Every credential issuance creates a corresponding TEL event with state transition:

NULL → issued

TEL Event Structure:
{
  "v": "KERI10JSON00011c_",
  "t": "iss",  // Issuance event type
  "d": "ELvaU6Z-i0d8JJR2nmwyYAZAoTNZH3UfSVPzhzS6b5CM",
  "i": "EAoTNZH3UfSVPzhzS6b5CMZAoTNZH3UfSVPzhzS6b5CM",
  "s": "0",
  "ri": "EGUPiCVO73M9worPwR3PfThAtC0AJnH5ZgwsXf6TzbVK",
  "ra": {
    "d": "EBdXt3gIXOf2BBWNHdSXCJnFJL5OuQPyM5K0neuniccM"
  }
}

IPEX Protocol Flow for Issuance

The complete issuance workflow follows this message sequence:

Issuer                    Holder
  |                         |
  |--- IPEX Grant --------->|
  |    (credential offer)   |
  |                         |
  |<-- IPEX Admit ----------|
  |    (acceptance)         |
  |                         |
  |--- TEL Anchor -------->|
  |    (registry update)    |

IPEX Grant Message Structure:

{
  "v": "KERI10JSON000260_",
  "t": "exn",
  "d": "ELvaU6Z-i0d8JJR2nmwyYAZAoTNZH3UfSVPzhzS6b5CM",
  "i": "EAoTNZH3UfSVPzhzS6b5CMZAoTNZH3UfSVPzhzS6b5CM",
  "p": "",
  "dt": "2023-08-19T17:30:00.000000+00:00",
  "r": "/ipex/grant",
  "q": {},
  "a": {
    "m": "",
    "i": "EKxy2sgzfplyr-tgwIxS19f2OchFHtLwPWD3v4oYimBx",
    "acdc": "<ACDC_CREDENTIAL_OBJECT>"
  }
}

Cryptographic Foundation

Digital Signature Requirements

All credential issuance MUST use Ed25519 signatures with CESR encoding:

Signature Generation:
1. ACDC_bytes = CESR_encode(ACDC_object)
2. digest = Blake3-256(ACDC_bytes)
3. signature = Ed25519_sign(issuer_private_key, digest)
4. CESR_signature = CESR_encode(signature, "0B")  // Ed25519 signature code

Signature Verification:
1. CESR_decode(signature) → raw_signature
2. Ed25519_verify(issuer_public_key, digest, raw_signature) → boolean

SAID (Self-Addressing Identifier) Generation

Every ACDC requires cryptographic self-addressing:

def generate_SAID(acdc_dict):
    # Remove existing 'd' field for calculation
    temp_dict = acdc_dict.copy()
    temp_dict['d'] = ''
    
    # Serialize with consistent ordering
    serialized = json.dumps(temp_dict, separators=(',', ':'), sort_keys=True)
    
    # Generate Blake3-256 digest
    digest = blake3.blake3(serialized.encode('utf-8')).digest()
    
    # CESR encode with Blake3-256 code 'E'
    said = 'E' + base64.urlsafe_b64encode(digest).decode('ascii').rstrip('=')
    
    return said

Registry Anchoring Cryptography

TEL events are cryptographically anchored to the issuer's KEL through Event Source Seals:

{
  "s": "3",  // KEL sequence number
  "d": "ELvaU6Z-i0d8JJR2nmwyYAZAoTNZH3UfSVPzhzS6b5CM"  // TEL event digest
}

The KEL interaction event includes this seal in its anchors section, creating cryptographic binding between credential issuance and issuer's key state.

Implementation Specifications

KERIpy Implementation

The reference implementation in KERIpy provides the Credentialer class:

class Credentialer:
    def __init__(self, hby, rgy, verifier):
        self.hby = hby  # Habery (keystore)
        self.rgy = rgy  # Registry
        self.verifier = verifier
    
    def issue(self, issuer, registry, schema, data, recipient=None):
        # 1. Validate schema compliance
        self._validate_schema(schema, data)
        
