Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 176 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
In KERI, 'authoritative' refers to cryptographically verified control authority over an identifier that has been attested to its root-of-trust, making the identifier accurate, renowned, and respectable. This term also applies to PKI key pairs that possess this verified control property.
The concept of authoritative in KERI represents a fundamental shift from administrative trust models to cryptographic verification of control authority. An identifier or key pair is considered authoritative when:
This concept is distinct from mere authentication or authorization. While authentication proves identity and authorization grants permissions, being authoritative means the identifier has achieved a verified state of control that can be independently validated by any party through cryptographic means.
KERI's approach to authoritative identifiers is built on a hierarchical framework called the Four A's of Secure Data Control:
This framework establishes that being authoritative is the culmination of the other three properties. An identifier must first have an author (creator), be authentic (cryptographically verifiable), and be authorized (have proper consent/control) before it can be considered authoritative.
Implementations must maintain the complete KEL to determine authoritative key state at any point in time. This requires:
To leverage witness attestation for authoritative status:
For delegated identifiers:
When verifying historical authoritative statements:
Implementations must detect when authoritative status is compromised:
Cryptographic Verifiability: Authoritative status is not asserted but proven through cryptographic verification chains. Any party can independently verify the authoritative nature of an identifier by examining its key event log (KEL) and validating signatures back to the inception event.
Root-of-Trust Anchoring: The verification must trace to a cryptographic root-of-trust, typically the inception event of an AID where the identifier is first bound to its controlling key pairs. This root provides the foundation for all subsequent authoritative statements.
Temporal Validity: Authoritative key pairs are those that were valid at the time a statement was made. KERI's key event logs enable validators to determine which keys were authoritative at any point in the identifier's history, even after key rotations.
Traditional identity systems rely on administrative authority where trusted third parties (certificate authorities, identity providers, registrars) assert the authoritative nature of identifiers. This creates several problems:
Centralization: Authority is concentrated in organizations that must be universally trusted
Revocation Challenges: When authority is compromised, revocation mechanisms are complex and often ineffective
Portability Issues: Identifiers are locked to specific administrative domains and cannot be transferred
Trust Assumptions: Validators must trust the administrative processes of the authority rather than being able to verify independently
In traditional PKI systems, a certificate authority's signature makes a public key "authoritative" for a domain. However, this authority is only as strong as the CA's security practices and the trust placed in it by validators. The 2011 DigiNotar breach demonstrated how compromised CAs can issue fraudulent but technically "authoritative" certificates.
KERI establishes authoritative control through self-certifying identifiers (SCIDs) that are cryptographically derived from their controlling key pairs. The identifier itself proves its binding to specific keys through one-way cryptographic functions, eliminating the need for external authorities to assert this relationship.
Inception Event: The inception event creates the authoritative binding between an AID and its initial key pairs. This event is self-contained and self-verifying—anyone with the inception event can verify that the identifier was correctly derived from the specified keys.
Key Event Log: The KEL maintains a complete, verifiable history of all authoritative key state changes. Each event is signed by the currently authoritative keys and includes commitments to future keys through pre-rotation, creating an unbroken chain of authoritative control.
In KERI, authoritative key pairs are those that have current signing authority over an identifier. The KEL explicitly tracks which keys are authoritative at any point in time:
Current Keys: The keys listed in the most recent establishment event (inception or rotation) that have signing authority for non-establishment events
Pre-rotated Keys: The next keys committed to via cryptographic digests in the current establishment event, which will become authoritative upon the next rotation
Historical Keys: Previous keys that were authoritative but have been rotated out, which remain important for verifying historical statements
When an identifier makes a statement (issues a credential, signs a message, anchors data), that statement is authoritative if:
This creates non-repudiable authoritative statements where the controller cannot deny having made the statement, and validators can independently verify the statement's authority.
KERI extends the concept of authoritative through witness attestation. Witnesses observe and sign key events, providing additional evidence of the authoritative key state. When a sufficient threshold of witnesses attest to an event, it strengthens the authoritative nature of that event by providing distributed consensus.
The threshold of accountable duplicity (TOAD) defines how many witness attestations are required for an event to be considered authoritatively witnessed. This creates a graduated model where authority increases with witness participation.
A critical aspect of KERI's authoritative model is duplicity detection. If a controller attempts to create conflicting authoritative statements (by signing different events with the same keys), this duplicity becomes evident to validators. The detection of duplicity undermines the authoritative nature of the identifier, as it demonstrates the controller is not acting in good faith.
When a QVI (Qualified vLEI Issuer) issues a Legal Entity credential, the credential is authoritative because:
Validators can independently verify this authority chain without contacting GLEIF or the QVI.
When keys are rotated, authority transfers from the old keys to the new keys. The rotation event itself must be signed by the currently authoritative keys, and it establishes the new keys as authoritative going forward. Pre-rotation ensures this transfer is secure even if the old keys are compromised.
For multi-signature AIDs, authority is distributed among multiple key holders. The signing threshold defines how many authoritative signatures are required for a statement to be authoritative. This enables organizational governance where multiple parties must cooperate to make authoritative statements.
KERI's cooperative delegation creates hierarchies of authoritative identifiers. A delegated AID derives its authority from its delegator, creating a chain of authority. The GLEIF vLEI ecosystem demonstrates this with:
Each level's authority can be verified by tracing the delegation chain back to the root.
Because KELs maintain complete history, validators can verify whether keys were authoritative at any point in time. This is crucial for:
While KERI provides cryptographic authority, the "renowned, honorable, and respected" aspects come from governance frameworks and reputation systems built on top of KERI. The vLEI ecosystem combines:
This creates a comprehensive authoritative system where technical, governance, and legal authority reinforce each other.
Key Management: Maintaining authoritative control requires secure key management. Compromised keys can be rotated out, but any statements made while they were authoritative remain valid.
Witness Selection: Choosing reliable witnesses strengthens the authoritative nature of an identifier by providing distributed attestation.
Escrow Handling: Out-of-order events must be properly escrowed and processed to maintain the authoritative event sequence.
Duplicity Monitoring: Watchers and validators must actively monitor for duplicity to detect when authority is being abused.
The concept of authoritative in KERI represents a fundamental reimagining of how digital authority is established and verified, moving from trust in institutions to trust in cryptographic verification while maintaining the governance and reputation aspects that make authority meaningful in real-world contexts.