notes: research/papers/papers-security-deep-dive-keri-necessary-and-sufficient

This data as json

path title type status classification words body
research/papers/papers-security-deep-dive-keri-necessary-and-sufficient Security Deep Dive: Why KERI is Necessary and Sufficient summary v0.1 — 2026-10-15: drafted by Claude from the PDF slide deck (all 76 slide titles, slides 1-9, 17-20, 28-46 in full); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 546 # Security Deep Dive: Why KERI is Necessary and Sufficient **Abstract.** A 76-slide deck by Samuel M. Smith, undated on its title slide (the PDF was created in October 2025), arguing that every part of KERI (Key Event Receipt Infrastructure) is needed to defend against a known set of attacks. It walks through the KERI ecosystem components, key compromise and recovery, delegation, and the trust-basis and spanning-layer background. For practitioners and implementers. ## Summary The deck lists hard problems (moving data across trust domains, persistent identifiers with rotatable keys, near-instant detection of and recovery from key compromise, duplicity-evident operation, no shared secrets, signing everything, resistance to a surprise quantum attack, global portability at scale) against the KERI suite components that address them: KERI, CESR (Composable Event Streaming Representation), ACDC (Authentic Chained Data Container), TSP (Trust Spanning Protocol) and the GLEIF vLEI (verifiable Legal Entity Identifier) as a reputational root of trust. Its central argument is "minimally sufficient means": each part of KERI is necessary to protect against a known attack, so a system is secure only if all of KERI is used, and anyone using a subset must show it is still secure. It borrows "combined arms" and armor analogies, and frames survivability as susceptibility, vulnerability and recoverability. The core section treats a malicious or compromised controller and how a validator is protected: internal versus external inconsistency (duplicity), witnesses and watchers in basic and advanced configurations, dead exploits of stale keys (with "watcher mentoring", where new watchers sync with old ones), and live exploits of current keys with recovery by pre-rotation. It contrasts risk assessment with appraisal, cites the IETF RATS (Remote ATtestation procedureS) working group, and describes dynamic appraisability. Later slides cover issuances that stay verifiable despite key compromise, the ACDC state registry on a TEL (transaction event log) with registrars and observers, a bowtie and graph model of verifiable data, closed-loop and open-loop models for cross-domain trust, and delegated identifiers for scaling signing infrastructure. The remainder is background: end verifiability, autonomic identifiers and pre-rotation, trust bases, the LEI (Legal Entity Identifier) and vLEI trust chain, flaws of DNS/CA (certificate authority) PKI (public key infrastructure) and of PGP's web of trust, and the PAC (privacy, authenticity, confidentiality) theorem. ## Key terms minimally sufficient means, duplicity, witness, watcher, watcher mentoring, live exploit, dead exploit, pre-rotation, dynamic appraisability, trust domain ## Claims and their evidence - A system using KERI is secure if and only if all of KERI is employed. [informative] - New watchers can protect themselves from dead exploits by syncing with older watchers before seeing new key event logs. [informative] - Pre-rotation allows recovery from a live compromise of current signing keys. [informative] - Popular identity architectures, closed-loop (OpenID, Kerberos) and open-loop (DNS/CA), are ill-suited to secure cross-domain trust transfer. [informative] - The resources slide lists adoptions including GLEIF vLEI, the European Banking Authority, US Customs, healthKERI, Provenant, Kerion and a Cardano-related project. [presenter-reported] ## Related Key Event Receipt Infrastructure (KERI) specification and white paper; ACDC specification; CESR specification; Trust Spanning Protocol; PAC Theorem deck; Duplicity Evident Data (DICE 2024). ## Provenance Drafted by Claude on 2026-10-15 from the PDF in Smith's Papers repository: all 76 slide titles, slides 1-9, 17-20 and 28-46 read in full as extracted text. Not yet read by Mark.

Links from other tables