KERI
Protocolo de Identidad
Comunidad
Detalles
Licencia Open source — Apache 2.0; KERIpy reference implementation at github.com/WebOfTrust/keripy; KERIA at github.com/WebOfTrust/keria; multiple language implementations under various open licenses
Estado de Desarrollo 🟢 Activo
Detalle del Estado de Desarrollo Released / Active (production deployment via GLEIF vLEI; multiple implementations; pre-IETF-final but past alpha and beta; KERIA is the production-grade re-implementation actively developed)
Propietario Original specification by Samuel M. Smith (ProSapien); Trust Over IP Foundation (ToIP) stewards the broader specification community; GLEIF stewards the vLEI production deployment
Propietario - Lista
- Trust Over IP Foundation
Órgano de Gobierno ToIP / LF Decentralized Trust (specification community stewardship) | GLEIF (governs the vLEI production deployment)
País International (specification development); United States (lead author); ToIP is internationally chartered
Año de Inicio 2019
Stack Python (KERIpy reference); Python (KERIA production); Rust (keri-rs); TypeScript (signify-ts); additional language implementations in development; CESR (Composable Event Streaming Representation) as the wire format
Financiamiento GLEIF (Global Legal Entity Identifier Foundation) for the vLEI production deployment; ToIP Foundation member organizations; various commercial implementers (ProSapien, Provenant, others); DARPA funded early research
Última Investigación 1 jul 2026
Protocolo de Identidad Atributos
Propietario - Lista
- Trust Over IP Foundation
Orígenes Self-sovereign identity / Decentralized key management (designed to solve the hard problem of key rotation through pre-rotation, with a ledger-less trust model for identifier verification)
Base de Datos Local Key Event Log (KEL) storage per identifier; LMDB is the default backing store in KERIpy; implementations may use other embedded key-value stores; no shared global ledger required
Lenguaje de Consulta N/A — KELs are append-only event logs; lookups are by identifier and event sequence
Formatos de Datos CESR (Composable Event Streaming Representation) — KERI's native wire format combining Base64URL text and CBOR binary; JSON serialization for tooling; events are CESR-serialized and cryptographically chained
Soporte Móvil Yes — Signify (the mobile/edge-agent component) is designed for mobile and constrained-device deployment; signify-ts targets browser and mobile JavaScript environments
Soporte Web Yes — signify-ts and KERIA's HTTP-based agent architecture support browser-based clients
Aplicaciones Nativas Yes — wallet implementations exist via KERIA agents; multiple commercial and open-source wallets support KERI (e.g. ToIP-aligned wallets and the GLEIF vLEI ecosystem tooling)
Términos Open Source / Free — Apache 2.0
Fondos Not separately disclosed at the specification level; GLEIF's vLEI program represents the largest concrete funding stream for KERI-based infrastructure
Basado En Pre-rotation key rotation pattern (KERI-original); CESR wire format (KERI-original); hash-chained event logs (KEL pattern, KERI-original); influenced by earlier self-certifying identifier research and Decentralized Key Management Systems (DKMS)
Permisos AID-controlled — control of an identifier is defined by control of the current KEL key state; delegated identifiers enable hierarchical permission patterns; multi-sig thresholds for multi-party permission; capability-style authorization layered separately (e.g. via ACDC chained authorizations)
Autenticación e Identidad Self-certifying identifiers (AIDs) where the identifier is cryptographically bound to its initial public key(s) via a self-addressing hash; authentication via signed events in the KEL; control is established and maintained through cryptographic key state
Modelo de Almacenamiento Per-controller Key Event Log stored locally by the controller and by any witnesses they designate; watchers may also retain copies for verification redundancy; no global shared storage required
Interoperabilidad High within the SSI ecosystem — KERI underlies the did:keri DID method and integrates with W3C VCs via ACDC (Authentic Chained Data Container); interoperates with ToIP's TSP and TRQP; bridges to did:webvh and other DID methods possible through KERI-based attestation
Portabilidad de Datos High — AIDs are portable by design (ledger-less means identifiers are not bound to any specific infrastructure); KELs can be replicated to any witness or watcher; controllers retain custody of their keys and event history
Gobernanza y Toma de Decisiones Trust Over IP Foundation stewardship (multi-stakeholder, foundation-governed); WebOfTrust GitHub organization for reference implementations; GLEIF governance for the vLEI deployment; pre-IETF standardization track for formal protocol specification
Madurez del Protocolo / Estandarización Released / Production-active (GLEIF vLEI is the largest concrete deployment); reference implementations mature; pre-IETF-final (active standardization track at IETF); broad ecosystem adoption in the ToIP-aligned SSI community
