notes: events/talks/kericonf26-05-feairheller-infrastructure-for-security

This data as json

path title type status classification words body
events/talks/kericonf26-05-feairheller-infrastructure-for-security Philip Feairheller: Infrastructure for Security (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 756 # Philip Feairheller: Infrastructure for Security (KERIConf 2026) **Abstract.** Philip Feairheller, chief technology officer and co-founder of healthKERI, presented the layers of security in KERI (Key Event Receipt Infrastructure) and the infrastructure healthKERI has built for them: the Locksmith wallet, witnesses offered as a service, and a global watcher network. Most of the session was a live demo. It is for developers and operators deciding how to run wallets, witnesses and watchers. ## Summary Feairheller began with the teaching slide he uses for newcomers, a stack of security layers. At the bottom are self-certifying identifiers and CESR (Composable Event Streaming Representation), which he described as solving the two hard problems of PKI (public key infrastructure): binding an identifier to its first keys and binding it through every rotation. Above that come pre-rotation and key event logs, then delegation and distributed group multisignature, and at the fourth layer witnesses and watchers. The first three layers live in the wallet; the fourth is the infrastructure healthKERI has donated to the KERI Foundation as open source. He introduced Locksmith, which began as his own alternative to the KERIpy command line and grew into a production wallet. Its open-source core covers local key state, vaults (his name for what KERIpy calls habery environments), identifiers, delegation, multisignature groups, rotation, schemas, credential issuance and the IPEX (Issuance and Presentation Exchange) protocol, with no server required and an export of key event logs as CESR. Integration with healthKERI's software-as-a-service platform was wrapped as a plugin interface so others can add their own services, and a further plugin manages multisignature coordination for vLEI (verifiable Legal Entity Identifier) issuance across an enterprise. KERI messages also feed a notification system. The demo created a vault and an identifier with a single step, showed the advanced options (keychain, salt or random keys, M-of-N thresholds, establishment-only, delegation), and showed group identifiers formed from contacts resolved through OOBIs (Out-Of-Band Introductions). Signing in to the platform uses a KERI identifier rather than a password, with traffic protected by ESSR (encrypt sender, sign receiver), built into KERIpy. Accounts are organized by teams. Locksmith hides the credential registry: choosing a schema for issuance creates the registry behind the scenes, a choice he said is open for debate. On witnesses, each witness reserved on the platform serves a single AID (autonomic identifier) only, has its own key store, and requires a one-time passcode for rotations, which he added to the KERI core. Witnesses are offered in New York, Frankfurt, Singapore and Sydney. He reserved four, authenticated with a batch passcode, and rotated them in with a TOAD (threshold of accountable duplicity) of three. On watchers, he explained that renting individual watchers did not work well, and after discussion with Samuel Smith the team moved to a global watcher network that watches any identifier on request. He demonstrated a second user being notified of a rotation and syncing the new key state, and described the same pattern for enterprise servers, such as an OAuth server validating vLEIs, running a local watcher sidecar. In questions he described four watchers chosen at random across the four regions, in data centers separate from the witnesses. ## Key terms Locksmith, vault, plugin architecture, witness as a service, non-promiscuous witness, one-time passcode, watcher network, ESSR, TOAD, remote identifier ## Claims and their evidence - KERI solves the two hard problems of PKI: binding an identifier to its initial keys and to every subsequent set of keys through rotation. [informative] - Each witness on the healthKERI platform witnesses for only one AID and keeps its own key store, which keeps each witness small and scalable. [presenter-reported] - The healthKERI witness and watcher core has been donated to the KERI Foundation as open source, and the Locksmith core is open source. [presenter-reported] - Watchers run in four regions, with four chosen at random per watched identifier, in data centers separate from the witnesses. [presenter-reported] - A group identifier behaves like any other KERI identifier, except that its keys are held across several machines and only public keys are shared to form it. [informative] ## Related Locksmith, KERIpy, the KERI Foundation, the KERI Foundation presentations on integrating the Locksmith core with their own services, the speaker's demonstration the next day of IPEX integrated into OAuth servers, the vLEI in healthcare work presented by Jared at the conference. ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (05-phil-feairheller-infrastructure-for-security.md), all minutes read (the transcript ends at about 37 minutes of the listed 41:15). No quotations; paraphrase only. Not yet read by Mark.

Links from other tables