notes: events/talks/kericonf26-06-oconnor-signify-security-architecture

This data as json

path title type status classification words body
events/talks/kericonf26-06-oconnor-signify-security-architecture Fergal O'Connor: Signify Security Architecture (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 850 # Fergal O'Connor: Signify Security Architecture (KERIConf 2026) **Abstract.** Fergal O'Connor, identity solutions lead architect at the Cardano Foundation and a builder of the Veridian wallet, explained the security architecture of KERIA, the cloud agent for KERI (Key Event Receipt Infrastructure), and Signify, its edge client library. He covered the service layout, the trust relationship between client and agent, and how managed identifiers reach the rest of the network. The talk was on the advanced track, for developers who already know KERI. ## Summary O'Connor introduced Veridian, the Cardano Foundation's open-source identity wallet, which he described as the first production mobile wallet in the KERI and ACDC (Authentic Chained Data Container) ecosystem, built on KERIA and Signify-ts and audited and penetration-tested. His tagline was agent in the cloud, controller at the edge: using a cloud agent does not mean giving up control of keys. Drawing on the five controller functions in the KERI specification, he showed how they can be split so that the edge generates keys and signs events while the cloud agent stores encrypted key material and performs validation, keeping edge applications light. KERIA is a multi-agent Python service built on KERIPy, with an isolated database per agent and one Signify client per agent. Signify is stateless apart from the key material it is given, and all signing happens at the edge. Implementations include Signify-ts, SignifyPy and a full Java implementation built at the Cardano Foundation. KERIA exposes three ports: a boot port for provisioning agents, which Veridian blocks from public access and opens through one-time boot links; an authenticated admin API; and an external CESR (Composable Event Streaming Representation) port, whose message router hands inbound streams to the right agent. For the trust relationship, Signify takes a 21-character passcode, a salt stretched with Argon2id along a derivation path, to produce Ed25519 signing and rotation keys for a client AID (autonomic identifier) in direct mode, without witnesses. Sending its inception event to the boot port provisions an agent whose own AID is delegated to the client AID, and the client approves the delegation with an interaction event. He explained that cooperative delegation is a security mechanism for rotation and recovery, not a grant of authority. REST requests are then signed with the client AID and responses with the agent AID, following RFC 9421 rather than bearer tokens. The passcode can be rotated. Because signed headers rely on TLS (Transport Layer Security) for confidentiality, his team added ESSR (encrypt sender, sign receiver), designed with Samuel Smith and implemented in KERIPy by Philip Feairheller: requests are sealed to the agent with a Libsodium sealed box and the signature covers the body digest, a timestamp, and the sender and receiver. Managed AIDs, the user-facing identifiers, each get their own randomly generated salt, stored encrypted on KERIA, so a passcode rotation does not force rotating every identifier; random keys or an external HSM (hardware security module) are alternatives. To reach the network, the controller authorizes the agent through an end-role authorization and the agent signs a location scheme, which together form its OOBI (out-of-band introduction). Veridian's fork also wraps agent-to-agent CESR streams in ESSR. He closed with a worked rotation from an old passcode to a new one using weighted thresholds. In questions he discussed abandoning an AID, offline signing, and high availability, disaster recovery and migration between KERIA providers. He said these are roadmap items, pointed to his talk the next day, and described his team's backups and work on an exportable backup file. ## Key terms KERIA, Signify, agent in the cloud and controller at the edge, boot port, admin port, client AID, agent AID, cooperative delegation, ESSR, managed AIDs, end-role authorization ## Claims and their evidence - Veridian launched to production as a mobile KERI wallet after security auditing and penetration testing. [presenter-reported] - A KERI controller's functions can be split so that key generation and signing stay at the edge while encrypted key storage and validation run in a cloud agent. [informative] - KERIA provisions each agent with an AID delegated to the client AID, and client and agent authenticate each REST request by signing it, following RFC 9421. [informative] - Signed headers give authenticity but rely on TLS for confidentiality, and ESSR adds encryption to the agent so both are provided. [informative] - Each managed AID uses a separate salt stored encrypted on KERIA, so a passcode rotation does not require rotating every identifier. [informative] - High availability, disaster recovery and provider migration for KERIA are roadmap work, and Veridian is building a backup-file export. [presenter-reported] ## Related The KERI specification; KERIPy, KERIA, Signify-ts, SignifyPy and the Cardano Foundation's Java Signify; Veridian; RFC 9421 (HTTP Message Signatures); ESSR and the SPAC (Secure Privacy, Authenticity and Confidentiality) paper by Samuel Smith; the Trust Spanning Protocol; Philip Feairheller's KERIConf 2026 talk and his design document in the KERIA repository; Samuel Smith's morning keynote; the speaker's roadmap talk on day two. ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (06-fergal-o-conner-signify-security-architecture.md), all of it (about 42 minutes, including questions). No quotations; paraphrase only. Not yet read by Mark.

Links from other tables