A root-of-trust is a system component that is secure by design, whose security characteristics are inherently trusted by other components. In KERI, the cryptographic root-of-trust is established through self-certifying identifiers derived from key pairs, eliminating dependency on external authorities and enabling end-verifiable control authority.
Related Concepts
No related concepts available
Comprehensive Explanation
root-of-trust
Conceptual Definition
A root-of-trust represents the foundational security anchor upon which an entire system's trust architecture depends. It is defined as "some component of a system that is secure by design and its security characteristics may be inherently trusted or relied upon by other components of the system." The failure of a root-of-trust would compromise the integrity of all bindings and trust relationships that depend upon it.
The concept encompasses three critical properties:
Inherent Security: The root-of-trust must be secure by design, not merely through operational procedures or external protections
Foundational Trust: Other system components rely upon its security characteristics without requiring additional verification
Binding Integrity: It establishes the authoritative basis for all cryptographic bindings and trust relationships in the system
In traditional systems, roots-of-trust often take the form of hardware security modules, certificate authorities, or trusted execution environments. However, KERI introduces a paradigm shift by establishing cryptographic roots-of-trust that eliminate dependency on administrative or algorithmic intermediaries.
Historical Context
Traditionally, digital identity systems have relied on three types of trust bases:
Administrative Trust Basis: Systems like DNS/CA (Domain Name System/Certificate Authority) depend on trusted organizational entities to maintain identifier-to-key bindings. These systems suffer from:
Single points of failure through compromised certificate authorities
Vulnerability to organizational failures or malicious insiders
Lack of cryptographic verifiability of the trust basis itself
Examples include the numerous CA compromises that have undermined HTTPS security
Algorithmic Trust Basis: Blockchain and distributed ledger systems establish trust through consensus algorithms:
Verify complete delegation chain during validation
Verification Implementation
Bitcoin, Ethereum, and similar systems use proof-of-work or proof-of-stake
Trust derives from computational difficulty or economic stake
Provides strong binding but locks identifiers to specific ledger infrastructure
Higher cost and lower performance compared to cryptographic approaches
Shared governance creates dependencies on network consensus
Cryptographic Trust Basis: The approach KERI pioneered, where trust derives entirely from cryptographic operations:
Self-certifying identifiers bound to key pairs through one-way functions
No external infrastructure required for initial verification
Truly decentralized with no shared governance requirements
Portable across different systems and platforms
The evolution toward cryptographic roots-of-trust addresses fundamental weaknesses in both administrative and algorithmic approaches, particularly the problem of insecure key rotation that plagues traditional PKI systems.
KERI's Approach
Cryptographic Root-of-Trust Architecture
KERI establishes its root-of-trust through self-certifying identifiers (SCIDs) that are cryptographically derived from public keys. This creates what KERI terms an autonomic trust basis—a trust foundation that is self-contained, self-managing, and requires no external validation infrastructure.
The KERI root-of-trust is established through:
Entropy-Based Key Generation: High-entropy random seeds (minimum 128 bits of cryptographic strength) generate private keys
Cryptographic Derivation: Public keys are derived from private keys through one-way functions
Identifier Binding: The identifier is cryptographically derived from the public key, creating an unbreakable binding
Key Event Logs: The KEL provides a verifiable history of all key state changes, maintaining the root-of-trust across key rotations
Primary vs. Secondary Roots-of-Trust
KERI distinguishes between two categories of roots-of-trust:
Primary Roots-of-Trust: These are irreplaceable foundational components that form the base layer of trust. In KERI, the KEL serves as the primary root-of-trust, providing:
Cryptographically verifiable key state from inception through all rotations
Direct one-to-one relationship with the entropy used to generate the initial keys
End-verifiable proof of control authority without external dependencies
Immutable audit trail of all establishment events
The characteristic that makes a root-of-trust primary is its direct relationship to the entropy used during key generation—the cryptographic randomness that serves as the ultimate foundation of security.
Secondary Roots-of-Trust: These are replaceable trust components that depend on primary roots for their security guarantees. Examples include:
TEL (Transaction Event Log) for credential registry state
Blockchain-anchored data that references KERI identifiers
Service endpoints and witness configurations
Secondary roots-of-trust maintain high trustability through cryptographic anchoring via seals to primary roots-of-trust. They can be automatically verified by tracing their cryptographic binding back to the primary root.
Pre-Rotation and Root-of-Trust Continuity
A critical innovation in KERI's root-of-trust model is pre-rotation—the mechanism that maintains the root-of-trust across key rotations:
Each establishment event includes a cryptographic digest of the next rotation keys
This creates a forward-chained commitment that cannot be altered retroactively
Even if current signing keys are compromised, the pre-rotated keys remain secure
The root-of-trust persists through key rotations because each rotation was cryptographically committed in the prior event
This provides post-quantum security since the pre-rotated key digests are protected by one-way hash functions
This solves the fundamental problem that plagued traditional PKI: key rotation events signed by potentially compromised keys cannot be trusted. KERI's pre-rotation ensures the root-of-trust remains unbroken even through key compromise and recovery.
Trust Basis Formation
The collection of all roots-of-trust (both primary and secondary) together form the trust basis for the entire identity system. In KERI, this trust basis provides:
Cryptographic Verifiability: Every trust relationship can be verified through cryptographic proofs
End-to-End Verification: No trusted intermediaries required for validation
Ambient Verifiability: Anyone, anywhere, at any time can verify the trust relationships
Duplicity Detection: Conflicting versions of key event logs can be detected through comparison
Replacing Human Trust with Cryptographic Trust
KERI's fundamental paradigm shift is replacing human basis-of-trust with cryptographic root-of-trust. Traditional systems rely on trusting what was said (content veracity), but KERI enables trusting who said it (attribution) through:
Verifiable digital signatures from asymmetric key cryptography
Consistent attribution through integral non-repudiable statements
Cryptographic binding between identifiers, keys, and controllers
End-verifiable proof of control authority
This transformation enables secure attribution—proving "whodunit in cyberspace"—without requiring trust in organizational entities or consensus networks.
Practical Implications
Use Cases and Applications
Organizational Identity (vLEI Ecosystem): GLEIF's implementation of verifiable Legal Entity Identifiers demonstrates root-of-trust in practice:
GLEIF establishes itself as the root-of-trust through its Root AID
Qualified vLEI Issuers receive delegated authority through cryptographic delegation
Legal entities and their representatives form a verifiable chain of trust
All credentials can be verified back to GLEIF's root without requiring online access to GLEIF systems
Cooperative delegation requiring both delegator and delegate participation
Verifiable chain of authority from root to leaves
The root-of-trust concept is thus not merely a technical detail but the foundational principle that enables KERI's vision of a secure, decentralized, and verifiable internet identity layer.