Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 94 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
A systematic organizational structure for grouping related identifiers and resources, providing a hierarchical or logical framework for managing identifier spaces and their associated attributes within identity systems.
A namespace represents a fundamental organizational concept in identity systems and computer science—a systematic method for grouping symbols, identifiers, or names for related objects within a coherent framework. At its core, a namespace provides logical boundaries that prevent naming collisions while enabling structured organization of identifiers and their associated resources.
Key properties of namespaces include:
The scope of a namespace defines its boundaries—what identifiers belong within it and what rules govern their creation, management, and interpretation. Namespaces can be flat (all identifiers at the same level) or hierarchical (nested levels of organization), with hierarchical schemes providing greater expressiveness and organizational capability.
Namespaces emerged as a solution to the naming collision problem in computing systems. As systems grew in complexity and multiple parties needed to create identifiers independently, the risk of accidentally using the same name for different entities increased dramatically.
Historically, namespaces have been implemented through various mechanisms:
DNS (Domain Name System): Perhaps the most familiar namespace system, DNS provides a hierarchical namespace for internet domain names. The structure creates a globally unique namespace where each level is administered by different authorities.
Hierarchy Depth: Balance organizational needs against identifier complexity. Deeper hierarchies provide more structure but create longer identifiers and more complex verification paths.
Delegation Boundaries: When designing hierarchical namespaces for delegation, each level should represent a meaningful delegation boundary with clear control authority.
Namespace Agnosticism: When implementing KERI systems, avoid hard-coding assumptions about namespace syntax. Design systems to work with multiple namespace schemes (DIDs, URLs, custom formats).
Schema Management: For ACDC implementations, leverage SAID-based schema identification rather than attempting to recreate centralized schema registries. The content-addressable nature of SAIDs provides global uniqueness without coordination.
Collision Prevention: When generating identifiers within a namespace, ensure sufficient entropy in the derivation process to prevent collisions, especially in flat (non-hierarchical) namespaces.
Portability: Design namespace structures that don't create dependencies on specific infrastructure providers or governance structures, maintaining KERI's portability guarantees.
Namespace Verification: When verifying identifiers within autonomic namespaces, verify the cryptographic binding from the identifier back to the namespace root through the KEL.
Delegation Verification: For hierarchical namespaces with delegation, verify each delegation event in the chain from root to leaf identifier.
Cross-Namespace References: When identifiers from different namespaces interact (e.g., in ACDC credential chains), verify each identifier within its own namespace context before verifying cross-namespace relationships.
subdomain.domain.tldXML Namespaces: In markup languages, namespaces prevent element name collisions when combining vocabularies from different sources. The URI-based namespace identifiers ensure global uniqueness.
Programming Language Namespaces: Languages like C++, Python, and Java use namespaces (or packages/modules) to organize code and prevent naming conflicts between libraries.
URN/URI Schemes: Uniform Resource Names and Identifiers provide namespace mechanisms through scheme prefixes (http:, urn:, did:) that partition the identifier space.
Traditional namespace systems typically rely on centralized authorities for namespace administration. DNS has ICANN, programming language package repositories have central registries, and corporate systems have IT departments managing internal namespaces. This centralization creates:
KERI introduces the concept of autonomic namespaces—namespaces that are self-certifying and self-administrating. This represents a fundamental departure from traditional centralized namespace management.
Key characteristics of KERI's autonomic namespaces:
Self-Certifying Prefix: An AN has a self-certifying prefix that provides cryptographic verification of root control authority over the namespace. The prefix is derived from cryptographic key material, creating an unbreakable binding between the namespace and its controller.
Unified Root-Source-Locus (RSL): All derived AIDs within the same AN share:
This unified RSL means the governance of the namespace is consolidated into one entity—the controller who holds root authority over the namespace.
