notes: events/talks/kericonf26-12-hardman-open-verifiable-communications

This data as json

path title type status classification words body
events/talks/kericonf26-12-hardman-open-verifiable-communications Daniel Hardman: Open Verifiable Communications (KERIConf 2026) summary v0.1 — 2026-10-15: drafted by Claude from the curated transcript; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only, no quotation partner 807 # Daniel Hardman: Open Verifiable Communications (KERIConf 2026) **Abstract.** Daniel Hardman, CTO (chief technology officer) of Provenant, presented OVC (Open Verifiable Communications), a GSMA (the mobile industry association) Foundry project that attaches verifiable evidence to phone calls so that a recipient, network or regulator can check who is calling and on whose authority. He played the project's demonstration, explained the Verifiable Voice Protocol and the dossier of credentials behind it, and described the follow-on work. The talk is for readers interested in a large-scale application of KERI (Key Event Receipt Infrastructure) and ACDCs (Authentic Chained Data Containers) in telecommunications. ## Summary Hardman began with the scale of phone and text scams: advice to stop answering the phone amounts to an existential threat for businesses that depend on calls. In his Microsoft example, customers ignore genuine support callbacks, and Ofcom, the UK communications regulator, will not let a call from an offshore contact center present a UK number unless the caller can prove it is Microsoft. He then played a demonstration first shown at Mobile World Congress. Credentials issued to Microsoft prove its right to the displayed telephone number, its legal identity through an LEI (Legal Entity Identifier), and its right to the brand; a fourth credential delegates signing to a platform such as Infobip, Twilio or Vonage. A call from a US number to a prepaid Spanish SIM displayed the verified name, number and brand. The governance model runs from a governance authority to policy administrators per jurisdiction, to vetting agents, to enterprises, all chained so that any link can be revoked with a cascading effect. A second call, after one credential was revoked, was rejected by the transit operator, and an evidence record showed which credential failed and who had vetted the enterprise. The call flow uses a signing service, a passport carried over the PSTN (public switched telephone network), verification by a transit operator, and a lookup from a modified Android dialer. Drawing out the points, he stressed that anyone who carries the call can verify it, which satisfies regulators as well as end users; that revocation must take effect in real time; and that evidence can be examined historically. He explained that VVP (Verifiable Voice Protocol) is an IETF (Internet Engineering Task Force) draft that adds a small field to the STIR (Secure Telephone Identity Revisited) passport, a JWT (JSON Web Token) that voice networks already carry, so no infrastructure change is needed; the demonstration ran over unmodified networks. He said Microsoft is going to production jurisdiction by jurisdiction, starting in the UK, that the GSMA project finished in March, and that follow-on work covers governance through the vLEI (verifiable LEI) family and other channels. OVC originally meant Open Verifiable Calling. On the architecture, the passport links to a dossier: a bundle of credentials from different issuers, each with its own revocation terms, ending with the enterprise's own declaration of intent, built in the same way as vLEIs. He said the solution could not be built without KERI and ACDCs, though foreign evidence such as W3C (World Wide Web Consortium) credentials or SD-JWTs (selective disclosure JWTs) can be brought in by wrapped mode, which he favors, or embedded mode. Unlike certificate-based SHAKEN, which requires frequent replacement, a KERI identifier never has to be replaced; keys rotate and attributes change only when they change. Proving whether a caller is an AI was out of scope; the goal is accountability. Questions covered the Google dialer, the security of the dossier link (an OOBI, out-of-band introduction, to a KEL, key event log), and privacy of callback paths. ## Key terms OVC, Verifiable Voice Protocol, STIR passport, dossier, governance authority, policy administrator, vetting agent, delegated signing credential, wrapped mode, embedded mode ## Claims and their evidence - The demonstration call reached a prepaid Spanish SIM over networks that had no notice of the trial, without infrastructure changes. [presenter-reported] - Microsoft is going to production in several jurisdictions, beginning in the UK. [presenter-reported] - VVP adds a link to a dossier of evidence inside the existing STIR passport, which networks already carry. [informative] - A KERI identifier for an enterprise need not be replaced when keys rotate, unlike the certificates used in SHAKEN. [informative] - Revoking a credential anywhere in the chain causes calls relying on it to fail verification, and evidence can be checked as of a past time. [informative] - The dossier link is an OOBI to a key event log, so substituted content would not verify against the identifier's history. [informative] ## Related Verifiable Voice Protocol (IETF draft), the Dossier specification at Trust over IP, STIR and SHAKEN, the GSMA Foundry OVC project, vLEI credentials, Samuel Smith's earlier KERIConf 2026 presentation. ## Provenance Drafted by Claude on 2026-10-15 from the curated transcript (12-daniel-hardman-open-verifiable-communications.md), all 40 minutes read. No quotations; paraphrase only. Not yet read by Mark.

Links from other tables