KERI
Protocolo de Identidade
Comunidade
Detalhes
Licença Open source — Apache 2.0; KERIpy reference implementation at github.com/WebOfTrust/keripy; KERIA at github.com/WebOfTrust/keria; multiple language implementations under various open licenses
Status de Dev 🟢 Ativo
Detalhe do Status de Dev Released / Active (production deployment via GLEIF vLEI; multiple implementations; pre-IETF-final but past alpha and beta; KERIA is the production-grade re-implementation actively developed)
Proprietário Original specification by Samuel M. Smith (ProSapien); Trust Over IP Foundation (ToIP) stewards the broader specification community; GLEIF stewards the vLEI production deployment
Proprietário - Lista
- Trust Over IP Foundation
Órgão de Governança ToIP / LF Decentralized Trust (specification community stewardship) | GLEIF (governs the vLEI production deployment)
País International (specification development); United States (lead author); ToIP is internationally chartered
Ano de Início 2019
Stack Python (KERIpy reference); Python (KERIA production); Rust (keri-rs); TypeScript (signify-ts); additional language implementations in development; CESR (Composable Event Streaming Representation) as the wire format
Financiamento GLEIF (Global Legal Entity Identifier Foundation) for the vLEI production deployment; ToIP Foundation member organizations; various commercial implementers (ProSapien, Provenant, others); DARPA funded early research
Última Investigação 1 de jul. de 2026
Protocolo de Identidade Atributos
Proprietário - Lista
- Trust Over IP Foundation
Origens Self-sovereign identity / Decentralized key management (designed to solve the hard problem of key rotation through pre-rotation, with a ledger-less trust model for identifier verification)
Banco de Dados Local Key Event Log (KEL) storage per identifier; LMDB is the default backing store in KERIpy; implementations may use other embedded key-value stores; no shared global ledger required
Linguagem de Consulta N/A — KELs are append-only event logs; lookups are by identifier and event sequence
Formatos de Dados CESR (Composable Event Streaming Representation) — KERI's native wire format combining Base64URL text and CBOR binary; JSON serialization for tooling; events are CESR-serialized and cryptographically chained
Suporte Móvel Yes — Signify (the mobile/edge-agent component) is designed for mobile and constrained-device deployment; signify-ts targets browser and mobile JavaScript environments
Suporte Web Yes — signify-ts and KERIA's HTTP-based agent architecture support browser-based clients
Aplicativos Nativos Yes — wallet implementations exist via KERIA agents; multiple commercial and open-source wallets support KERI (e.g. ToIP-aligned wallets and the GLEIF vLEI ecosystem tooling)
Termos Open Source / Free — Apache 2.0
Fundos Not separately disclosed at the specification level; GLEIF's vLEI program represents the largest concrete funding stream for KERI-based infrastructure
Baseado Em Pre-rotation key rotation pattern (KERI-original); CESR wire format (KERI-original); hash-chained event logs (KEL pattern, KERI-original); influenced by earlier self-certifying identifier research and Decentralized Key Management Systems (DKMS)
Permissões AID-controlled — control of an identifier is defined by control of the current KEL key state; delegated identifiers enable hierarchical permission patterns; multi-sig thresholds for multi-party permission; capability-style authorization layered separately (e.g. via ACDC chained authorizations)
Autenticação e Identidade Self-certifying identifiers (AIDs) where the identifier is cryptographically bound to its initial public key(s) via a self-addressing hash; authentication via signed events in the KEL; control is established and maintained through cryptographic key state
Modelo de Armazenamento Per-controller Key Event Log stored locally by the controller and by any witnesses they designate; watchers may also retain copies for verification redundancy; no global shared storage required
Interoperabilidade High within the SSI ecosystem — KERI underlies the did:keri DID method and integrates with W3C VCs via ACDC (Authentic Chained Data Container); interoperates with ToIP's TSP and TRQP; bridges to did:webvh and other DID methods possible through KERI-based attestation
Portabilidade de Dados High — AIDs are portable by design (ledger-less means identifiers are not bound to any specific infrastructure); KELs can be replicated to any witness or watcher; controllers retain custody of their keys and event history
Governança e Tomada de Decisão Trust Over IP Foundation stewardship (multi-stakeholder, foundation-governed); WebOfTrust GitHub organization for reference implementations; GLEIF governance for the vLEI deployment; pre-IETF standardization track for formal protocol specification
Maturidade / Padronização do Protocolo Released / Production-active (GLEIF vLEI is the largest concrete deployment); reference implementations mature; pre-IETF-final (active standardization track at IETF); broad ecosystem adoption in the ToIP-aligned SSI community
