notes: research/papers/papers-pac-theorem-keri-zero-trust-data-management

This data as json

path title type status classification words body
research/papers/papers-pac-theorem-keri-zero-trust-data-management PAC Theorem: Privacy, Authenticity, Confidentiality. KERI and Zero Trust Data Management summary v0.1 — 2026-10-15: drafted by Claude from the PDF slide deck (slide titles throughout, slides 1-30 and selected later slides read in full); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 537 # PAC Theorem: Privacy, Authenticity, Confidentiality. KERI and Zero Trust Data Management **Abstract.** A 228-slide deck by Samuel M. Smith, marked version 2.60 and dated 2021/04/23, that states the PAC (privacy, authenticity, confidentiality) theorem and uses it to frame zero-trust data management with KERI (Key Event Receipt Infrastructure). Most of the deck is reference material on KERI identifiers, delegation, witnessing, security and the CESR encoding. For practitioners and implementers. ## Summary The deck opens with the PAC theorem: a conversation may be two of the three, private, authentic and confidential, to the same degree, but not all three at the same degree, so trade-offs are required. It defines each term: privacy as control over disclosure of who took part (non-content metadata), authenticity as proving who said what (secure attribution), and confidentiality as control over disclosure of what was said (content). It then separates non-repudiable proof (asymmetric digital signatures, which it calls zero-trust and legally binding) from repudiable proof (shared-key encryption, where every verifier is a potential forger), and asks whether zero-knowledge proofs are repudiable or not. The next section treats layering, strong privacy, the economics of correlators and de-correlators, and a three-party exploitation model. As a remedy it offers contractually governed exchanges: chain-link confidentiality, least disclosure, contractual exchange and latent accountability. It introduces the BADA (Best Available Data Acceptance) policy and "RUN off the CRUD" (slide 27) for data that is not anchored in a transaction event log. The rest of the deck is a long background section. It covers the secure attribution problem and the identity system security overlay; forms of self-certifying identifier (SCID), from basic to self-addressing, multi-signature, delegated and self-signing; inconsistency and duplicity; administrative, algorithmic and autonomic trust bases; delegation and its scaling; the tripartite verifiable credential model with KERI-based registries and separable issuance and revocation TELs (transaction event logs); the spanning-layer hourglass argument; protocol modes, witnessing rules and the KA2CE agreement algorithm; recovery from live and dead key exploits; generic event formats; discovery; macro security considerations; and the CESR (Composable Event Streaming Representation) code tables and stream parsing rules, closing with archival preservation, legally binding signatures and audit trails. ## Key terms PAC theorem, non-repudiable authenticity, repudiable authenticity, chain-link confidentiality, latent accountability, BADA policy, self-certifying identifier, autonomic identifier, duplicity, trust basis ## Claims and their evidence - Privacy, authenticity and confidentiality cannot all be had at the highest degree in one conversation; trade-offs are required. [informative] - Non-repudiable authenticity by asymmetric signature is zero-trust and legally binding; repudiable authenticity by shared keys requires trust. [informative] - Contractually protected disclosure with chain-link confidentiality protects disclosed data where technical means cannot. [informative] - KERI provides duplicity-evident key management in which internal inconsistency is caught by verification and external inconsistency by duplicity detection. [informative] - CESR's composable text and binary encodings round-trip without loss and support archival preservation. [informative] ## Related Key Event Receipt Infrastructure (KERI) white paper; Composable Event Streaming Representation (CESR) specification; Authentic Chained Data Containers (ACDC); SPAC (Secure Privacy, Authenticity, and Confidentiality); Sustainable Privacy; BADA and OOBI material in "Internet Safety with KERI". ## Provenance Drafted by Claude on 2026-10-15 from the PDF in Smith's Papers repository: every slide title, slides 1-30 in full, and selected later slides. Not yet read by Mark.

Links from other tables