Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 20 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
A trust model where an Autonomic Identifier (AID) serves as the cryptographic root-of-trust, establishing verifiable control authority through self-certifying identifiers and key event logs without requiring external consensus mechanisms or trusted third parties.
An autonomic trust basis represents a fundamental approach to establishing trust in identifier systems where the root-of-trust derives directly from cryptographic self-certification rather than external authorities or distributed consensus. When an AID (Autonomic Identifier) functions as the root-of-trust, it creates what KERI terms an autonomic trust basis.
The term "autonomic" (from Greek auto-nomos, meaning self-rule) emphasizes that these identifiers are self-governing and self-managing. They establish trust through cryptographic binding between identifiers and controlling key pairs, without requiring permission from or coordination with external entities. This represents a distinct architectural choice in identifier system design that prioritizes cryptographic verifiability over organizational authority or network consensus.
An autonomic trust basis exhibits several essential characteristics:
When designing identifier systems, the choice of trust basis has profound architectural implications:
Autonomic trust basis supports various governance models through delegation:
Autonomic trust basis can be integrated with existing systems through:
Maintaining autonomic trust basis requires:
The concept of autonomic trust basis emerges from decades of evolution in cryptographic identifier systems and represents a synthesis of several foundational technologies:
The foundation lies in self-certifying identifiers (SCIDs), where identifiers are cryptographically derived from public keys through one-way hash functions. This approach, pioneered in systems like SDSI (Simple Distributed Security Infrastructure) and SPKI (Simple Public Key Infrastructure) in the 1990s, established that identifiers could carry their own cryptographic proof of authenticity.
Traditional SCIDs suffered from a critical limitation: they could not support secure key rotation. If a private key was compromised or needed replacement, the identifier itself had to change, breaking all existing references and relationships. This made SCIDs impractical for persistent identity use cases.
The development of certificate transparency systems demonstrated that append-only, cryptographically verifiable logs could provide strong security guarantees for key management. These systems showed that duplicity detection through log comparison could identify malicious behavior by certificate authorities.
KERI implements autonomic trust basis through Autonomic Identifiers (AIDs) that combine self-certifying properties with secure key management infrastructure. This approach addresses the historical limitations of SCIDs while maintaining their cryptographic security advantages.
The core innovation is the Key Event Log (KEL) - a cryptographically verifiable, append-only data structure that records all key management events for an identifier. Each KEL provides:
The KEL transforms a basic SCID into a persistent, manageable identifier while preserving the autonomic trust basis. The identifier remains cryptographically self-certifying, but now supports key rotation through cryptographic commitments to future keys.
KERI's pre-rotation mechanism is essential to maintaining autonomic trust during key changes. Each establishment event includes a cryptographic digest of the next rotation keys, creating a forward-blinded commitment. This approach:
While autonomic trust basis is self-contained, KERI optionally employs witnesses to enhance availability and provide additional security guarantees. Critically, witnesses do not become part of the trust basis itself - they provide:
The trust basis remains autonomic because validators can verify all cryptographic proofs independently. Witnesses enhance operational security but are not required for cryptographic verification.
KERI documentation explicitly contrasts autonomic trust basis with two other fundamental approaches:
An algorithmic trust basis relies on networks of nodes executing Byzantine fault tolerant distributed consensus algorithms as the root-of-trust. Examples include:
These systems achieve decentralization through distributed consensus but:
The algorithmic approach provides strong security but sacrifices portability and efficiency.
An administrative or organizational trust basis depends on trusted entities (certificate authorities, identity providers) to establish the root-of-trust. Traditional PKI systems like DNS/CA exemplify this model.
KERI documentation explicitly characterizes administrative trust basis as:
Historical security incidents (DigiNotar breach, Symantec certificate misissuance) demonstrate the vulnerabilities inherent in administrative trust models.
The autonomic approach provides several practical benefits:
Infrastructure Independence: Identifiers are not locked to any specific platform, blockchain, or service provider. The same AID can be used across different contexts without requiring permission or coordination.
Zero-Trust Architecture: Validators need not trust any intermediary infrastructure. All cryptographic proofs can be verified independently, enabling true zero-trust computing.
Performance and Cost: Cryptographic verification is computationally efficient compared to distributed consensus. No ongoing fees or participation in consensus mechanisms is required.
Scalability: Each identifier has its own independent KEL. There is no shared state that must be synchronized across a network, enabling horizontal scalability.
Post-Quantum Security: Pre-rotation commitments using cryptographic digests provide protection against future quantum computing threats without requiring quantum-resistant signature algorithms.
Verifiable Credentials: The GLEIF vLEI (verifiable Legal Entity Identifier) system uses autonomic trust basis to issue cryptographically verifiable credentials for legal entities. The trust chain begins with GLEIF's root AID and extends through delegated AIDs to individual credential issuers.
Supply Chain Provenance: Autonomic identifiers enable end-to-end verifiable supply chain tracking without requiring all participants to use the same blockchain or trust the same authorities.
IoT Device Identity: Devices can maintain persistent, verifiable identities across different networks and platforms without requiring centralized identity services.
Decentralized Applications: Applications can establish trust relationships directly between parties without requiring shared infrastructure or trusted intermediaries.
While autonomic trust basis provides strong security and decentralization properties, certain considerations apply:
Key Management Responsibility: Controllers bear full responsibility for protecting their private keys. Loss of keys means loss of control over the identifier (though pre-rotation provides recovery mechanisms for compromise scenarios).
Human Meaningfulness: Autonomic identifiers are cryptographic strings, not human-meaningful names. KERI addresses this through the aid|lid couplet model, where human-meaningful identifiers are authorized within an AID's trust domain.
Discovery: While autonomic identifiers are self-certifying, discovering the current key state requires access to the KEL. KERI uses OOBI (Out-Of-Band Introduction) for initial discovery and witness/watcher networks for ongoing availability.
Adoption Barriers: The autonomic model represents a paradigm shift from familiar centralized identity systems. Organizations accustomed to administrative control may find the self-sovereign nature challenging.
Autonomic trust basis does not exist in isolation but integrates with other trust mechanisms:
Delegation: AIDs support delegation, enabling hierarchical trust structures where a root AID delegates authority to other AIDs. This allows organizations to maintain centralized policy control while leveraging autonomic security.
Reputation Systems: While autonomic trust basis establishes attributional trust (cryptographic proof of authorship), it can be combined with reputational trust systems that track behavior over time.
Legal Frameworks: Systems like vLEI demonstrate how autonomic trust basis can integrate with legal identity frameworks, providing cryptographic verification while maintaining compliance with regulatory requirements.
The autonomic trust basis represents a fundamental architectural choice in the design of trust systems. By establishing trust through cryptographic self-certification rather than external authorities or consensus mechanisms, KERI enables a trust spanning layer for the internet - analogous to how IP serves as the spanning layer for network protocols.
This approach resolves the tension between security, decentralization, and usability that has plagued identifier systems. The aid|lid couplet model demonstrates that human-meaningful identifiers can be secured within autonomic trust domains, transcending the limitations of Zooko's triangle.
The autonomic trust basis thus provides the foundation for a new generation of identity and trust infrastructure that is simultaneously secure, decentralized, portable, and interoperable - properties essential for the future of digital trust systems.