notes: events/talks/kericonf26-07-smith-digital-identity-tradespace

This data as json

path title type status classification words body
events/talks/kericonf26-07-smith-digital-identity-tradespace Samuel M. Smith: The Digital Identity Tradespace (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 777 # Samuel M. Smith: The Digital Identity Tradespace (KERIConf 2026) **Abstract.** Samuel M. Smith explained the design trades behind KERI (Key Event Receipt Infrastructure) and ACDC (Authentic Chained Data Containers), and in particular why the suite addresses privacy through bulk issuance and blinded state registries rather than through other mechanisms. The talk was a detailed, technical session for people already familiar with the suite's basics. The transcript ends partway through the section on identity assurance. ## Summary Smith opened with the suite's policy of security first: when a design choice would trade weaker security for a gain elsewhere, the trade is declined, because over time every weakened security trade becomes a bad one. The question is then how well the other problems can be solved under that constraint. In KERI each AID (autonomic identifier) controller is its own identity provider, with keys at the edge and no third-party identity providers or trusted intermediaries. Picking up from his plenary, he named RAPC3 (Reputable Autonomic Pseudonymity and Control over Confidential Contexts) and said privacy is addressed through control over confidential contexts, which bulk issuance gives the user. He stressed that all shared information is correlatable to some degree, and that unlinkability differs from uncorrelatability. He described an ACDC as a graph fragment whose edges are part of what is authenticated, so fragments from different sources compose securely into a labeled property graph. This supports delegable, attenuable, aggregable, revocable and transferable authority, and lets credentials model real-world authority structures, organizational or parental, instead of fitting them to session-based models such as OAuth and OIDC (OpenID Connect). ACDCs aim at perpetually verifiable issuances, the harder problem, while ephemeral uses remain possible. He listed the suite's disclosure mechanisms: graduated, compact, metadata, partial, nested partial, full and selective disclosure, bulk-issued instance disclosure and contractually protected disclosure, which shifts liability onto the recipient. He noted that digital signatures and Merkle tree inclusion proofs are, technically, zero-knowledge proofs, and that the suite avoids only those proof systems whose security he considers too weak for long-lived issuances. He also mentioned a user presentation registry that lets presenters detect compromise of their own proofs. On infrastructure, ACDCs add registrars (controlled by issuers) and observers (controlled by verifiers), mirroring KERI's split between witnesses and watchers. Registry state lives in a TEL (Transaction Event Log) anchored by seals in the issuer's KEL (Key Event Log). In a blinded state registry, updates carry a blinded identifier, so third parties cannot tell what changed; only parties to whom the issuee unblinds the state can read it. To avoid metadata correlation, registries can be created in bulk on one date (his example was a state issuing registries for all future birth certificates on the first day of SEDI, State-Endorsed Digital Identity), updated with no-change events, refreshed at the holder's request, shared across many ACDCs, and published to observers in a single daily batch for herd privacy. Blinding factors derive from a salt exchanged between issuer and issuee, which can happen out of band during in-person identity assurance. He contrasted this with Tor's variable packet sizes and said SPAC (Secure Privacy, Authenticity and Confidentiality) and TSP (Trust Spanning Protocol) use uniform packets. The remaining weakness is collusion between a malicious issuer and observer, which he said has no built-in channel and would be fraud. He began explaining identity assurance as the answer to cheap pseudonymity when the transcript ends. ## Key terms security first, keys at the edge, RAPC3, control over confidential contexts, graph fragment, perpetually verifiable issuance, contractually protected disclosure, registrar and observer, blinded state registry, bulk issuance, herd privacy ## Claims and their evidence - ACDC edges are authenticated with each fragment, so a graph can be composed securely from multiple independent sources. [informative] - A blinded state registry keeps an ACDC's state unreadable to third parties until the issuee unblinds it for a chosen verifier. [informative] - Bulk registry creation and batched daily updates remove timing metadata that would otherwise reveal events such as a birth date or a job loss. [informative] - Disclosure mechanisms beyond selective disclosure, such as compact, partial, graduated and contractually protected disclosure, are not found in other credential formats. [presenter-reported] - On launch, a state issuing SEDI credentials would create registries for its whole expected population at once. [presenter-reported] ## Related ACDC specification, KERI specification, SEDI, SPAC and TSP (Trust Spanning Protocol), Samuel M. Smith's KERIConf 2026 plenaries on both days ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (07-samuel-smith-the-digital-identity-tradespace.md), minutes 0 to 37 read; the transcript ends there, mid-sentence, and the last 8 or so minutes of the 45:30 talk are missing. No quotations; paraphrase only. Not yet read by Mark.

Links from other tables