Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 166 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
A decentralized trust model used in PGP, GnuPG, and OpenPGP-compatible systems where participants establish the authenticity of public key-to-identity bindings through peer-to-peer validation and signature chains, creating a mesh network of trust relationships rather than relying on centralized certificate authorities.
The term web-of-trust has two distinct but related meanings within the KERI ecosystem context:
In cryptography, a web of trust is a decentralized trust model used in PGP, GnuPG, and other OpenPGP-compatible systems to establish the authenticity of the binding between a public key and its owner. This concept was first introduced by Phil Zimmermann in 1992 in the manual for PGP (Pretty Good Privacy).
Key characteristics of this traditional model include:
In this traditional model, participants establish trust relationships through key signing parties and other validation mechanisms where individuals personally verify the identity of key owners and sign their public keys to indicate confidence in the key-to-identity binding.
The term also refers to the WebOfTrust GitHub organization (github.com/WebOfTrust), which serves as the primary development hub for the KERI Suite of protocols and technologies. This organization maintains the canonical repositories for:
The web of trust is a conceptual model rather than a specific implementation. In traditional PGP/GPG systems, it is implemented through:
In KERI-based systems, the web of trust concept is transformed:
Implementers should understand that KERI does not implement traditional web of trust mechanisms but achieves similar goals (decentralized trust, no central authority) through different cryptographic means. The concept remains valuable for understanding trust models in decentralized systems.
The organization name deliberately evokes the cryptographic concept while representing a modern approach to decentralized trust infrastructure that fundamentally differs from traditional web-of-trust architectures.
Zimmermann's 1992 innovation addressed several critical limitations of centralized Public Key Infrastructure (PKI) systems:
The web of trust model spread through the PGP ecosystem and was later formalized in the OpenPGP standard. It became particularly important in communities requiring strong privacy guarantees and resistance to institutional control, such as cryptography researchers, privacy advocates, and secure communications users.
Traditional web of trust operations involve:
KERI represents a fundamentally different approach to establishing trust in digital identifiers, rather than an evolution of traditional web-of-trust models. The relationship between KERI and traditional web-of-trust is one of architectural divergence addressing the same underlying problem—establishing verifiable identity—through incompatible mechanisms.
Self-Certifying Foundation: KERI identifiers (AIDs) are cryptographically derived from keys using one-way functions, creating an unbreakable mathematical binding between identifier and key. This eliminates the fundamental problem that traditional web-of-trust addresses: establishing that a particular key belongs to a particular identity. In KERI, the identifier is a cryptographic transformation of the key, making the binding mathematically verifiable rather than socially validated.
Key Event Logs vs. Signature Chains: Traditional web-of-trust relies on chains of user signatures attesting to key ownership. KERI uses Key Event Logs (KELs)—append-only, cryptographically verifiable records of key events—to establish authoritative key state. KELs provide:
Witness Networks vs. Personal Trust: Traditional web-of-trust depends on personal trust judgments about other users' validation practices. KERI introduces witnesses—designated entities that provide key event receipts—operating under the KAACE algorithm (KERI's Agreement Algorithm for Control Establishment). Witnesses:
Duplicity Detection vs. Trust Accumulation: The most profound difference is in security model. Traditional web-of-trust accumulates trust through signature chains—more signatures from trusted parties increase confidence. KERI achieves security through ambient duplicity detection—the ability for anyone, anywhere, at any time to detect if a controller has created conflicting versions of their key event history. This shifts the security guarantee from "many people trust this key" to "any attempt to use different keys for the same identifier will be cryptographically detectable."
End-Verifiability vs. Transitive Trust: Traditional web-of-trust requires trusting intermediary nodes in trust paths. KERI provides end-to-end verifiable validation where validators can cryptographically verify the entire chain of control authority from inception to current state without trusting any intermediaries. The KEL itself is the authoritative source of truth.