Estándares de Identidad KERI itself (self-defining standard); composes with W3C DIDs (via did:keri); composes with W3C VCs (via ACDC); ToIP's TSP and TRQP for trust spanning
Estándares de Identidad - Lista
Métodos DID Soportados did:keri (primary, KERI-native); KERI AIDs can also be used in did:webs and other web-anchored DID methods that reference KERI key state; KERI is the identifier substrate, not itself a DID method registry
Gestión de Claves Pre-rotation — KERI's signature key management innovation: the next key is committed in advance (as a hash) during the current key's establishment, eliminating the window of vulnerability in traditional key rotation. Post-quantum secure when paired with post-quantum signature algorithms. Supports delegated identifiers for hierarchical key management
Tipos de Credenciales ACDC (Authentic Chained Data Containers) — KERI's credential format, designed for chained attestations with cryptographic linkage; ACDCs compose with W3C VC patterns; supports schema-based credential definitions
Tipos de Credenciales - Lista
Método de Verificación KEL-based — verification traverses the Key Event Log of the signing identifier to confirm current key state, then verifies the signature against that key state; witnesses provide redundant attestation of KEL events; watchers monitor for KEL forks or anomalies
Funciones de Privacidad Selective disclosure via ACDC's chained-credential model; pairwise AIDs supported (one AID per relationship for unlinkability); GDPR-compliant by design — non-intertwined identifier trust bases mean an individual identifier's data can be truly forgotten without affecting other identifiers
Métodos de Autenticación Signed event challenge-response with current KEL key state; mutual authentication via paired KEL exchanges; integration with DIDComm for protocol-level authentication; ACDC-based credential presentation
Mecanismo de Revocación Key rotation via signed rotation events in the KEL (rotates control to the pre-committed next key); ACDC revocation registries for credential-level revocation; ledger-less so no on-chain revocation lookup required
Tipos de Agentes Soportados Humans, organizations (notably Legal Entities via vLEI), services, devices, software agents — any entity capable of holding and using cryptographic keys can have a KERI AID; GLEIF vLEI uses KERI for verifiable Legal Entity Identifiers at production scale
Tipos de Billetera/Cliente KERIA-based agents (HTTP-accessible cloud agents); Signify edge agents (mobile/browser); various wallet implementations in the broader ToIP and GLEIF vLEI ecosystem; ProSapien's commercial offerings
Mecanismos de Recuperación Pre-rotation provides built-in single-key-compromise recovery (rotate to the pre-committed next key); multi-signature thresholds for multi-party control; delegated identifiers enable hierarchical recovery via parent controller; backup of KEL plus next-key seed material is the foundational recovery primitive
Cumplimiento / Regulaciones GDPR-compliant by design (non-intertwined identifier trust bases enable true forgetting); GLEIF vLEI compliant with various regulatory frameworks for Legal Entity Identifier use; eIDAS 2.0 alignment work ongoing through ToIP and partner organizations
Protocolos de Intercambio de Credenciales ACDC exchange via DIDComm; native KERI exchange protocols (e.g. mailbox-based message exchange); VC-API compatibility for broader W3C VC ecosystem interop; ToIP's TSP for protocol-level credential spanning
Protocolos de Intercambio de Credenciales - Lista
Marco de Confianza Trust Over IP (KERI is foundational to ToIP's identity stack); GLEIF vLEI ecosystem trust framework (authoritative for Legal Entity verification); composable with national and sectoral SSI trust frameworks via ACDC chained attestation
Modelo de Costos Specification is free; reference implementations are open-source; operational costs are deployment-specific (witness/watcher infrastructure, agent hosting); ledger-less design avoids on-chain transaction fees
Resistencia a la Censura High — KELs can be replicated across any chosen set of witnesses (no global gatekeeper); ledger-less means no chain-level censorship vector; controllers can move their AID's witness set if any individual witness becomes adversarial
Relaciones
Cómo se conecta esta herramienta con otras herramientas y organizaciones, según relaciones revisadas por el responsable de datos de OpenHaven. Describen cómo se conectan los proyectos, no su calidad.
- Aspira a interoperar con
- Cumple con
- Desarrollado por
- Trust Over IP Foundation
- Habla el protocolo
- Miembro de la suite
- KERI Suite
- Puente hacia
- Interopera con
- Se compone con
- Almacenamiento para
- Base de
- Implementaciones conformes
- Inspiró a
- Otros que aspiran a interoperar con él
- Primitiva de identidad para
- Protocolo hablado por
- Puente desde
- Requerido por