Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 188 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
Authenticity is the quality of having an objectively verifiable origin, established through cryptographic proofs that demonstrate who created or authorized data, distinct from veracity (truthfulness of content). In KERI, authenticity is achieved through self-certifying identifiers, digital signatures, and verifiable key event logs that enable end-to-end verification without trusted intermediaries.
Authenticity represents the property of having an objectively verifiable origin—the ability to cryptographically prove that data, messages, or credentials originated from a specific source and have not been tampered with since creation. This concept is fundamentally distinct from veracity (truthfulness): a newspaper story may be authentic (verifiably published by that newspaper) without being true (the reported events may not have occurred as described).
In digital identity systems, authenticity encompasses three critical properties:
Authenticity is strongly related to digital security and should ideally be verifiable to a root-of-trust. The future vision is the Authentic Web—an internet where all data carries verifiable proof-of-authorship.
Authenticity exists within a security overlay properties trilemma that constrains all identifier systems. The PAC Theorem states that a communication system can achieve any two of three properties at the highest level, but not all three simultaneously:
Implementing authenticity verification in KERI requires:
Key Management: Authenticity depends entirely on private key security. Implement:
Duplicity Detection: Always check for conflicting KELs from multiple sources. A single KEL copy is insufficient—compare against witness receipts and watcher copies to detect duplicitous behavior.
Timestamp Validation: For time-sensitive authenticity (e.g., credential expiration), verify:
Caching: Cache verified KEL states to avoid repeated verification. Invalidate cache on:
Batch Verification: When verifying multiple signatures from the same AID, resolve key state once and reuse for all signatures from the same key state period.
Incremental Verification: For long KELs, implement checkpointing where verified state up to a certain sequence number is cached, and only new events are verified incrementally.
Authenticity provides cryptographic proof of origin, but governance frameworks establish:
This trilemma arises because no single cryptographic operation can provide all three properties. Systems must layer multiple operations, and these layers inherently introduce weaknesses. The Trust over IP (ToIP) design goals establish a clear priority ordering:
This prioritization reflects KERI's architectural philosophy: cryptographic verifiability and secure attribution are prerequisites for any meaningful privacy guarantees. You cannot have reputation without attributional trust—authenticity forms the foundation upon which other security properties are built.
Traditional approaches to authenticity have relied on centralized trust models:
Certificate Authority (CA) Model: X.509 certificates establish authenticity through hierarchical trust chains. A root CA vouches for intermediate CAs, which vouch for end-entity certificates. This model suffers from:
Web of Trust (PGP): Decentralized peer-to-peer validation where users sign each other's public keys. While eliminating central authorities, this approach faces:
Blockchain-based Systems: Distributed ledgers provide algorithmic consensus for authenticity. However:
These traditional models share a common limitation: they require external infrastructure or authorities to establish authenticity, creating dependencies that compromise true self-sovereignty.
KERI provides autonomic authenticity—self-certifying, cryptographically verifiable proof-of-authorship that requires no external authorities. This is achieved through several integrated mechanisms:
KERI's autonomic identifiers (AIDs) are self-certifying: the identifier itself is cryptographically derived from the controller's public key(s). Any non-repudiable signature made with the corresponding private key can be verified by extracting the public key from the identifier or its inception information. This creates an intrinsic binding between identifier and cryptographic authority.
Unlike basic SCIDs (which are ephemeral and cannot rotate keys), KERI AIDs support key rotation through pre-rotation mechanisms, enabling persistent control despite key compromise.
The KEL is an append-only, cryptographically-chained log of all key events for an AID. Each event is signed by the current authoritative keys, and events are linked through cryptographic digests. The KEL provides:
The KEL serves as the authoritative source for establishing control authority over an AID, creating a verifiable chain from any current operation back to the inception event.
KERI uses Ed25519 signatures with SUF-CMA (Strong Unforgeability under Chosen Message Attack) properties. Every message includes:
Because the payload includes the identifier, the signature creates a non-repudiable cryptographic commitment to both the source identifier and the data. This dual binding ensures:
ACDCs extend authenticity to verifiable credentials through:
Self-Addressing Identifiers (SAIDs): Each ACDC section has a SAID—a cryptographic digest that is both content-addressable and self-referential. The SAID is embedded within the data it identifies, creating tamper-evident binding.
