Self-Certifying Identifier Limitations

Basic self-certifying identifiers (SCIDs) are fundamentally ephemeral because they lack key rotation support. The KERI specification explicitly notes: "If the controlling private key becomes weakened or compromised through exposure, the SCID must be completely abandoned." This ephemeral nature distinguishes basic SCIDs from KERI's more sophisticated Autonomic Identifiers (AIDs), which support persistent control through key rotation mechanisms.

Witness Infrastructure

KERI witnesses often use non-transferable (ephemeral) AIDs for their own identifiers. Rather than relying on individual key rotation, witness security comes from pool-based threshold structures. This design choice reflects that witness identifiers serve infrastructure roles rather than persistent identity needs.

Privacy and Unlinkability

Ephemeral identifiers serve critical privacy functions by enabling:

• Contextual isolation: Different identifiers for different interactions prevent cross-context correlation
• Temporal unlinkability: Short-lived identifiers cannot be tracked over time
• Minimal exposure: Reduced attack surface through limited identifier lifespan

The SPAC (Secure Privacy, Authenticity, and Confidentiality) framework recognizes ephemeral identifiers as a key privacy mechanism, though it notes that privacy protection is a "hot war" requiring ongoing tactical adaptation.

Use Cases

Appropriate scenarios for ephemeral identifiers:

• Temporary authentication sessions
• One-time authorization tokens
• Peer-to-peer ephemeral connections
• Disposable service endpoints
• Short-lived delegation contexts
• Privacy-preserving credential presentations where persistent correlation is undesirable

Inappropriate scenarios:

• Long-term organizational identity
• Persistent credential issuance authority
• Scenarios requiring key compromise recovery
• Applications needing verifiable history over extended periods

Related Terms

• Non-transferable identifier: The primary KERI primitive for ephemeral identity
• Transferable identifier: The persistent alternative supporting key rotation
• Key rotation: The mechanism ephemeral identifiers lack
• Autonomic Identifier (AID): Can be either ephemeral or persistent depending on configuration
• Witness: Infrastructure component often using ephemeral identifiers
• Privacy: Ephemeral identifiers as a privacy-preserving mechanism