Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 197 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
Decentralized identity is a cryptographic technology that enables individuals and organizations to create and control their own unique identifiers, obtain verifiable credentials from trusted organizations, and present elements of these credentials as proof of claims without requiring centralized service providers or intermediaries.
Decentralized identity represents a fundamental paradigm shift in how digital identity is established, managed, and verified. At its core, decentralized identity is a technology framework that enables individual control over identifiers and credentials through cryptographic mechanisms rather than centralized authorities. This approach transfers ownership of identity from service providers to individuals, allowing them to create unique identifiers, acquire verifiable credentials from trusted organizations, and selectively disclose credential elements as proof of claims—all without ceding control to centralized intermediaries.
The key properties that distinguish decentralized identity include:
The scope of decentralized identity extends beyond simple authentication to encompass the entire lifecycle of identity management: identifier creation, credential issuance, presentation, verification, and revocation. This comprehensive approach addresses fundamental limitations in traditional identity systems where centralized providers control user data, create correlation risks, and establish single points of failure.
Decentralized identity requires governance frameworks that address:
Trust Registries: Mechanisms for discovering and verifying which issuers are authorized to issue specific credential types within a trust community
Schema Management: Processes for defining, versioning, and evolving credential schemas in a decentralized manner
Dispute Resolution: Procedures for handling conflicts and disputes without centralized arbitration authorities
Regulatory Compliance: Approaches for meeting regulatory requirements (KYC, AML, data protection) while preserving decentralization
Successful decentralized identity deployment requires:
Custodial Options: Providing managed services for users who prefer not to manage keys directly, while preserving ultimate user control through rotation authority
Progressive Disclosure: Implementing graduated disclosure mechanisms that reveal information progressively as trust relationships develop
Interoperability: Supporting multiple DID methods and credential formats to enable ecosystem growth
User Experience: Abstracting cryptographic complexity through intuitive interfaces while maintaining security properties
Decentralized identity security depends on:
Key Management: Protecting private keys through hardware security modules, secure enclaves, or distributed key generation
Duplicity Detection: Implementing mechanisms to detect and respond to inconsistent identifier histories
Witness Selection: Choosing diverse, independent witnesses to prevent collusion
Recovery Mechanisms: Designing key recovery approaches that balance security and usability
The concept of decentralized identity emerged from decades of work in cryptography, distributed systems, and digital identity. Traditional identity systems relied on administrative trust bases—centralized authorities like Certificate Authorities in PKI systems or identity providers like Facebook and Google in federated identity models. These systems created inherent vulnerabilities: centralized databases became attractive targets for attackers, service providers could track user behavior across contexts, and users had no recourse if providers failed or acted maliciously.
The Self-Sovereign Identity (SSI) movement, formally articulated by Christopher Allen in 2016 through his "Ten Principles of Self-Sovereign Identity," provided philosophical foundations for decentralized approaches. Allen's principles emphasized user control, portability, consent, and minimization—concepts that directly challenged centralized identity architectures.
Blockchain technology catalyzed practical implementations of decentralized identity by providing distributed ledgers that could anchor identifiers without centralized registries. Early blockchain-based DID methods demonstrated that identifiers could be created and resolved without traditional DNS or certificate authority infrastructure. However, these approaches introduced new challenges: blockchain dependency created vendor lock-in, transaction costs limited scalability, and ledger immutability conflicted with privacy regulations like GDPR.
The W3C Decentralized Identifiers (DIDs) specification, developed starting in 2016, established standardized syntax and resolution mechanisms for decentralized identifiers. This specification defined DIDs as URIs that refer to subjects (persons, organizations, things, data models, or abstract entities) as determined by the controller, with DID Documents providing cryptographic material and service endpoints for verification. The W3C Verifiable Credentials specification complemented DIDs by standardizing credential formats that are cryptographically secure, privacy-respecting, and machine-verifiable.
KERI (Key Event Receipt Infrastructure) represents a fundamental advancement in decentralized identity by solving critical problems that plagued earlier approaches. KERI's innovation centers on autonomic identifiers (AIDs)—self-managing, self-certifying identifiers that achieve true decentralization without blockchain dependency.
KERI establishes what it terms an autonomic trust basis that differs fundamentally from both administrative (centralized) and algorithmic (blockchain) trust models. In KERI's architecture:
This autonomic approach means that KERI identifiers are truly portable—they can be moved between different infrastructure providers, anchored to different ledgers, or operated entirely off-ledger without losing verifiability. This portability addresses a critical limitation of blockchain-based DIDs, which lock identifiers to specific ledgers.
KERI's conceptual framework makes a crucial distinction: decentralization is about control authority, not spatial distribution. A system can be:
This distinction clarifies that KERI's security derives from cryptographic verification of control authority rather than from geographic distribution of infrastructure. Multiple entities providing or controlling infrastructure makes it decentralized, regardless of physical topology.
KERI achieves end-verifiability—any party can independently verify the authenticity and current key state of an identifier by processing its KEL without requiring trust in intermediary infrastructure. This property eliminates the need for trusted third parties in the verification chain, enabling truly decentralized trust.
The duplicity detection mechanisms in KERI provide ambient verifiability: any inconsistency in key event histories becomes evident to any observer, creating strong disincentives for malicious behavior. This approach transforms security from preventing attacks to making attacks evident and attributable.
KERI's Authentic Chained Data Containers (ACDCs) extend decentralized identity to verifiable credentials with advanced privacy features:
ACDCs leverage KERI's cryptographic foundations to provide credentials that are simultaneously verifiable, privacy-preserving, and portable across contexts.
Decentralized identity enables transformative applications across multiple domains:
Organizational Identity: The GLEIF vLEI (verifiable Legal Entity Identifier) ecosystem demonstrates decentralized identity at organizational scale. Legal entities receive verifiable credentials anchored to their LEI codes, enabling cryptographically verifiable organizational identity for:
Individual Identity: Personal identity credentials enable:
IoT and Machine Identity: Decentralized identity extends to devices and autonomous systems:
Decentralized identity provides concrete advantages over centralized approaches:
User Control: Individuals and organizations maintain direct control over their identifiers and credentials without intermediary gatekeepers. This control includes the ability to:
Privacy Preservation: Cryptographic techniques enable:
Security Enhancement: Decentralized architecture eliminates:
Interoperability: Standards-based approaches enable:
Decentralized identity introduces new considerations:
Complexity: Users must understand concepts like key management, credential presentation, and selective disclosure. While tools can abstract complexity, the underlying model requires more sophisticated mental models than username/password systems.
Recovery Challenges: Self-sovereign control means users bear responsibility for key backup and recovery. Lost keys can mean permanently lost access, requiring careful design of recovery mechanisms that balance security and usability.
Adoption Barriers: Network effects favor existing centralized systems. Decentralized identity requires critical mass of issuers, holders, and verifiers to achieve utility, creating chicken-and-egg adoption challenges.
Governance Complexity: Decentralized systems require new governance models for:
Performance Considerations: Cryptographic operations and distributed verification introduce latency compared to centralized database lookups, though KERI's design minimizes these costs through efficient algorithms and caching strategies.
Despite these trade-offs, decentralized identity represents a fundamental improvement in digital identity architecture, enabling user sovereignty, privacy preservation, and security enhancement that centralized systems cannot achieve. KERI's approach addresses many practical challenges through its autonomic trust basis, end-verifiability, and portability, making decentralized identity viable for production deployment at scale.