Padrões de Identidade KERI itself (self-defining standard); composes with W3C DIDs (via did:keri); composes with W3C VCs (via ACDC); ToIP's TSP and TRQP for trust spanning
Padrões de Identidade - Lista
Métodos DID Suportados did:keri (primary, KERI-native); KERI AIDs can also be used in did:webs and other web-anchored DID methods that reference KERI key state; KERI is the identifier substrate, not itself a DID method registry
Gestão de Chaves Pre-rotation — KERI's signature key management innovation: the next key is committed in advance (as a hash) during the current key's establishment, eliminating the window of vulnerability in traditional key rotation. Post-quantum secure when paired with post-quantum signature algorithms. Supports delegated identifiers for hierarchical key management
Tipos de Credenciais ACDC (Authentic Chained Data Containers) — KERI's credential format, designed for chained attestations with cryptographic linkage; ACDCs compose with W3C VC patterns; supports schema-based credential definitions
Tipos de Credenciais - Lista
Método de Verificação KEL-based — verification traverses the Key Event Log of the signing identifier to confirm current key state, then verifies the signature against that key state; witnesses provide redundant attestation of KEL events; watchers monitor for KEL forks or anomalies
Recursos de Privacidade Selective disclosure via ACDC's chained-credential model; pairwise AIDs supported (one AID per relationship for unlinkability); GDPR-compliant by design — non-intertwined identifier trust bases mean an individual identifier's data can be truly forgotten without affecting other identifiers
Métodos de Autenticação Signed event challenge-response with current KEL key state; mutual authentication via paired KEL exchanges; integration with DIDComm for protocol-level authentication; ACDC-based credential presentation
Mecanismo de Revogação Key rotation via signed rotation events in the KEL (rotates control to the pre-committed next key); ACDC revocation registries for credential-level revocation; ledger-less so no on-chain revocation lookup required
Tipos de Agentes Suportados Humans, organizations (notably Legal Entities via vLEI), services, devices, software agents — any entity capable of holding and using cryptographic keys can have a KERI AID; GLEIF vLEI uses KERI for verifiable Legal Entity Identifiers at production scale
Tipos de Carteira/Cliente KERIA-based agents (HTTP-accessible cloud agents); Signify edge agents (mobile/browser); various wallet implementations in the broader ToIP and GLEIF vLEI ecosystem; ProSapien's commercial offerings
Mecanismos de Recuperação Pre-rotation provides built-in single-key-compromise recovery (rotate to the pre-committed next key); multi-signature thresholds for multi-party control; delegated identifiers enable hierarchical recovery via parent controller; backup of KEL plus next-key seed material is the foundational recovery primitive
Conformidade / Regulamentações GDPR-compliant by design (non-intertwined identifier trust bases enable true forgetting); GLEIF vLEI compliant with various regulatory frameworks for Legal Entity Identifier use; eIDAS 2.0 alignment work ongoing through ToIP and partner organizations
Protocolos de Troca de Credenciais ACDC exchange via DIDComm; native KERI exchange protocols (e.g. mailbox-based message exchange); VC-API compatibility for broader W3C VC ecosystem interop; ToIP's TSP for protocol-level credential spanning
Protocolos de Troca de Credenciais - Lista
Estrutura de Confiança Trust Over IP (KERI is foundational to ToIP's identity stack); GLEIF vLEI ecosystem trust framework (authoritative for Legal Entity verification); composable with national and sectoral SSI trust frameworks via ACDC chained attestation
Modelo de Custo Specification is free; reference implementations are open-source; operational costs are deployment-specific (witness/watcher infrastructure, agent hosting); ledger-less design avoids on-chain transaction fees
Resistência à Censura High — KELs can be replicated across any chosen set of witnesses (no global gatekeeper); ledger-less means no chain-level censorship vector; controllers can move their AID's witness set if any individual witness becomes adversarial
Relacionamentos
Como esta ferramenta se conecta a outras ferramentas e organizações, a partir de relacionamentos revisados pelo responsável pelos dados do OpenHaven. Descrevem como os projetos se conectam, não a qualidade deles.
- Desenvolvido por
- Trust Over IP Foundation
- Está em conformidade com
- Fala o protocolo
- Membro da suíte
- KERI Suite
- Ponte para
- Pretende interoperar com
- Compõe-se com
- Interopera com
- Armazenamento para
- Base de
- Implementações em conformidade
- Inspirou
- Outros que pretendem interoperar com ele
- Primitiva de identidade para
- Protocolo falado por
- Requerido por