Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 176 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
Self-sovereign identity (SSI) is a decentralized identity architecture that places the identity controller—whether a natural person or organization—in direct control of the identifiers and credentials they use to assert their digital identity, without requiring permission from or reliance on centralized identity providers.
Self-sovereign identity represents a paradigm shift in digital identity management, moving control from centralized authorities to individual identity holders. The concept encompasses a broad set of ideas, architectures, processes, and technologies designed to support autonomous parties as they negotiate and execute electronic transactions with one another.
The foundational work on SSI principles comes from Christopher Allen's 2016 blog post "The Path to Self-Sovereign Identity," which proposed ten principles of SSI. However, Allen explicitly framed these as "a departure point to provoke a discussion about what's truly important" rather than as definitive requirements. Since 2016, no universal consensus definition has emerged, with different stakeholders emphasizing different aspects based on their specific needs and contexts.
The essential characteristic distinguishing SSI from other identity models is that it puts the identity controller directly in control of:
SSI systems exhibit several defining properties:
User Control: Individuals maintain control over their identity information rather than delegating it to identity providers like Facebook Connect or Google Sign-In. This eliminates the concentration of identity control in the hands of major technology platforms.
Decentralization: SSI architectures do not rely on centralized registries, identity providers, or certificate authorities. While third parties may assist with information discovery, the fundamental design ensures controllers can prove control without permission from external authorities.
Implementing SSI requires careful attention to governance frameworks:
Trust Frameworks: Organizations like GLEIF establish governance frameworks defining:
Schema Registries: Centralized or federated registries for credential schemas enable interoperability while maintaining decentralized identifier control.
Dispute Resolution: Mechanisms for handling disputes about credential validity or revocation must be established outside the technical protocol.
SSI systems must abstract cryptographic complexity:
Key Management: Users need secure, usable key storage through:
Recovery Mechanisms: Systems must provide key recovery without compromising security:
Selective Disclosure: User interfaces must clearly communicate what information is being shared and with whom.
SSI implementations should support standard protocols:
W3C Standards: Integration with W3C Verifiable Credentials and DIDs enables broader ecosystem participation.
OOBI Protocol: Out-of-band introduction enables discovery while maintaining security through in-band verification.
IPEX Protocol: Issuance and Presentation Exchange provides standardized credential exchange workflows.
SSI implementations must address:
Key Compromise: Pre-rotation and witness networks provide protection, but systems must also implement:
Privacy Protection: Graduated disclosure and selective revelation protect against correlation, but implementations must also consider:
Cryptographic Verifiability: Identity assertions are backed by cryptographic proofs rather than trust in intermediary authorities. This enables end-to-end verifiable identity without requiring trusted third parties.
Portability: Identities and credentials can move between systems and platforms without loss of security properties, enabling genuine self-sovereignty where controllers maintain complete autonomy.
SSI is explicitly defined as having "many different interpretations" across the identity community. The concept encompasses:
What SSI is not:
The evolution of digital identity systems provides essential context for understanding SSI:
Administrative Trust Basis (DNS/CA): Traditional systems rely on external administrators and hierarchical certificate authorities. Users must trust centralized identity providers to maintain and validate their identity information. This creates:
Federated Identity: Systems like SAML and OAuth enable identity federation across domains, but still require:
The SSI movement emerged from recognition that existing identity systems concentrate too much power in centralized authorities. Key drivers included:
Privacy Concerns: Big data collectors and social media platforms accumulate knowledge about individuals that exceeds self-knowledge, enabling surveillance and manipulation.
Security Vulnerabilities: Centralized identity databases create attractive targets for attackers, with breaches affecting millions of users.
User Disempowerment: Individuals lack control over their own identity data, unable to move credentials between platforms or revoke access without provider cooperation.
Democratic Threats: Elections have been influenced and individuals impersonated through digital manipulation, undermining trust in digital interactions.
SSI builds on several foundational concepts:
Self-Certifying Identifiers: Cryptographically derived identifiers that can be verified without external authorities, providing a decentralized root of trust.
Verifiable Credentials: Digitally signed credentials that are tamper-evident and cryptographically verifiable, enabling trust without intermediaries.
Decentralized Key Management: Cryptographic key management that doesn't rely on centralized infrastructure, enabling true user sovereignty.
