KERI
Identity Protocol
Community
Details
License Open source — Apache 2.0; KERIpy reference implementation at github.com/WebOfTrust/keripy; KERIA at github.com/WebOfTrust/keria; multiple language implementations under various open licenses
Dev Status 🟢 Active
Dev Status Detail Released / Active (production deployment via GLEIF vLEI; multiple implementations; pre-IETF-final but past alpha and beta; KERIA is the production-grade re-implementation actively developed)
Owner Original specification by Samuel M. Smith (ProSapien); Trust Over IP Foundation (ToIP) stewards the broader specification community; GLEIF stewards the vLEI production deployment
Owner - List
- Trust Over IP Foundation
Governing Body ToIP / LF Decentralized Trust (specification community stewardship) | GLEIF (governs the vLEI production deployment)
Country International (specification development); United States (lead author); ToIP is internationally chartered
Start Year 2019
Stack Python (KERIpy reference); Python (KERIA production); Rust (keri-rs); TypeScript (signify-ts); additional language implementations in development; CESR (Composable Event Streaming Representation) as the wire format
Funding GLEIF (Global Legal Entity Identifier Foundation) for the vLEI production deployment; ToIP Foundation member organizations; various commercial implementers (ProSapien, Provenant, others); DARPA funded early research
Last Investigated Jul 1, 2026
Identity Protocol Attributes
Owner - List
- Trust Over IP Foundation
Origins Self-sovereign identity / Decentralized key management (designed to solve the hard problem of key rotation through pre-rotation, with a ledger-less trust model for identifier verification)
Database Local Key Event Log (KEL) storage per identifier; LMDB is the default backing store in KERIpy; implementations may use other embedded key-value stores; no shared global ledger required
Query Language N/A — KELs are append-only event logs; lookups are by identifier and event sequence
Data Formats CESR (Composable Event Streaming Representation) — KERI's native wire format combining Base64URL text and CBOR binary; JSON serialization for tooling; events are CESR-serialized and cryptographically chained
Mobile Support Yes — Signify (the mobile/edge-agent component) is designed for mobile and constrained-device deployment; signify-ts targets browser and mobile JavaScript environments
Web Support Yes — signify-ts and KERIA's HTTP-based agent architecture support browser-based clients
Native Apps Yes — wallet implementations exist via KERIA agents; multiple commercial and open-source wallets support KERI (e.g. ToIP-aligned wallets and the GLEIF vLEI ecosystem tooling)
Terms Open Source / Free — Apache 2.0
Funds Not separately disclosed at the specification level; GLEIF's vLEI program represents the largest concrete funding stream for KERI-based infrastructure
Based On Pre-rotation key rotation pattern (KERI-original); CESR wire format (KERI-original); hash-chained event logs (KEL pattern, KERI-original); influenced by earlier self-certifying identifier research and Decentralized Key Management Systems (DKMS)
Permissions AID-controlled — control of an identifier is defined by control of the current KEL key state; delegated identifiers enable hierarchical permission patterns; multi-sig thresholds for multi-party permission; capability-style authorization layered separately (e.g. via ACDC chained authorizations)
Authentication & Identity Self-certifying identifiers (AIDs) where the identifier is cryptographically bound to its initial public key(s) via a self-addressing hash; authentication via signed events in the KEL; control is established and maintained through cryptographic key state
Storage Model Per-controller Key Event Log stored locally by the controller and by any witnesses they designate; watchers may also retain copies for verification redundancy; no global shared storage required
Interoperability High within the SSI ecosystem — KERI underlies the did:keri DID method and integrates with W3C VCs via ACDC (Authentic Chained Data Container); interoperates with ToIP's TSP and TRQP; bridges to did:webvh and other DID methods possible through KERI-based attestation
Data Portability High — AIDs are portable by design (ledger-less means identifiers are not bound to any specific infrastructure); KELs can be replicated to any witness or watcher; controllers retain custody of their keys and event history
Governance & Decision Making Trust Over IP Foundation stewardship (multi-stakeholder, foundation-governed); WebOfTrust GitHub organization for reference implementations; GLEIF governance for the vLEI deployment; pre-IETF standardization track for formal protocol specification