Cryptographic Derivation: Identifiers within an autonomic namespace are derived through cryptographic operations from the root namespace identifier. This derivation can follow hierarchical patterns similar to hierarchically deterministic key derivation, enabling:
A critical aspect of KERI's design is its namespace agnosticism. KERI can support AIDs in any namespace that accepts pseudo-random strings as elements. This means:
DID Compatibility: KERI identifiers can be represented as DIDs (e.g., did:keri:, did:webs:), but KERI is not limited to the DID namespace
URL/URI Support: KERI identifiers can be expressed using URL or URI syntax when appropriate for specific applications
Custom Namespaces: Applications can define custom namespace schemes while maintaining KERI's security properties
This agnosticism is explicitly stated in KERI documentation: "A given DID may be a type of AID, but not all DIDs are AIDs" and "AIDs may use namespace standards besides DIDs, so not all AIDs are DIDs."
KERI supports hierarchical prefix schemes where prefixes are composed hierarchically to create complete identifiers. The canonical example from KERI documentation uses geographic addressing:
state.county.city.zip.street.number
Concrete instantiation:
utah.wasatch.heber.84032.main.150S
This hierarchical structure provides:
A significant innovation in KERI's ACDC protocol is the elimination of centralized schema namespace registries. Traditional credential systems require central registries where schemas must be registered within specific namespaces to ensure interoperability.
KERI's solution uses:
SAIDs for Schema Identification: Schemas are identified by their self-addressing identifiers, which are content-addressable digests. This eliminates the need for namespace coordination—the schema's content determines its identifier.
Graph-Based Interoperability: ACDCs use directed acyclic graph structures where schemas are referenced by their SAIDs. This provides "interoperability by design" without requiring centralized schema registries.
Decentralized Schema Management: Organizations can create and manage schemas independently, with the SAID providing global uniqueness without central coordination.
Hierarchical Identity Management: Organizations can create hierarchical namespace structures for managing employee identifiers, device identifiers, or resource identifiers. For example:
company.department.team.employee
acme.engineering.backend.alice
Delegated Authority Structures: Autonomic namespaces enable delegation hierarchies where a root authority can delegate sub-namespaces to other entities while maintaining cryptographic proof of the delegation chain.
Multi-Tenant Systems: Service providers can create isolated namespaces for different customers, with each customer having full autonomy within their namespace while the provider maintains the root namespace.
Credential Schema Organization: While KERI eliminates the need for centralized schema registries, organizations can still organize their schemas using namespace conventions for internal management and documentation purposes.
Collision Prevention: Proper namespace design eliminates identifier collisions, even when multiple parties independently create identifiers.
Organizational Clarity: Hierarchical namespaces provide intuitive organization that mirrors real-world organizational structures.
Scalability: Namespace hierarchies enable distributed management where different entities control different portions of the namespace tree.
Portability: KERI's autonomic namespaces are truly portable—they can be moved between infrastructure providers without losing their cryptographic properties or requiring permission from intermediaries.
Interoperability: Namespace agnosticism allows KERI to work with existing namespace standards (DIDs, URLs) while not being locked to any particular scheme.
Complexity vs. Flexibility: Hierarchical namespace schemes provide great flexibility but increase complexity in implementation and management.
Human Readability vs. Security: Cryptographically-derived namespace prefixes (like KERI's self-certifying prefixes) provide strong security but sacrifice human readability. This is addressed through KERI's aid|lid couplet model.
Namespace Depth: Deeper hierarchies provide more organizational capability but can make identifiers longer and more complex to manage.
Delegation Overhead: While hierarchical namespaces enable delegation, each delegation level adds cryptographic overhead for verification.
Namespaces in KERI are not merely organizational conveniences—they are deeply integrated into the protocol's security model:
Key Event Logs: Each AID has its own KEL, which serves as the authoritative source of truth for that identifier within its namespace.
Witness Pools: Witnesses are designated per-AID, but namespace hierarchies can enable shared witness infrastructure across related identifiers.
OOBI Discovery: Out-of-band introductions can leverage namespace structure for efficient discovery of related identifiers and their service endpoints.
ACDC Chaining: Credential chains in ACDC can follow namespace hierarchies, with parent credentials establishing authority for child credentials within delegated sub-namespaces.
The namespace concept in KERI thus serves as both an organizational tool and a security primitive, enabling scalable, verifiable, and portable identity systems without dependence on centralized namespace authorities.