notes: research/papers/papers-decentralized-self-certifying-self-identifying-data

This data as json

path title type status classification words body
research/papers/papers-decentralized-self-certifying-self-identifying-data Decentralized Self-certifying Self-Identifing Data summary v0.1 — 2026-10-15: drafted by Claude from the markdown file in the Papers repository; unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 502 # Decentralized Self-certifying Self-Identifing Data **Abstract.** A 2017 white paper by Samuel M. Smith on how to represent data items that carry their own self-certifying decentralized identifier (DID) and a signature, with attention to economy of expression for data-intensive applications. It covers HTTP signature headers, change detection, intelligent defaults and key management (rotation, reproduction, recovery, revocation), and describes an early form of key pre-rotation. It predates KERI. ## Summary The paper asks how best to represent decentralized, self-certifying, self-identifying data for distributed data-intensive processing, where economy of expression matters. A self-identifying data item includes a self-certifying DID (one containing a public key or its fingerprint) and a signer field whose DID's private key signs the serialized item; if the two are the same the item is trivially self-signed. Examples show JSON items followed by a separator and a signature. For HTTP, it proposes a custom `Signature` header carrying one or more tagged signatures, with an optional `kind` tag for the cryptographic suite, following RFC 7230 conventions. A change-detection section adds a monotonically increasing `changed` field so that stale copies cannot replace newer ones, framed as protection against replay. The paper introduces "relative expressive power", meaning conveyed per dependency, and two ways to raise it: intelligent defaults, which give meaning to absent data, and keeping essential elements explicit rather than behind lookups. The key management section lists the four R's: rotation, reproduction, recovery and revocation. Rotation can be expressed in the item through a `keys` list. A passage on pairwise keys and hierarchical deterministic keys describes pre-rotating each key pair by publishing the next key in advance, so that a compromised key can at most trigger rotation to a key the attacker does not hold. It recommends fixed cryptographic suites rather than independently chosen algorithms, citing criticism of JOSE. Key reproduction uses hierarchical deterministic key paths; recovery and revocation are listed as headings with little text, as are nested signatures and data canonicalization. ## Key terms self-identifying data, self-certifying identifier, DID, signer field, Signature header, change detection, relative expressive power, intelligent defaults, four R's of key management, pre-rotation, hierarchical deterministic keys, cryptographic suite ## Claims and their evidence - A data item whose identifier contains a public key, and which is signed by that key, is tamper-evident: any change invalidates the signature. [informative] - A monotonically increasing `changed` field lets a recipient discard replayed stale copies. [informative] - Publishing the next key in advance (pre-rotation) prevents a compromised key from being used to rotate to an attacker's key. [informative] - Letting each cryptographic operation be chosen independently, as in JOSE, exposes vulnerabilities; fixed suites prevent bad choices. [informative] ## Related DID Revision Proposal (2017), A DID for Everything (RWOT 7), Decentralized Autonomic Data (DAD) and the three R's of Key Management (RWOT 6), Key Event Receipt Infrastructure (KERI) white paper. ## Provenance Drafted by Claude on 2026-10-15 from the markdown file `whitepapers/SelfIdentifyingData.md` (dated 2017/10/27), read in full, with JSON examples skimmed. The title keeps the source's spelling, "Self-Identifing". Not yet read by Mark.

Links from other tables