KERIMask is a planned browser extension wallet for the KERI ecosystem, conceptually similar to MetaMask, that will enable users to manage and control their Autonomic Identifiers (AIDs) directly from their web browser by connecting to KERIA agent servers.
Related Concepts
No related concepts available
Comprehensive Explanation
KERIMask
Implementation Overview
KERIMask is a browser extension wallet designed to bring KERI (Key Event Receipt Infrastructure) identity management capabilities to web browsers. As of October 2023, KERIMask exists only in the planning phase with no production implementation yet available. The project draws conceptual inspiration from MetaMask's successful model of providing cryptocurrency wallet functionality through browser extensions, but adapts this pattern for managing cryptographic identities rather than blockchain assets.
The implementation will be built as a browser extension that communicates with KERIA (KERI Agent in the cloud) servers using the SKRAP (Signify KERIA Request Authentication Protocol). This architecture enables users to interact with KERI-based applications and services without requiring standalone desktop applications, lowering the barrier to entry for KERI adoption by providing familiar wallet-like UX patterns that web3 users already understand.
Architectural Design
Client-Server Model
KERIMask follows a client-server architecture that separates cryptographic operations from agent coordination:
Client Side (Browser Extension):
User interface for identity management
Local key management and signing operations via Signify
Connection management to KERIA servers
Browser integration for web application interactions
Server Side (KERIA):
Implementation Notes
Current Status
As of October 2023, KERIMask exists only in the planning phase with no production implementation available. Developers interested in this project should monitor the WebOfTrust GitHub organization for future development activity.
Architecture Considerations
Browser Extension Development
When implementation begins, developers will need to consider:
Browser Compatibility: Chrome, Firefox, Brave, and other Chromium-based browsers have different extension APIs
Manifest Version: Chrome's Manifest V3 requirements may impact architecture decisions
Storage APIs: Browser extension storage mechanisms (localStorage, IndexedDB, chrome.storage) have different characteristics
Background Scripts: Service workers vs. persistent background pages affect how the extension maintains state
SKRAP Protocol Implementation
The SKRAP protocol specification will need to define:
Authentication Mechanisms: How browser extensions authenticate with KERIA servers
Session Management: Token-based authentication, refresh mechanisms, and session expiration
Request Signing: How requests are signed to prove control over AIDs
Error Handling: Standard error codes and recovery procedures
Security Implementation
Key Storage: Browser extensions should use the most secure storage available:
Chrome: chrome.storage.local with encryption
Firefox: browser.storage.local with encryption
Consider integration with browser's native credential management APIs
Content Security Policy: Strict CSP to prevent XSS attacks and unauthorized script execution
Permission Model: Minimal permissions requested, with clear justification for each permission
Integration with Signify
KERIMask will need to integrate with Signify for cryptographic operations:
Library Integration: Embedding Signify as a JavaScript library within the extension
Key Generation: Using Signify's key generation functions for creating AIDs
Signing Operations: Delegating all signing to Signify's APIs
Cloud-hosted KERI agents managing KEL (Key Event Log) state
KERIMask will utilize SKRAP as its authentication and communication protocol for connecting to KERIA servers. According to Kent Bull (KERI Slack, May 2023), SKRAP serves as the client-side protocol for connecting various types of clients to KERIA's multi-tenant Mark II Agent server architecture.
The SKRAP protocol enables:
Authenticated Communication: Secure request authentication between the browser extension and KERIA servers without exposing private keys
Edge Signing: Signify performs all cryptographic signing operations at the edge (client side), including signing ACDCs (Authentic Chained Data Containers)
Agent Coordination: KERIA manages communications between agents while the items transmitted are signed by Signify
Multi-tenant Support: Multiple users can share KERIA infrastructure through the Mark II Agent server
KERIA Service Endpoints
KERIMask will interact with KERIA's three-interface architecture:
1. Boot Interface
Exposes one endpoint for Agent Worker initialization
Typically exposed to internal infrastructure only or disabled altogether
Can be completely disabled in static worker mode (where all agent workers are configured at startup)
2. Admin Interface
Provides REST API for command and control operations from Signify clients
Enables management of agent configurations and operations
Primary interface for KERIMask's control plane operations
Handles KERI protocol interactions with external systems
Enables communication with other participants in the KERI ecosystem
This separation allows for flexible security configurations where the Boot interface can be restricted to internal access while Admin and Protocol interfaces are exposed externally as needed.
Key Features & Capabilities
AID Management
The primary purpose of KERIMask is to enable users to control their AIDs (Autonomic Identifiers) directly from their web browser. This includes:
Threshold Management: Configuring TOAD (Threshold of Accountable Duplicity) parameters
Witness Pool Management: Interacting with available witness pools
Security Model
KERIMask's architecture maintains KERI's security principles through careful design:
Edge-Based Key Management
Private Key Isolation: All private keys remain within the browser extension's secure storage, never transmitted to KERIA servers or exposed to web applications. This preserves the autonomic nature of KERI identifiers where controllers maintain exclusive control over their cryptographic keys.
Signify Integration: By leveraging Signify for signing operations, KERIMask ensures that all cryptographic operations occur at the edge. The items transmitted through KERIA are already signed, meaning KERIA servers never have access to signing keys.