While KERI replaces traditional web-of-trust mechanisms for establishing key-to-identifier bindings, it does not eliminate all trust relationships:
Witness Selection: Controllers choose which witnesses to designate in their KEL configuration. This represents a form of trust, though more limited than traditional web-of-trust:
Watcher Networks: Validators may rely on watchers—entities that monitor KELs for duplicity. Choosing which watchers to trust represents a decision point, though watchers cannot forge events, only report observed duplicity.
Credential Issuers: ACDC credentials create trust relationships between issuers and verifiers. While KERI provides cryptographic verifiability of the credential itself, determining which issuers to trust for particular claims remains a policy decision.
OOBI Trust Bootstrap: Out-Of-Band Introductions (OOBIs) provide initial discovery of service endpoints. The OOBI itself is not trusted—it merely bootstraps discovery that is subsequently verified through KERI mechanisms—but the source of the OOBI represents a trust decision point.
Document 73 references "Renewing the Web of Trust" as a KERI presentation title, which reflects KERI's position relative to traditional web-of-trust concepts. KERI renews rather than extends the web of trust by:
Preserving Core Values:
Replacing Technical Mechanisms:
Solving Historical Problems:
The vLEI (verifiable Legal Entity Identifier) ecosystem demonstrates how KERI replaces traditional web-of-trust for enterprise identity:
Traditional Approach: Organizations might accumulate trust through certificates from multiple authorities, with verifiers evaluating which certificate authorities they trust and how many independent validations exist.
KERI/vLEI Approach:
The WebOfTrust GitHub organization structure reflects the architectural departure from traditional web-of-trust:
Modular Protocol Suite: Rather than a single monolithic web-of-trust implementation, the organization maintains separate but interoperable protocols:
This modularity enables independent verification of each component while maintaining composability across the ecosystem.
Multiple Implementations: The organization supports implementations in multiple languages (Python KERIpy, TypeScript SignifyTS, Rust KERIox), enabling:
Direct Mode: KERI supports a direct mode where validators have direct (albeit intermittent) contact with identifier controllers. This is analogous to traditional web-of-trust direct key validation but with cryptographic rather than social validation.
Indirect Mode: The indirect mode uses witnesses and KERLs (Key Event Receipt Logs) as secondary roots of trust. Unlike traditional web-of-trust transitive trust, this provides cryptographic guarantees through:
Registry-Backed Credentials: Public Transaction Event Logs (PTELs) provide verifiable credential registries that are:
This contrasts with traditional approaches requiring trusted certificate revocation lists or OCSP responders.
Security Guarantees:
Operational Advantages:
Ecosystem Benefits:
Cold Start Discovery: KERI identifiers require OOBI for initial service endpoint discovery. Traditional web-of-trust benefits from existing email/keyserver infrastructure, though OOBI provides simpler bootstrap.
Human-Meaningful Identifiers: KERI AIDs are cryptographic strings, not human-meaningful names. The aid|lid couplet model addresses this through verifiable authorization binding AIDs to human-meaningful identifiers, but requires additional infrastructure.
Witness Infrastructure: KERI requires witness infrastructure for indirect mode operation. Traditional web-of-trust requires no additional infrastructure beyond key servers, though witness services provide stronger guarantees.
Learning Curve: Understanding KERI's event-sourced architecture, cryptographic primitives, and protocol interactions requires significant technical knowledge. Traditional web-of-trust concepts map more directly to existing mental models of trust and social validation.
The term "web-of-trust" in the KERI ecosystem context serves dual purposes:
KERI does not implement a web-of-trust in the traditional PGP sense. Instead, it creates a cryptographic web of verifiable events where:
The WebOfTrust GitHub organization name reflects this philosophy: preserving the decentralized, peer-to-peer ethos of the original web of trust while providing fundamentally different—and arguably stronger—technical mechanisms for establishing verifiable digital identity.
For developers working in the KERI ecosystem, "web-of-trust" should be understood as:
This understanding helps position KERI correctly in the broader identity ecosystem: not as an incremental improvement to PGP-style web-of-trust, but as a fundamentally different architecture achieving similar goals through cryptographic rather than social mechanisms.