        # 2. Generate ACDC structure
        acdc = self._build_acdc(issuer, registry, schema, data, recipient)
        
        # 3. Generate SAID
        acdc['d'] = self._generate_said(acdc)
        
        # 4. Create TEL issuance event
        tel_event = self._create_tel_event(acdc, registry)
        
        # 5. Anchor to KEL
        self._anchor_to_kel(issuer, tel_event)
        
        # 6. Sign ACDC
        signature = self._sign_acdc(issuer, acdc)
        
        return acdc, signature

KERIA Agent API

The KERIA agent exposes RESTful endpoints for credential issuance:

POST /identifiers/{aid}/credentials
Content-Type: application/json

{
  "registry": "EGUPiCVO73M9worPwR3PfThAtC0AJnH5ZgwsXf6TzbVK",
  "schema": "ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY",
  "recipient": "EKxy2sgzfplyr-tgwIxS19f2OchFHtLwPWD3v4oYimBx",
  "data": {
    "LEI": "5493001KJTIIGC8Y1R17",
    "legalName": "Example Corporation"
  }
}

Response: 202 Accepted
{
  "d": "EBdXt3gIXOf2BBWNHdSXCJnFJL5OuQPyM5K0neuniccM",
  "credential": { /* ACDC object */ },
  "signature": "0BDKrANtOpUKuC9AZhxzfCc991iuG1bWmIeHDjk2PTwmvVdwNAg2XgXqeqBBps_6jdEu1IR3GrfyLRnyB7E0D5Cw"
}

SignifyTS Client Integration

interface CredentialIssuanceArgs {
  registryId: string;
  schemaId: string;
  recipient?: string;
  data: Record<string, any>;
  timestamp?: string;
}

class SignifyClient {
  async issueCredential(aid: string, args: CredentialIssuanceArgs): Promise<Credential> {
    const response = await this.client.post(
      `/identifiers/${aid}/credentials`,
      {
        registry: args.registryId,
        schema: args.schemaId,
        recipient: args.recipient,
        data: args.data,
        dt: args.timestamp || new Date().toISOString()
      }
    );
    
    return new Credential(response.data.credential, response.data.signature);
  }
}

Technical Relationships

Schema Resolution Dependencies

Credential issuance requires prior schema OOBI resolution:

Schema OOBI: http://schema-server:7723/oobi/ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY

Resolution Process:
1. HTTP GET to schema OOBI URL
2. Retrieve JSON Schema definition
3. Validate schema SAID matches expected value
4. Cache schema for credential validation

Registry Lifecycle Integration

Credential registries must be created before issuance:

# Registry inception
registry_event = {
    "v": "KERI10JSON00011c_",
    "t": "vcp",  # Registry inception
    "d": "EGUPiCVO73M9worPwR3PfThAtC0AJnH5ZgwsXf6TzbVK",
    "i": "EGUPiCVO73M9worPwR3PfThAtC0AJnH5ZgwsXf6TzbVK",
    "s": "0",
    "c": ["NB"],  # No backers configuration
    "bt": "0",   # Backer threshold
    "b": []      # Backer list (empty for NB config)
}

Witness Network Coordination

Issuance events require witness receipts for availability:

Witness Receipt Structure:
{
  "v": "KERI10JSON000091_",
  "t": "rct",
  "d": "ELvaU6Z-i0d8JJR2nmwyYAZAoTNZH3UfSVPzhzS6b5CM",
  "i": "BWzwEHHzq7K0gzQPYGGwTmuupUhPx5_yZ-Wk1x4ejhcc"
}

Signature: 0BDKrANtOpUKuC9AZhxzfCc991iuG1bWmIeHDjk2PTwmvVdwNAg2XgXqeqBBps_6jdEu1IR3GrfyLRnyB7E0D5Cw

Performance Analysis

Computational Complexity

• SAID Generation: O(n) where n = serialized ACDC size
• Ed25519 Signing: O(1) constant time
• Schema Validation: O(m) where m = schema complexity
• TEL Event Creation: O(1) constant time
• Overall Issuance: O(n + m) linear in credential and schema size

Memory Footprint

Typical ACDC Memory Usage:
- Base ACDC structure: ~500 bytes
- Attribute data: variable (100-2000 bytes typical)
- CESR signature: 88 bytes
- TEL event: ~300 bytes
- Total per credential: ~1-3 KB