KERI (Key Event Receipt Infrastructure) implements SSI principles through a specific technical architecture that addresses core challenges in decentralized identity:
KERI's Autonomic Identifiers embody SSI principles through:
Self-Certifying: AIDs are cryptographically derived from public keys, enabling verification without external authorities. The identifier itself proves its binding to the controlling key pair.
Self-Governing: AIDs operate independently without requiring permission from centralized registries or identity providers.
Self-Sovereign: Controllers maintain complete authority over their identifiers through cryptographic key control.
Self-Managing: Key rotation and delegation operations are managed by controllers without intermediary involvement.
Self-Administering: The identifier namespace is autonomic, requiring no external administration.
KERI provides what it calls an autonomic trust basis - a cryptographic root of trust that doesn't depend on external authorities:
Primary Root of Trust: KERI establishes trust through cryptographically verifiable key event logs (KELs) that can be verified all the way to the current controlling key pair. This is fundamentally different from:
End-Verifiability: Anyone can verify any KEL, anywhere, at any time - a property KERI calls "ambient verifiability." This eliminates dependency on intervening infrastructure.
Zero-Trust Architecture: KERI requires no trust in intermediary infrastructure. All verification is performed cryptographically by the verifier.
KERI's approach to key management directly supports SSI principles:
Pre-Rotation: Controllers commit to next keys before rotation, providing post-quantum security and protection against key compromise. This enables:
Delegation: KERI supports cooperative delegation where both delegator and delegate must contribute, enabling:
Witness Networks: Instead of requiring blockchain consensus, KERI uses designated witnesses that provide duplicity detection without requiring shared governance.
KERI distinguishes itself from other SSI implementations:
No Blockchain Dependency: Unlike many SSI systems that anchor to blockchains, KERI provides decentralized trust without requiring:
Portability: KERI identifiers can be transferred off ledgers to native KERI infrastructure, providing true portability.
Security-First Design: KERI explicitly prioritizes:
This ordering reflects a deliberate architectural philosophy that security guarantees must precede privacy features.
Scalability: KERI's witness-based approach scales better than blockchain-based SSI systems, supporting high-throughput credential issuance and verification.
Performance: Without blockchain transaction latency, KERI operations complete in milliseconds rather than minutes.
Cost: No transaction fees for identifier operations or credential issuance.
Simplicity: KERI uses well-established cryptographic primitives rather than complex zero-knowledge proofs or blockchain consensus.
Interoperability: KERI can integrate with existing standards like W3C DIDs through did:keri and did:webs methods.
SSI principles implemented through KERI enable diverse applications:
Organizational Identity (vLEI): GLEIF's verifiable Legal Entity Identifier system uses KERI to provide cryptographically verifiable organizational credentials, enabling:
Supply Chain: Authentic data supply chains track provenance through chained credentials, providing:
Healthcare: Patient-controlled health records enable:
Education: Verifiable academic credentials provide:
User Empowerment: Individuals and organizations control their own identity data, deciding what to share and with whom.
Privacy Protection: Selective disclosure and graduated revelation enable sharing only necessary information for each interaction.
Security: Cryptographic verification eliminates reliance on trusted intermediaries that could be compromised.
Portability: Identities and credentials work across platforms and jurisdictions without vendor lock-in.
Efficiency: Automated cryptographic verification reduces manual identity checks and paperwork.
Trust: End-to-end verifiable credentials establish trust without requiring reputation-based systems.
SSI implementations face inherent challenges:
Complexity: Users must manage cryptographic keys, which requires education and appropriate tooling.
Recovery: Lost keys can mean lost identity, requiring careful backup and recovery mechanisms.
Adoption: Network effects favor existing centralized systems, making SSI adoption challenging.
Usability: Cryptographic operations must be abstracted behind user-friendly interfaces.
Governance: Decentralized systems require new governance models for schema registries, trust frameworks, and dispute resolution.
The PAC Trilemma: As KERI acknowledges, no system can simultaneously maximize all three of Privacy, Authenticity, and Confidentiality - design choices must prioritize among these properties.
The vLEI ecosystem represents the most mature production deployment of KERI-based SSI:
This deployment validates that SSI principles can work in high-stakes, regulated environments while maintaining the core properties of user control, decentralization, and cryptographic verifiability.
Availability: Witness networks and watchers ensure identifier availability, but systems should also implement: