Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 44 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
Proof-of-authorship is cryptographic evidence establishing who originally created specific data or content, focusing on data inception rather than subsequent rights or permissions. In KERI/ACDC systems, it provides verifiable attribution through digital signatures and hash chains that bind data to its creator's autonomic identifier.
Proof-of-authorship is a cryptographic mechanism that establishes verifiable evidence of who originally created specific data or content. This concept addresses the fundamental question of data inception - proving the original creator at the point of creation rather than tracking subsequent ownership or permissions.
The core properties of proof-of-authorship include:
Proof-of-authorship is fundamentally distinguished from proof-of-authority, which concerns rights, permissions, and authorizations attached to data after creation. While proof-of-authorship answers "who created this?", proof-of-authority answers "who has rights over this?"
Traditional proof-of-authorship mechanisms have existed in both physical and digital domains:
Physical World Examples:
Digital Implementations:
Authorship vs. Authority Separation: System designers must clearly distinguish between proof-of-authorship (who created data) and proof-of-authority (who has rights over data). These are separate concerns that may diverge in practice - the original author may no longer have authority, or authority may be delegated while authorship remains with the original creator.
Governance Framework Requirements: While KERI provides cryptographic proof-of-authorship, determining whether that authorship is meaningful for a particular use case requires governance frameworks. Organizations must establish policies for:
Temporal Considerations: Proof-of-authorship establishes when data was created relative to the author's key state, but not absolute timestamps. Systems requiring precise time-of-creation must combine KERI authorship proofs with trusted timestamping services or witness-based temporal ordering.
Delegation Architecture: When implementing delegated authorship, carefully design the delegation tree structure. Deep delegation chains increase verification complexity and create more points of potential compromise. Consider using partial rotation to separate signing authority from rotation authority in delegated scenarios.
Privacy and Disclosure: Proof-of-authorship can reveal information about data creators. Use graduated disclosure mechanisms and selective disclosure to control what authorship information is revealed to different parties. Consider using private ACDCs with high-entropy UUIDs when authorship must be provable but not publicly discoverable.
Verification Performance: Authorship verification requires processing KEL events and validating signatures. For high-throughput systems, implement caching of verified key states and batch signature verification. Consider using witnesses to pre-verify authorship claims and reduce verification burden on end verifiers.
Key Compromise Response: Establish procedures for handling compromised authorship keys. While past authorship claims remain cryptographically valid, governance policies must determine how to treat data authored with compromised keys. Consider implementing revocation registries or status lists for authored data.
However, traditional digital proof-of-authorship systems often suffer from:
KERI and ACDC (Authentic Chained Data Container) provide a sophisticated approach to proof-of-authorship that addresses traditional limitations through several key innovations:
KERI uses Autonomic Identifiers (AIDs) as the foundation for authorship claims. AIDs are self-certifying identifiers cryptographically derived from public keys, eliminating dependency on external naming authorities. When an AID controller signs data, the signature provides:
ACDCs integrate proof-of-authorship into their core data structure through Authentic Provenance Chains (APCs). Each ACDC contains:
Issuer AID Field (i): The autonomic identifier of the ACDC creator, establishing the root of authorship
SAID Field (d): A Self-Addressing Identifier that is a cryptographic digest of the entire ACDC, creating an immutable binding between the data and its content
Digital Signatures: Attached as CESR-encoded primitives that cryptographically prove the issuer AID controller authorized the ACDC creation
Anchoring Digests: Hash commitments that bind the ACDC to specific points in the issuer's KEL, establishing temporal ordering
This structure creates a verifiable chain of proof-of-authorship where:
ACDCs support chained proof-of-authorship through their directed acyclic graph (DAG) structure. The Edge section of an ACDC can reference other ACDCs, creating authorship chains that track:
For example, in a book publishing scenario:
This separation enables complex scenarios where authorship and authority diverge while maintaining cryptographic verifiability of both.
KERI's architecture recognizes that real-world data ecosystems require both authorship and authority proofs. ACDCs provide:
Proof-of-Authorship Layer: Establishes who created the data through cryptographic signatures bound to AIDs
Proof-of-Authority Layer: Establishes who has rights over the data through chained delegation structures
The combination creates comprehensive provenance tracking:
This dual-layer approach enables use cases like:
A critical property of KERI's proof-of-authorship is end-verifiability - any party can verify authorship claims without relying on infrastructure not under their control:
This eliminates single points of failure and enables truly decentralized authorship verification.
Authentic Data Supply Chains: Manufacturing and logistics systems can track product data from creation through distribution, with verifiable authorship at each transformation step. Each processing stage creates a new ACDC with proof-of-authorship for the transformation while maintaining the chain back to original creation.
Digital Rights Management: Content creators can establish cryptographic proof of original authorship that persists even as usage rights are licensed or transferred. The authorship proof remains verifiable regardless of how many times rights change hands.
Regulatory Compliance: Financial institutions can prove the authorship of regulatory reports, with cryptographic evidence of who created each data element and when. This supports audit trails and non-repudiation requirements.
Scientific Data Provenance: Research data can carry verifiable authorship from collection through analysis and publication, enabling reproducibility verification and proper attribution in collaborative research.
Verifiable Credentials: Credential issuers establish proof-of-authorship for issued credentials, enabling verifiers to cryptographically confirm the credential's origin without contacting the issuer.
Cryptographic Non-Repudiation: Authors cannot deny creating data once they've signed it with their AID. The KEL provides an immutable record of the signing event.
Decentralized Verification: No dependency on centralized authorities or online services for authorship verification. Verifiers need only the ACDC, signatures, and KEL.
Portable Attribution: Authorship proofs work across different systems, platforms, and contexts. Data can move between ecosystems while maintaining verifiable authorship.
Temporal Ordering: KEL anchoring establishes verifiable creation timestamps without requiring trusted timestamp authorities.
Delegation Support: Authorship can be delegated through cryptographically verifiable chains, enabling complex organizational structures while maintaining accountability.
Privacy Preservation: Graduated disclosure mechanisms allow selective revelation of authored data while maintaining cryptographic proof of complete authorship.
Complexity: Implementing proper proof-of-authorship requires understanding KERI's key management, event logs, and signature verification. This is more complex than simple digital signatures.
Key Management Burden: Authors must properly manage their AIDs and signing keys. Key compromise undermines all authorship claims made with those keys.
Storage Requirements: Maintaining KELs and signature attachments increases storage overhead compared to unsigned data.
Verification Overhead: Verifying authorship requires processing KEL events and validating signatures, which is more computationally expensive than trusting centralized assertions.
Irrevocability: Once authorship is cryptographically established, it cannot be undone. This is a feature for non-repudiation but may be problematic if keys are compromised.
Governance Dependency: While cryptographically verifiable, determining whether authorship matters for a particular use case requires governance frameworks and trust policies beyond the cryptographic layer.
The KERI approach to proof-of-authorship represents a fundamental shift from trust-based to cryptographically-verifiable authorship systems, enabling authentic data ecosystems where origin and creation can be independently verified without relying on centralized authorities or trusted intermediaries.