GEDA (GLEIF External Delegated AID) is a KERI Autonomic Identifier delegated from the GLEIF Root AID, used by GLEIF to manage its relationship with and authorize Qualified vLEI Issuers (QVIs) within the vLEI ecosystem.
Related Concepts
No related concepts available
Comprehensive Explanation
GEDA (GLEIF External Delegated AID)
Official Definition
The GLEIF External Delegated AID (GEDA) is formally defined in the vLEI Ecosystem Governance Framework as a KERIAutonomic Identifier (AID) delegated from the GLEIF Root AID. GEDA serves as GLEIF's operational identity for issuing QVI credentials and establishing the chain of trust from the root to QVIs.
According to the GLEIF Identifier Governance Framework v1.0, GEDA is one of two primary delegated AIDs under the GLEIF Root AID, the other being GIDA (GLEIF Internal Delegated AID). While GIDA handles internal GLEIF operations, GEDA specifically manages external ecosystem relationships, particularly the authorization and oversight of Qualified vLEI Issuers.
The canonical abbreviation is GEDA, though it may also be referred to as the "GLEIF External Delegated Identifier" or "GLEIF External AID" in governance documents.
Governance Context
Position in vLEI Ecosystem Hierarchy
GEDA occupies a critical intermediate position in the vLEI trust hierarchy:
GLEIF Root AID (apex of trust)
|
├── GIDA (Internal Delegated AID)
└── GEDA (External Delegated AID)
|
└── QVI Delegated AIDs
|
└── Legal Entity vLEI Credentials
|
└── Role Credentials (OOR/ECR)
Implementation Notes
Operational Deployment
External GAR Coordination: GEDA operations require coordination among multiple External GARs who must maintain secure key stores and participate in multisig ceremonies. Organizations implementing GEDA must establish clear procedures for GAR authentication, challenge-response protocols, and threshold signing coordination.
Witness Pool Management: GEDA's witness pool should be geographically distributed across multiple regions (EU, NA, AS, OC) to provide resilience against regional failures. Witness selection should prioritize independence, reliability, and compliance with GLEIF's security standards.
QVI Delegation Workflow: The QVI delegation approval process requires careful coordination between QVI participants and External GARs. Organizations should implement automated tooling to validate QVI inception configurations against governance requirements before GAR approval.
Credential Registry Maintenance: GEDA's credential registry (TEL) must be continuously available for verifiers. Implementations should include redundancy, backup procedures, and monitoring to ensure registry availability meets ecosystem SLA requirements.
Version Management: GEDA implementations must support KERI specification version upgrades within the 18-month backward compatibility window and 12-month implementation period. Organizations should plan upgrade cycles to maintain ecosystem interoperability.
Security Considerations
Key Compromise Recovery: GEDA's pre-rotation mechanism enables recovery from key compromise without breaking the chain of trust. Organizations should maintain secure storage of pre-rotated keys separate from current signing keys, with highest level protection (HSM or equivalent).
Multisig Threshold Selection: The multisig threshold for GEDA should balance security (requiring multiple GAR signatures) with operational efficiency (avoiding excessive coordination overhead). A 2-of-3 or 3-of-5 configuration is typical for production deployments.
Witness Pool Security: Witness compromise does not directly compromise GEDA's keys, but can enable duplicity attacks. Organizations should monitor witness behavior, implement witness rotation procedures, and maintain sufficient witness pool size to tolerate Byzantine faults.
Audit and Monitoring: All GEDA operations should be logged and monitored for anomalous behavior. Implementations should include alerting for unusual patterns such as unexpected credential issuance, revocation events, or key rotation attempts.
This hierarchical structure implements a tree of trust where:
The GLEIF Root AID provides the ultimate cryptographic root of trust
GEDA extends this trust to external ecosystem participants
QVI AIDs are delegated from GEDA, inheriting its trust authority
Legal Entity credentials are issued by QVIs under GEDA's delegated authority
GLEIF's Dual AID Architecture
GLEIF maintains a separation of concerns through its dual delegated AID structure:
GEDA (External):
Manages relationships with QVIs
Issues QVI vLEI Credentials
Approves QVI delegated AID inception events
Oversees QVI qualification and termination
Handles ecosystem-facing governance operations
GIDA (Internal):
Manages GLEIF's internal operations
Issues credentials for GLEIF staff and systems
Handles internal administrative functions
Maintains separation from external ecosystem operations
This architectural separation ensures that compromise of internal systems does not directly affect external ecosystem trust, and vice versa. It also enables different security policies and operational procedures for internal versus external operations.
Relationship to GLEIF Root AID
GEDA is cryptographically bound to the GLEIF Root AID through KERI's delegation mechanism. According to the governance framework:
Cryptographic Seal: The GLEIF Root AID creates a cryptographic seal of GEDA's inception event
Cooperative Delegation: Both the delegator (GLEIF Root) and delegate (GEDA) must contribute to the delegation
Verifiable Chain: Any verifier can cryptographically trace GEDA's authority back to the GLEIF Root AID
This delegation structure provides end-to-end verifiability of GEDA's authority without requiring centralized registries or certificate authorities.
Roles & Responsibilities
Primary Responsibilities
GEDA serves as GLEIF's operational identity for QVI management, with the following core responsibilities:
1. QVI Credential Issuance
GEDA is the issuer of QVI vLEI Credentials, which authorize organizations to act as Qualified vLEI Issuers. According to the Qualified vLEI Issuer vLEI Credential Governance Framework, GEDA:
Issues QVI credentials to organizations that have completed the vLEI Issuer Qualification Program
Embeds the QVI's LEI (Legal Entity Identifier) in the credential
Specifies a 90-day grace period to manage QVI transitions
Maintains the credential's lifecycle through issuance, verification, and revocation
2. QVI Delegated AID Approval
GEDA must approve the inception of QVI delegated AIDs through a formal delegation ceremony. The technical documentation "Approving QVI Inception Events" specifies that: