notes: research/papers/why-x509-certs-should-be-secondary-evidence

This data as json

path title type status classification words body
research/papers/why-x509-certs-should-be-secondary-evidence Why X509 Certs Should Be Secondary Evidence of Org Identity summary v0.1 — 2026-10-14: drafted by Claude from the web page (full text); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 465 # Why X509 Certs Should Be Secondary Evidence of Org Identity **Abstract.** A position paper by Daniel Hardman arguing that X.509 certificates should be secondary, not primary, evidence of an organization's identity, with ACDCs (Authentic Chained Data Containers) such as vLEIs carrying the primary weight. It works through mismatched lifespans, opaque governance, the post-quantum path, single-key signing, missing pre-rotation, unsequenced signatures, maintenance, revocation and scale. For practitioners choosing evidence for organizational identity. ## Summary The paper accepts that X.509 certificates and PKI (Public Key Infrastructure) have secured the web well, and says it is not a rejection of certificates. Its argument is that they are the wrong primary evidence of an organization's identity: ACDCs (Authentic Chained Data Containers), such as vLEIs (verifiable Legal Entity Identifiers), should carry that weight, with certificates in a supporting role. The body is a list of mismatches, one per section. Lifespans don't match: an organization gets a legal identity once, while certificate lifetimes shrink toward weeks; "Dynamic privilege is not stable identity." Governance is opaque, centralized and inconsistent: a certificate rests on one secret whose creation and custody are hard to audit. The path to post-quantum is slow across the certificate ecosystem. One key isn't realistic, since organizations approve important acts with several people, which calls for weighted multisignature. Pre-rotation is missing, so continuity across a key change rests on a CA's assertion. Signatures aren't sequenced, which weakens audit trails. Maintenance is hard to do well, with outages from expired certificates. Revocation is disincented when frequent expiry seems to do the job. Scale and performance are constrained if millions of organizations each manage certificates through third parties. The last section, Much better alternatives exist, considers DIDs (decentralized identifiers) and verifiable credentials and finds gaps in issuer key rotation and governance, then presents ACDCs issued by KERI (Key Event Receipt Infrastructure) autonomic identifiers (AIDs) as addressing them: pre-rotation, weighted multisignature, witnesses, a post-quantum upgrade path, and no blockchain requirement. The paper mentions STIR/SHAKEN as a setting where certificate-based identity is used today. ## Key terms X.509, PKI, certificate authority, ACDC, vLEI, autonomic identifier (AID), pre-rotation, weighted multisig, revocation, post-quantum ## Claims and their evidence - Certificates suit short-lived privileges, not stable organizational identity [informative] - Certificate security depends on a single secret whose management is hard to audit [informative] - Short certificate lifetimes can discourage timely revocation (worked example in the paper) [informative] - ACDCs with KERI AIDs provide pre-rotation, multisig and a post-quantum path without a blockchain [informative] - Early testing suggests post-quantum signatures can slow TLS handshakes [unverified] ## Related - Trust with KERI, X.509, and CT (keri.one title) - Why Anchored Signatures? - ACDC specification ## Provenance Drafted by Claude on 2026-10-14 from the web page at dhh1128.github.io, read in full as text. Not yet read by Mark.

Links from other tables