Network Overhead

IPEX Grant Message Size:
- Message envelope: ~400 bytes
- Embedded ACDC: ~1-3 KB
- CESR attachments: ~200 bytes
- Total network payload: ~1.5-4 KB per issuance

Throughput Characteristics

• Single-threaded issuance: ~1000 credentials/second
• Multi-threaded with witness coordination: ~500 credentials/second
• Network-limited (IPEX delivery): ~100 credentials/second
• Registry anchoring bottleneck: ~50 anchored credentials/second

Edge Cases & Error Handling

Schema Validation Failures

class SchemaValidationError(Exception):
    def __init__(self, schema_id, validation_errors):
        self.schema_id = schema_id
        self.errors = validation_errors
        super().__init__(f"Schema {schema_id} validation failed: {validation_errors}")

def validate_against_schema(data, schema):
    try:
        jsonschema.validate(data, schema)
    except jsonschema.ValidationError as e:
        raise SchemaValidationError(schema['$id'], [e.message])

Registry State Conflicts

def handle_registry_conflict(registry_id, credential_id):
    # Check if credential already exists in registry
    existing = registry.get_credential_state(credential_id)
    
    if existing == 'issued':
        raise CredentialAlreadyIssuedError(credential_id)
    elif existing == 'revoked':
        raise CredentialRevokedError(credential_id)
    
    # Proceed with issuance
    return True

Witness Timeout Handling

async def wait_for_witness_receipts(event_digest, timeout=30):
    start_time = time.time()
    required_receipts = calculate_witness_threshold()
    received_receipts = 0
    
    while received_receipts < required_receipts:
        if time.time() - start_time > timeout:
            raise WitnessTimeoutError(f"Only {received_receipts}/{required_receipts} receipts received")
        
        await asyncio.sleep(0.1)
        received_receipts = count_receipts_for_event(event_digest)
    
    return True

Key Rotation During Issuance

def ensure_key_state_consistency(issuer_aid, issuance_timestamp):
    current_key_state = get_key_state_at_time(issuer_aid, issuance_timestamp)
    
    if current_key_state != get_current_key_state(issuer_aid):
        # Key rotation occurred during issuance
        # Use historical key state for signature verification
        return current_key_state
    
    return get_current_key_state(issuer_aid)

Standards & Specifications

IETF Draft References

• KERI Protocol: draft-ssmith-keri-core-01
• ACDC Specification: draft-ssmith-acdc-02
• IPEX Protocol: draft-ssmith-ipex-01
• CESR Encoding: draft-ssmith-cesr-03
• PTEL Specification: draft-pfeairheller-ptel-00

JSON Schema Compliance

All ACDC schemas MUST comply with JSON Schema Draft 2020-12:

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY",
  "title": "Legal Entity vLEI Credential",
  "type": "object",
  "properties": {
    "LEI": {
      "type": "string",
      "pattern": "^[0-9A-Z]{18}[0-9]{2}$"
    },
    "legalName": {
      "type": "string",
      "maxLength": 500
    }
  },
  "required": ["LEI", "legalName"]
}

GLEIF vLEI Compliance

For vLEI ecosystem credentials, issuance MUST follow:

• vLEI EGF v3.0: Technical Requirements Part 2
• ISO 17442: LEI data format compliance
• Ed25519 CESR Proof Format: Mandatory signature algorithm
• Blake3-256 SAID: Required digest algorithm

Production Considerations

High-Availability Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: keria-issuer
spec:
  replicas: 3
  selector:
    matchLabels:
      app: keria-issuer
  template:
    spec:
      containers:
      - name: keria
        image: gleif/keria:latest
        env:
        - name: KERI_WITNESS_URLS
          value: "http://witness1:5642,http://witness2:5643,http://witness3:5644"
        - name: KERI_DB_PATH
          value: "/data/keri"
        volumeMounts:
        - name: keri-data
          mountPath: /data
        resources:
          requests:
            memory: "512Mi"
            cpu: "250m"
          limits:
            memory: "1Gi"
            cpu: "500m"

Monitoring & Observability

import prometheus_client

# Metrics for credential issuance
CREDENTIAL_ISSUANCE_COUNTER = prometheus_client.Counter(
    'keri_credentials_issued_total',
    'Total number of credentials issued',
    ['issuer_aid', 'schema_type', 'status']
)

