDs

Reidentfied —— Redanified [ Aggregater | Uier Agaregator s | Aggregaor | Pt 4 & ) Suried B / Issuarce Dedentifec / Deions / Pt / FTC Regaied o SOR0 S it / 7 S e N [— (v oo o — vertr £ % s = [ Exloter [[soie = o g R AR N~ S B ] o N lne \ B B e e s - s L A . Contrtal Gt Cotonual N Daonw Letkr Comocal o - o (o~ e Y o G e / N A S : o S — i v N — - O e = (R R \ activity / A disclosure L et L ed

What is easily correlatable today is exponentially greater than what was correlatable 10 years ago, 5 years ago, 2 years ago 2024/01/24 Mother of all breaches (MOAB) 26 B Records: npsiw e comogsimens ssbcnsecrcs O — 2024/04/01 NDP Data Breach 2.9 B Records: mpsinperescncoms 2024/02/01 Change Health Care Breach: 190 M Records uupsise ssausmugesne conistidestorsossaminpateci: hange e aachsecuy st s Health Care Data Breaches: 2024 276 M+, 2023 168 M+ Cumulative 2009-present : 846 M+ FECOTAS: rtpsivwn ipssoumst comhesthese dos eeschatotsis! MS Sharepoint Breach ZeroDay 400 SEIVErS: s esecuiyconentiogshaspansiersbiyl GOOGIR 2.5 B USEIS sosstis:essiens et comorsiosone s s Reach and Scope of Modern Data Aggregators: Probability Waterfall s sty contiogsevsteironsingmodetsctinsodispoteibasdrcecses POT Data Brokers, global coverage, multi-constellation << $0.01 per point: scomes hessi [ — ChatGPT4 = 1 PetaByte Training Data Set Size Generative Agentic AK connected services Nation State Funded 5GW (Fifth Generation Warfare)

Design for the Future of Correlatability not the Past What is not easily and cheaply correlatable today will be exponentially easier and cheaper to correlate in 2 years, 5 years, 10 years.

Generative Agentic Al-connected data broker services will enable anyone to surveil anyone else anywhere, with natural language queries for pennies per target.

Corpus of personally linkable knowledge via re-identification attack name, postal address(es), phone number(s), email address(es) SSN, birthdate, age biometrics: face, voice, DNA, fingerprints, gait old passwords any secrets previously used as shared AuthN factors credit card numbers credit history medical history anything from commercial background check, criminal history text, email, social media Google drive, MS Sharepoint drive mobile GPS tracking data surveillance data, security camera, ALPR etc Any breached data of any kind Anything scraped by LLM Al (ChatGPT, Gemini, Grok, etc)

Every act of Selective Disclosure contributes to this corpus of knowledge The act of selective disclosure “singles-out” an individual thereby enabling correlation of the context of the act of disclosure to the corpus of knowledge about the individual. The selectively disclosed data along with the context of the act of disclosure is then added to this corpus of knowledge.

Therefore, counter-intuitively, selective disclosure increases the traceability of individuals, contradicting its falsely purported benefit of reducing the traceability.

The only individuals for whom this is not true are those that are “off-grid” or have fake identities The only material benefit of selective disclosure is that the undisclosed information is not contributed to the corpus of knowledge, so it satisfies the principle of least disclosure, which reduces the rate at which the corpus of reidentifiable information grows over time.

Because the act of disclosure itself is sufficient to correlate that act to the corpus of knowledge that may be tracked/traced to the individual performing that act, the use of a cryptographic identifier in that disclosure is largely immaterial to the traceability of the act.

So whom or what does cryptographic “unlinkabililty” actually protect?

Comprehensive Decorrelation Incentivization Technical fr\ N\ e ) 04 % ! Layered Decorrelation Incentives Spiral

The flawed misconception of “unlinkability” Unqualified “unlinkability” is impossible. Every act in the defined use cases is easily statistically contextually linkable (correlatable) to the corpus of knowledge. Qualified “cryptographic unlinkability" is a very weak form of unlinkability that actually defeats more comprehensive protection measures and increases traceability in the typical use cases. The only unlinkability that ultimately matters is full “contextual unlinkability,” Given the extant corpus of knowledge, there is no technology that provides “contextual unlinkability”. Therefore, providing unqualified “unlinkability” is not a viable policy goal.

The false attraction of unlinkability The concept of unlinkability is attractive primarily because it purports to provide a largely technological solution to what is otherwise a complex and so far intractable problem involving economic, legal, regulatory, and social issues. Itis trying to cure the symptom of the disease, not the disease itself. True unlinkability requires eliminating all “points-of-correlation”, which is impossible. Unlinkability is a “wack-a-mole” approach to privacy, incremental vs. comprehensive. If one does not first employ economic, legal, regulatory, and social solutions to privacy, then merely pursuing unlinkability is “privacy theater”. Indeed, authentic points of correlation may be essential to enable counter-incentives to exploitation.

Fallacy of argument that we should always start with crypto un-linkability as baseline

«Cryptographic unlinkability is not free. It forces hard tradeoffs.

+ZKPs in general are less secure that other mechanisms for selective disclosure. Detection of issuer key compromise requires breaking unlinkability.

+Undetected key compromise enables impersonation of the Issuer thereby incentivizing Issuer employees to exfiltrate private keys.

+Thus the security dilemma of cryptographic unlinkability: given Issuer key compromise, recovery requires revoking and reissuing all the Issuances used by those keys because there is no way to “link” a given issuance past or future toa compromised vs uncompromised use of those keys (without breaking unlinkability).

«Impractical for any long term issuances such as birth certificate SEDI etc

Insecurity increases the vulnerability of breach which increases the disclosure of data.

«ltis easy to defeat in leaky interaction contexts, so bare crypto unlinkability is insufficient. It MUST require tight control over the interaction context, and the tight control must be compatible with the application adoption constraints. (no free lunch)

«The hard problem is not un-linkability but holding the 2nd party (verifier) accountable in order to ensure continued confidentiality of the selectively disclosed data.

+ZKP mechanisms defeat non-technological mechanisms for enforcing confidentiality such as chain-link-confidentialty. A enforceable confidential contract requires 1) an agreement, 2) an exchange of consideration, and 3) an intention to create legal relations. #3 is defeated by unlinkability.

Logical Entailment and Policy A necessary condition means the consequent does not occur when the condition is absent. A sufficient condition means the consequent must occur when the condition is present A necessary condition appears as a subset of every sufficient condition What are sufficient conditions for protecting an individual from tracking with respect to digital identity? Is there a technology that provide a sufficient condition for protecting an individual from tracking? Given a sufficient condition for protecting an individual from tracking does the addition of a given technology defeat that sufficient condition (i.e. does the technology itself make the sufficient condition insufficient)? Can’t evaluate net benefit of any measure until we identify at least one sufficient measure. Insufficient half-measure may defeat a sufficient full measure

What is the Policy Goal that defines sufficiency The best that we can do? The best we can do is a slippery slope. It is the rationale used to justify half-measures. ZKPs and Selective Disclosure are justified as the best we can do, when indeed: 1) they are not the best we can do even only technologically 2) they are net counter productive Suggested Policy Goal: Exploitation of individuals wrt to tracking behavior by legitimate entities is protected such that on balance the expected cost of exploitation exceeds the expected benefit of exploitation. How to achieve: Legal and regulatory measures coupled with technology that supports the legal and regulatory measures that in combination disincentivizes exploitation by legitimate entities.