notes: research/papers/papers-bulk-issuance-privacy

This data as json

path title type status classification words body
research/papers/papers-bulk-issuance-privacy Bulk Issuance: Balancing security of perpetually verifiable issuances with correlation risk for privacy protection summary v0.1 — 2026-10-15: drafted by Claude from the PDF slides (text extracted with pdftotext); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 673 # Bulk Issuance: Balancing security of perpetually verifiable issuances with correlation risk for privacy protection **Abstract.** A 48-slide deck by Samuel M. Smith on bulk issuance of Authentic Chained Data Containers (ACDCs): how an issuer can give a holder many unlinkable copies of a credential while keeping each one verifiable against the issuer's key state. It covers blindable state registries, Sparse Merkle Tree anchoring for herd privacy, graduated and contractually protected disclosure, and the IPEX exchange protocol, for implementers and designers of credential systems. ## Summary The deck opens with a "tradespace" of threats (identity theft, attention theft, intimidation) and the mitigations it proposes: perpetual identity, perpetually verifiable issuances, and control over the context of disclosure, presence and usage. It treats an Authentic Chained Data Container (ACDC) as a fragment of a distributed property graph whose edges can model delegable, attenuable and revocable authority. It then lists the ACDC confidentiality and privacy protections: least disclosure, graduated disclosure (compact, partial, nested partial, full, selective, metadata and bulk-issued instance disclosure, dated "circa 2020"), contractually protected disclosure (chain-link confidentiality, contingent disclosure, latent accountability), and, dated "circa 2023-2025", blindable and bindable delegated ACDC state registries. The middle of the deck describes the infrastructure. Key Event Receipt Infrastructure (KERI) provides witnesses, watchers and duplicity detection; ACDC state lives in registries kept by an issuer registrar and read by observers. Registry events (inception, blinded update) are anchored by seals in the issuer's Key Event Log (KEL), so ACDC state stays bound to the issuer's key state across rotations. A Transaction Event Log (TEL) records issued and revoked states; blinded attribute blocks hide the state from third parties, and placeholder updates hide the timing of real changes. A usage presentation registry does the same for the issuee's presentations. For bulk issuance, each member of a set gets UUIDs and an Autonomic Identifier (AID) derived by a hierarchical deterministic key algorithm from shared and private salts, and typically its own registry. The issuer anchors all registry updates under one seal, the root of a Sparse Merkle Tree (SMT), which the deck says gives "herd privacy" so that two second parties cannot compare inclusion proofs to link credentials from one set. An identity assurance proof-of-control (IAPC) ACDC, issued after an in-person session, lets an account AID request a bulk issuance of SEDI credentials (State Endorsed Digital Identity in a companion deck). The deck closes with proof-of-age options, comparing zero-knowledge proof (ZKP) predicates with SMT predicate proofs, the IPEX message flow (apply, offer, agree, grant, admit), chain-link confidentiality, and the ACDC field labels. ## Key terms bulk issuance, herd privacy, blindable state registry, Sparse Merkle Tree, graduated disclosure, contractually protected disclosure, chain-link confidentiality, IPEX, perpetually verifiable issuance, Transaction Event Log ## Claims and their evidence - ACDC state recorded in a registry is verifiably bound to the issuer's key state despite key rotations, through seals anchored in the issuer's KEL. [informative] - Anchoring all registry updates for a bulk-issued set under one Sparse Merkle Tree root lets the issuer prove inclusion of any one update without revealing which other registries belong to the same set. [informative] - Random placeholder updates across registries can guarantee a pre-specified level of herd privacy. [informative] - An SMT age predicate needs about 36,500 leaves and roughly 1.17 MB for 100 years of daily values, with inclusion proofs of about 15 operations, and, unlike a ZKP predicate, keeps issuer key compromise detectable. [presenter-reported] - The identity assurance session for SEDI accounts is described as compliant with NIST Identity Assurance Level 3 (IAL3). [presenter-reported] ## Related ACDC specification (ToIP), KERI specification, Composable Event Streaming Representation (CESR) specification, ACDCs for Delegable Authorization (AuthorizationEVAC deck), Bulk Issuance Context Management: Self-enforcing Data Loyalty (companion deck), Cryptoperiod Catastrophe (companion deck) ## Provenance Drafted by Claude on 2026-10-15 from the PDF in Smith's Papers repository (presentations/BulkIssuancePrivacy.pdf), all 48 slides read as extracted text; slides 40, 41, 47 and 48 carry no extractable text. The date (April 2026) is from the PDF's metadata; the deck names no venue or date. Not yet read by Mark.

Links from other tables