CREDENTIAL_ISSUANCE_DURATION = prometheus_client.Histogram(
    'keri_credential_issuance_duration_seconds',
    'Time spent issuing credentials',
    ['issuer_aid', 'schema_type']
)

def issue_credential_with_metrics(issuer, schema, data):
    start_time = time.time()
    
    try:
        credential = issue_credential(issuer, schema, data)
        CREDENTIAL_ISSUANCE_COUNTER.labels(
            issuer_aid=issuer,
            schema_type=schema,
            status='success'
        ).inc()
        return credential
    except Exception as e:
        CREDENTIAL_ISSUANCE_COUNTER.labels(
            issuer_aid=issuer,
            schema_type=schema,
            status='error'
        ).inc()
        raise
    finally:
        duration = time.time() - start_time
        CREDENTIAL_ISSUANCE_DURATION.labels(
            issuer_aid=issuer,
            schema_type=schema
        ).observe(duration)

Database Scaling Strategies

# Sharded credential storage
class ShardedCredentialStore:
    def __init__(self, shard_count=16):
        self.shard_count = shard_count
        self.shards = [LMDBStore(f"credentials_shard_{i}") for i in range(shard_count)]
    
    def get_shard(self, credential_id):
        shard_index = int(credential_id[-2:], 16) % self.shard_count
        return self.shards[shard_index]
    
    def store_credential(self, credential_id, credential_data):
        shard = self.get_shard(credential_id)
        return shard.put(credential_id, credential_data)

Backup & Recovery Procedures

#!/bin/bash
# KERI credential backup script

BACKUP_DIR="/backup/keri/$(date +%Y%m%d_%H%M%S)"
mkdir -p "$BACKUP_DIR"

# Backup KEL databases
cp -r /data/keri/db/kels "$BACKUP_DIR/"

# Backup credential registries
cp -r /data/keri/db/regs "$BACKUP_DIR/"

# Backup credential store
cp -r /data/keri/db/creds "$BACKUP_DIR/"

# Create integrity manifest
find "$BACKUP_DIR" -type f -exec sha256sum {} \; > "$BACKUP_DIR/integrity.sha256"

# Compress backup
tar -czf "$BACKUP_DIR.tar.gz" -C "$(dirname $BACKUP_DIR)" "$(basename $BACKUP_DIR)"

echo "Backup completed: $BACKUP_DIR.tar.gz"

Registry Access Control

• Implement proper authorization checks before credential issuance
• Use multi-signature schemes for high-value credential types
• Audit all credential issuance operations
• Implement rate limiting to prevent abuse

Testing Strategies

Unit Testing Credential Issuance

import pytest
from unittest.mock import Mock, patch

class TestCredentialIssuance:
    def test_acdc_structure_validation(self):
        issuer = 'EAoTNZH3UfSVPzhzS6b5CMZAoTNZH3UfSVPzhzS6b5CM'
        registry = 'EGUPiCVO73M9worPwR3PfThAtC0AJnH5ZgwsXf6TzbVK'
        
        acdc = build_acdc(issuer, registry, test_data)
        
        assert acdc['v'].startswith('ACDC10JSON')
        assert acdc['i'] == issuer
        assert acdc['ri'] == registry
        assert 'd' in acdc
        assert 'a' in acdc
    
    @patch('keri.core.eventing.Kevery')
    def test_tel_anchoring(self, mock_kevery):
        tel_event = create_tel_event(test_acdc)
        anchor_to_kel(issuer_aid, tel_event)
        
        mock_kevery.assert_called_once()
        # Verify KEL interaction event created

Integration Testing with Test Networks

#!/bin/bash
# Start test witness network
kli witness demo &
WITNESS_PID=$!

# Start test schema server
vlei-server -s ./test-schemas -p 7723 &
SCHEMA_PID=$!

# Run credential issuance tests
python -m pytest tests/test_credential_issuance.py -v

# Cleanup
kill $WITNESS_PID $SCHEMA_PID

Load Testing Considerations

• Test witness network capacity under high credential issuance load
• Validate TEL performance with large numbers of credentials
• Monitor memory usage during batch credential operations
• Test IPEX delivery reliability under network stress