Hardware Wallet Support
While KERIMask itself is a browser extension, the SKRAP protocol architecture supports integration with hardware security modules (HSMs) and hardware wallets. In this configuration:
Cryptographic keys remain secured within the hardware device
Application code uses SKRAP to communicate with agents running on KERIA servers
Hardware-backed key storage is preserved while leveraging KERIA-based agent services
This architecture enables secure KERI implementations across web and hardware wallet platforms while preserving the autonomic identifier security model central to KERI's design.
Network-Level Separation
The three-interface architecture of KERIA provides fine-grained access control:
Boot Interface: Isolatable from external networks, used only for agent initialization
Admin Interface: Externally accessible for KERIMask control operations
Protocol Interface: Externally accessible for KERI protocol interactions
This separation enables security configurations appropriate for different deployment scenarios.
Use Cases and Applications
Web Application Authentication
KERIMask will enable web applications to request identity operations from users:
Sign-in with KERI: Web applications can request proof of control over an AID
Credential Presentation: Users can present verifiable credentials (ACDCs) to web applications
Transaction Signing: Applications can request signatures on specific data or transactions
Credential Management
Users will be able to manage their verifiable credentials:
Credential Storage: Maintaining a collection of credentials in the browser extension
Selective Disclosure: Presenting credentials with selective disclosure of attributes
Credential Revocation: Checking revocation status via TEL (Transaction Event Log)
Identity Delegation
KERIMask will support KERI's delegation mechanisms:
Delegated Identifiers: Creating and managing delegated AIDs
Delegation Hierarchies: Supporting nested delegation trees
Custodial Arrangements: Enabling custodial rotation for managed identities
Comparison to MetaMask
While KERIMask draws inspiration from MetaMask's user experience patterns, there are fundamental differences:
Similarities
Browser Extension Form Factor: Both provide wallet functionality through browser extensions
Web Application Integration: Both enable web applications to request operations from users
Key Management: Both manage cryptographic keys on behalf of users
Permission Model: Both implement user-controlled authorization for web applications
Differences
Identity vs. Assets: MetaMask manages cryptocurrency assets and blockchain transactions, while KERIMask manages cryptographic identities and verifiable credentials.
Blockchain vs. KERI: MetaMask connects to blockchain networks, while KERIMask connects to KERIA agent servers and the KERI ecosystem.
Transaction Model: MetaMask signs blockchain transactions that transfer value, while KERIMask signs key events and credentials that establish and prove identity.
Consensus Mechanism: MetaMask relies on blockchain consensus, while KERIMask leverages KERI's witness-based consensus through KAACE (KERI Agreement Algorithm for Control Establishment).
Development Status and Roadmap
As of October 2023, KERIMask remains in the planning phase with no production implementation available. No specific release timeline has been announced. The project represents the KERI community's roadmap for bringing KERI capabilities to browser-based applications and making KERI identity management more accessible to everyday users.
The planning phase likely involves:
Architecture Design: Finalizing the technical architecture and integration points
SKRAP Protocol Specification: Completing the SKRAP protocol specification for browser extension clients
Security Model: Defining the security model and threat mitigation strategies
User Experience Design: Creating the user interface and interaction patterns
Browser Compatibility: Determining which browsers to support (Chrome, Firefox, Brave, etc.)
Ecosystem Integration
KERIMask will integrate with the broader KERI ecosystem:
KERIA Servers
KERIMask's primary integration point is with KERIA servers, which provide:
Agent Services: Cloud-hosted agents managing KEL state
Multi-tenancy: Shared infrastructure for multiple users
Protocol Handling: CESR protocol processing and inter-agent communication
TELs: For credential issuance and revocation state
Technical Challenges
Implementing KERIMask will require addressing several technical challenges:
Browser Security Constraints
Browser extensions operate within strict security sandboxes:
Storage Limitations: Browser extension storage has size and persistence constraints
Cross-origin Restrictions: Communication between the extension and web applications must respect browser security policies
Key Storage: Secure storage of private keys within browser extension storage mechanisms
Performance Considerations
Browser environments have performance constraints:
Cryptographic Operations: Performing cryptographic operations efficiently in JavaScript
KEL Processing: Parsing and validating potentially large KELs
Network Latency: Managing latency in communications with KERIA servers
User Experience
Creating an intuitive user experience for complex cryptographic operations:
Key Management: Presenting key rotation and pre-rotation concepts to non-technical users
Witness Configuration: Simplifying witness selection and configuration
Error Handling: Providing clear feedback when operations fail
Permission Prompts: Designing clear permission requests for web applications
Conclusion
KERIMask represents an important step in making KERI technology accessible to mainstream users through familiar browser-based interfaces. By providing a MetaMask-like experience for KERI identity management, KERIMask aims to lower the barrier to entry for KERI adoption and enable web applications to leverage KERI's cryptographic identity capabilities. While still in the planning phase, KERIMask's architecture demonstrates careful consideration of security, usability, and integration with the broader KERI ecosystem through SKRAP protocol and KERIA agent infrastructure.
ACDC Operations: Using Signify for creating and signing verifiable credentials
Development Roadmap Considerations
When development begins, the project will likely follow phases:
SKRAP Protocol Finalization: Complete specification of the browser extension variant of SKRAP
Core Extension Development: Basic browser extension with AID management
KERIA Integration: Connection to KERIA servers and agent management
Web Application APIs: JavaScript APIs for web applications to interact with KERIMask
Credential Management: ACDC issuance, storage, and presentation