notes: research/papers/kerione-manning-ssi-book-chapter-10

This data as json

path title type status classification words body
research/papers/kerione-manning-ssi-book-chapter-10 10 Decentralized key management summary v0.1 — 2026-10-14: drafted by Claude from the PDF (38 pages); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 481 # 10 Decentralized key management **Abstract.** Chapter 10, 'Decentralized key management', from a Manning book on self-sovereign identity (SSI), written by Sam Smith and posted as a 38-page pre-production manuscript. It covers why key management is hard, conventional standards, roots of trust, decentralized key management, ledger-based and peer DID methods, and closes with a section summarizing KERI's architecture, for readers new to the subject. ## Summary The chapter belongs to a Manning book on self-sovereign identity (SSI) and follows a chapter on digital wallets and agents. An editors' introduction presents Dr. Sam Smith as the chapter's author and the inventor of KERI (Key Event Receipt Infrastructure), covered in the final section. It first explains why digital key management is hard: digital keys can be stolen remotely, their theft may go unnoticed, and their loss can be irreversible. It then reviews conventional standards and practice, naming NIST publications and OASIS's Key Management Interoperability Protocol (KMIP). The core of the chapter is roots of trust. It contrasts administrative roots of trust with algorithmic (ledger) and self-certifying ones, summarized in a table of the three types, and describes the move to decentralized key management as a migration away from administrative roots. It sets out requirements for a decentralized key management system (DKMS): vendor neutral, open to new cipher suites, portable across wallets, and with built-in recovery, and notes an initial DKMS design developed by Evernym for the U.S. Department of Homeland Security. It then describes the tools that verifiable credentials (VCs), decentralized identifiers (DIDs) and SSI bring, such as separating key verification from identity verification, automated rotation, backup and recovery, and guardianship. It reviews ledger-based DID methods, which it says make up most DID methods and are "ledger-locked", and peer DIDs, which use a simple self-certifying identifier (SCID) shared peer to peer. The final section summarizes KERI: generalized SCIDs, key event logs whose records chain by digest and are signed, witnesses as secondary roots of trust, pre-rotation, and ambient verifiability. ## Key terms key management, root of trust, administrative, algorithmic and self-certifying roots of trust, DKMS, self-certifying identifier (SCID), peer DID, key event log, witness, pre-rotation, ambient verifiability ## Claims and their evidence - The shift to decentralized key management is a migration from administrative to algorithmic or self-certifying roots of trust (Summary). [informative] - About 95 percent of DID methods use blockchains or distributed ledgers as their root of trust (Summary). [unverified] - Ledger-based DIDs are not portable and may conflict with the GDPR right to be forgotten (Summary). [informative] - KERI's pre-rotation minimizes the damage if the current private key is stolen (Summary). [informative] ## Related KERI White Paper; Universal Identifier Theory with KERI; the Hitchhiker's Guide to KERI, Part 3, which recommends the book. ## Provenance Drafted by Claude on 2026-10-14 from the PDF manuscript, read through the opening pages, section headings and the chapter summary. Not yet read by Mark.

Links from other tables