notes: events/talks/kericonf26-01-bull-keria-tutorial

This data as json

path title type status classification words body
events/talks/kericonf26-01-bull-keria-tutorial Kent Bull: KERIA Tutorial (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 765 # Kent Bull: KERIA Tutorial (KERIConf 2026) **Abstract.** Kent Bull gave a developer-focused tutorial on KERIA (the KERI agent server, where KERI is Key Event Receipt Infrastructure) and the Signify edge-signing clients that work with it. He explained the signing-at-the-edge architecture, walked through a demo wallet, and covered the configuration details and common mistakes developers meet. The session is for developers who plan to build on or operate KERIA. ## Summary Bull opened by framing the session as hands-on and developer-oriented. He noted that the Signify and KERIA architecture is used in production by several qualified vLEI issuers (vLEI is the verifiable Legal Entity Identifier) in the GLEIF (Global Legal Entity Identifier Foundation) ecosystem, naming Provenant, Finema, CFCA and Certizen, and that the Veridian wallet is built on it. He stressed that the wallet in his demo is a developer demo, not any issuer's product. In answer to an audience question about whether the client is a web app, mobile app or extension, he explained that the client runs anywhere TypeScript and the browser build of Libsodium can run: a browser, Ionic Capacitor or React Native. He then offered his own terminology for two kinds of wallet. A lightweight wallet (Signify with KERIA) keeps only an edge signing client in the user's hands, holding keys unencrypted in memory and minimal state. A heavyweight wallet, with Locksmith from healthKERI (Philip Feairheller's project) as his example, keeps keys, credentials and state together locally with no server agent. He described the agent as the server side of the lightweight model: a mailbox (a store-and-forward service so messages reach an offline phone), a delegation communication proxy, and the primary data store for ACDCs (Authentic Chained Data Containers), contacts, OOBIs (Out-Of-Band Introductions) and key event logs. Key seeds are stored at the agent only in encrypted form, encrypted with a key derived from a passcode that never leaves the edge. Provisioning is a two-step boot and connect, in which the edge controller delegates to the agent identifier, so the agent's first event is a delegated inception. One agent serves one Signify controller, and an agency hosts many agents. He traced the design back to the Simple KERI for Web Auth (SKWA) protocol documented around 2021 and 2022. The demo showed connecting with a 21-character passcode, creating a managed identifier, inspecting the controller and agent relationship, and fetching an identifier's key event log as a CESR (Composable Event Streaming Representation) stream. Audience discussion covered why a person or organization might hold several managed identifiers, for separate roles or to keep contexts apart for privacy, including in SEDI (State-Endorsed Digital Identity) scenarios. He added that the agency administrator has access to no usable keys. He then listed the libraries (SignifyTS, SignifyPy, and a Java implementation from Cardano) and recent version releases, and a set of gotchas: never store the passcode in browser storage in production, use secure storage plugins on devices, and set the KERI_AGENT_CORS environment variable. Multisignature works as in KERIpy except that messages pass through agents. He closed with the configuration file: matching names, controller URLs for port binding, and sections that pre-resolve witnesses and schemas for every agent. His summary rule was to use KERIA when a lightweight wallet is needed and not otherwise. ## Key terms KERIA, Signify, signing at the edge, lightweight wallet, heavyweight wallet, agent and agency, managed identifier, delegated inception, mailbox, passcode ## Claims and their evidence - Several qualified vLEI issuers and the Veridian wallet run on the Signify and KERIA architecture in production. [presenter-reported] - In the lightweight model, all signing happens at the edge client; the agent stores key seeds only encrypted, with a key derived from a passcode that never leaves the edge. [informative] - The agent is provisioned through a KERI delegation, so its first key event is a delegated inception from the edge controller. [informative] - The administrator of a multi-tenant agency cannot use the keys of the agents it hosts, because they are encrypted at rest. [informative] - SignifyPy has been brought to parity with SignifyTS, and a KERIA patch for a delegation issue found during preparation was pending release. [presenter-reported] ## Related KERIA, SignifyTS, SignifyPy, Signify Java (Cardano), KERIpy, Locksmith (healthKERI), Simple KERI for Web Auth (SKWA), the Signify React TS example repository, the speaker's blog post on configuring KERIpy and KERIA, the speaker's KERIConf 2026 talk on the HIO async framework. ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (01-kent-bull-keria-tutorial.md), all minutes read (the transcript runs to about 41 minutes of the listed 51:20). No quotations; paraphrase only. Not yet read by Mark.

Links from other tables