notes: research/papers/hardman-a-primer-on-keri-acdcs-and-cesr

This data as json

path title type status classification words body
research/papers/hardman-a-primer-on-keri-acdcs-and-cesr A Primer on KERI, ACDCs, and CESR summary v0.1 — 2026-10-15: drafted by Claude from the web page (version 1.2); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 596 # A Primer on KERI, ACDCs, and CESR **Abstract.** An introductory paper by Daniel Hardman that explains the three layers of the KERI suite: Key Event Receipt Infrastructure (KERI) for identifiers and key state, Authentic Chained Data Containers (ACDCs) for verifiable data, and Composable Event Streaming Representation (CESR) for encoding. It starts from the weaknesses of administrative public key infrastructure (PKI) and walks through each layer's mechanisms with worked examples. Written for engineers and technically literate readers new to the suite. ## Summary The paper opens with what it calls administrative trust failure. In the X.509 model the binding between an identifier and a key is an assertion signed by a certificate authority (CA), so the root of trust lies outside the identifier. It cites CA compromises and distrust events, the limits of certificate revocation lists and the Online Certificate Status Protocol, the centralizing effect of certificate transparency (CT), and the loss of continuity when certificates expire or keys rotate. From this it derives requirements for a new stack: the identifier as root of trust, auditable history, identity that survives key rotation, safe revocation, and self-service recovery. The KERI section explains key event logs (KELs) as per-identifier microledgers rather than a global consensus ledger; autonomic identifiers (AIDs) as self-certifying identifiers in basic and transferable forms; the inception, rotation and interaction events; pre-rotation, where the next key is committed by its digest; fractionally weighted multisig thresholds, with a corporate board and a break-glass recovery example; quantum resistance through hidden next keys and hybrid thresholds; and witnesses and watchers, which detect duplicity rather than attest to identity. The ACDC section covers issuance by agents with anchoring in the issuer's KEL or a transaction event log (TEL) and transport over the Issuance and Presentation Exchange (IPEX) protocol; self-addressing identifiers (SAIDs); anchored as opposed to paired signatures; chained credentials as a directed acyclic graph, illustrated with a tantalum supply chain; and selective disclosure and the right to be forgotten. The CESR section describes text and binary interconvertibility, self-framing codes that allow pipelined routing, and code tables that give cryptographic agility, including room for post-quantum keys. The conclusion lists resilience, transparency, revocability and efficiency, notes incremental verification costs, and expects adoption to run in parallel with the web PKI, first where X.509 is weakest: supply chains, the Internet of Things (IoT) and high-assurance credentials. ## Key terms autonomic identifier (AID), key event log (KEL), pre-rotation, weighted multisig, duplicity, witnesses and watchers, self-addressing identifier (SAID), anchored signatures, IPEX, self-framing ## Claims and their evidence - The X.509 model separates identifier from key, placing the root of trust in an external administrator; supported by cited CA incidents (DigiNotar, Symantec, TrustCor). [informative] - Pre-rotation prevents an attacker holding the current key from rotating control to keys they hold, because only the digest of the next key is public. [normative] - Anchoring an ACDC's digest in the issuer's KEL removes the timestamp ambiguity that paired signatures have and resists retrograde attacks. [informative] - Deleting an ACDC payload while the KEL keeps only its hash reconciles the log with the right to be forgotten. [unverified] - CESR parsers that predate a new code assignment can still frame the stream, so post-quantum algorithms can be added without re-releasing parsers. [informative] ## Related Key Event Receipt Infrastructure (KERI) specification; Authentic Chained Data Containers (ACDC) specification; Composable Event Streaming Representation (CESR) specification; KERI's Strategy for Post-Quantum Security; ACDCs and W3C VCs: Lossless vs. Lossy. ## Provenance Drafted by Claude on 2026-10-15 from the web page at dhh1128.github.io/papers/keri-primer.html, read in full except the works cited. Not yet read by Mark.

Links from other tables