Cryptographic Chaining: ACDCs form directed acyclic graphs (DAGs) where credentials reference other credentials through SAIDs. This creates verifiable provenance chains showing the complete chain-of-custody for data.
KEL Anchoring: ACDC SAIDs are anchored in the issuer's KEL through cryptographic seals. This binds the credential to the issuer's key state, enabling verification even after key rotation. The credential's authenticity is verified by:
ACDCs support graduated disclosure—progressive revelation of credential information while maintaining authenticity:
Crucially, authenticity is preserved across all disclosure levels. A signature on the compact form commits to the entire credential structure through the SAID mechanism. Recipients can verify authenticity without seeing all content, and later expansions can be verified against the original commitment.
Supply Chain Provenance: ACDCs enable authentic data supply chains where each transformation, aggregation, or transfer is cryptographically signed. The complete chain-of-custody is verifiable from raw materials to finished products, with each participant's authenticity independently verifiable through their KEL.
Verifiable Legal Entity Identifiers (vLEIs): GLEIF issues vLEI credentials to legal entities, with authenticity established through:
Regulatory Compliance: Organizations can submit cryptographically signed documents where authenticity is verifiable to the submitter's AID. Regulators can independently verify:
Decentralized Reputation Systems: Authenticity enables verifiable reputation where attestations are cryptographically bound to their issuers. Reputation scores can be computed from authentic attestations without trusting aggregators.
No Trusted Intermediaries: KERI's authenticity model eliminates dependence on certificate authorities, blockchain consensus, or other external trust infrastructure. Verification is purely cryptographic and end-to-end.
Portability: AIDs and their authenticity proofs are portable across platforms, networks, and jurisdictions. The KEL provides the complete verification context without requiring access to specific infrastructure.
Scalability: Verification is computationally efficient (signature verification and hash computation). No network consensus or distributed coordination required for authenticity checks.
Post-Quantum Security: KERI's pre-rotation mechanism provides protection against quantum computing attacks on current cryptographic algorithms. Even if an attacker breaks current signatures, they cannot forge future rotations without the pre-rotated keys.
Ambient Verifiability: Anyone with access to a KEL can verify authenticity at any time, anywhere. This enables "trust but verify" architectures where participants can independently audit authenticity claims.
Privacy Constraints: The PAC trilemma means maximizing authenticity constrains privacy. Cryptographic signatures create correlation points—multiple signatures from the same AID are linkable. KERI addresses this through:
Key Management Burden: Authenticity depends on secure key management. Controllers must:
Verification Complexity: While cryptographic verification is efficient, the complete verification workflow requires:
KERI provides infrastructure (witnesses, watchers) to support this, but it adds operational complexity compared to simple username/password systems.
Authenticity ≠ Veracity: KERI proves who said what, not whether what was said is true. Establishing veracity requires:
The vLEI ecosystem demonstrates this: GLEIF's governance framework establishes processes for verifying legal entity information, while KERI provides the cryptographic infrastructure for authentic credential issuance.
KERI's ultimate goal is the Authentic Web—an internet where all data has verifiable proof-of-authorship. This vision requires:
Signed at Rest: Data never discards its signatures. Traditional approaches use "signed in motion" (TLS) where signatures are ephemeral. The Authentic Web requires persistent signatures enabling future verification.
Key State at Rest: KERI solves the "hard problem" of maintaining verifiable key state over time. KELs provide persistent, verifiable records of key authority without requiring continuous reconstruction.
Scalable Verification: The Authentic Web must support:
KERI's architecture—self-certifying identifiers, append-only KELs, SAID-based ACDCs—provides the foundational infrastructure for realizing this vision of universal, verifiable authenticity across the internet.
The vLEI ecosystem demonstrates this integration: KERI provides authenticity infrastructure while GLEIF governance establishes trust policies and accountability mechanisms.