Protocol Maturity / Standardization Released / Production-active (GLEIF vLEI is the largest concrete deployment); reference implementations mature; pre-IETF-final (active standardization track at IETF); broad ecosystem adoption in the ToIP-aligned SSI community
Identity Standards KERI itself (self-defining standard); composes with W3C DIDs (via did:keri); composes with W3C VCs (via ACDC); ToIP's TSP and TRQP for trust spanning
Identity Standards - List
DID Methods Supported did:keri (primary, KERI-native); KERI AIDs can also be used in did:webs and other web-anchored DID methods that reference KERI key state; KERI is the identifier substrate, not itself a DID method registry
Key Management Pre-rotation — KERI's signature key management innovation: the next key is committed in advance (as a hash) during the current key's establishment, eliminating the window of vulnerability in traditional key rotation. Post-quantum secure when paired with post-quantum signature algorithms. Supports delegated identifiers for hierarchical key management
Credential Types ACDC (Authentic Chained Data Containers) — KERI's credential format, designed for chained attestations with cryptographic linkage; ACDCs compose with W3C VC patterns; supports schema-based credential definitions
Credential Types - List
Verification Method KEL-based — verification traverses the Key Event Log of the signing identifier to confirm current key state, then verifies the signature against that key state; witnesses provide redundant attestation of KEL events; watchers monitor for KEL forks or anomalies
Privacy Features Selective disclosure via ACDC's chained-credential model; pairwise AIDs supported (one AID per relationship for unlinkability); GDPR-compliant by design — non-intertwined identifier trust bases mean an individual identifier's data can be truly forgotten without affecting other identifiers
Authentication Methods Signed event challenge-response with current KEL key state; mutual authentication via paired KEL exchanges; integration with DIDComm for protocol-level authentication; ACDC-based credential presentation
Revocation Mechanism Key rotation via signed rotation events in the KEL (rotates control to the pre-committed next key); ACDC revocation registries for credential-level revocation; ledger-less so no on-chain revocation lookup required
Agent Types Supported Humans, organizations (notably Legal Entities via vLEI), services, devices, software agents — any entity capable of holding and using cryptographic keys can have a KERI AID; GLEIF vLEI uses KERI for verifiable Legal Entity Identifiers at production scale
Wallet/Client Types KERIA-based agents (HTTP-accessible cloud agents); Signify edge agents (mobile/browser); various wallet implementations in the broader ToIP and GLEIF vLEI ecosystem; ProSapien's commercial offerings
Recovery Mechanisms Pre-rotation provides built-in single-key-compromise recovery (rotate to the pre-committed next key); multi-signature thresholds for multi-party control; delegated identifiers enable hierarchical recovery via parent controller; backup of KEL plus next-key seed material is the foundational recovery primitive
Compliance / Regulations GDPR-compliant by design (non-intertwined identifier trust bases enable true forgetting); GLEIF vLEI compliant with various regulatory frameworks for Legal Entity Identifier use; eIDAS 2.0 alignment work ongoing through ToIP and partner organizations
Credential Exchange Protocols ACDC exchange via DIDComm; native KERI exchange protocols (e.g. mailbox-based message exchange); VC-API compatibility for broader W3C VC ecosystem interop; ToIP's TSP for protocol-level credential spanning
Credential Exchange Protocols - List
Trust Framework Trust Over IP (KERI is foundational to ToIP's identity stack); GLEIF vLEI ecosystem trust framework (authoritative for Legal Entity verification); composable with national and sectoral SSI trust frameworks via ACDC chained attestation
Cost Model Specification is free; reference implementations are open-source; operational costs are deployment-specific (witness/watcher infrastructure, agent hosting); ledger-less design avoids on-chain transaction fees
Censorship Resistance High — KELs can be replicated across any chosen set of witnesses (no global gatekeeper); ledger-less means no chain-level censorship vector; controllers can move their AID's witness set if any individual witness becomes adversarial
Relationships
How this tool connects to other tools and organizations, from relationships reviewed by the OpenHaven data steward. They describe how projects connect, not how good they are.
- Aims to interoperate with
- Bridges to
- Conforms to
- Developed by
- Trust Over IP Foundation
- Member of suite
- KERI Suite
- Speaks protocol
- Composes with
- Interoperates with
- Basis for
- Bridged from
- Conforming implementations
- Identity primitive for
- Inspired
- Others aiming to interoperate with it
- Storage for