KERI
Identity Protocol
Comunidade
Links
Detalhes
Licença Open source — Apache 2.0; KERIpy reference implementation at github.com/WebOfTrust/keripy; KERIA at github.com/WebOfTrust/keria; multiple language implementations under various open licenses
Status de Dev 🟢 Ativo
Detalhe do Status de Dev Released / Active (production deployment via GLEIF vLEI; multiple implementations; pre-IETF-final but past alpha and beta; KERIA is the production-grade re-implementation actively developed)
Proprietário Original specification by Samuel M. Smith (ProSapien); Trust Over IP Foundation (ToIP) stewards the broader specification community; GLEIF stewards the vLEI production deployment
País International (specification development); United States (lead author); ToIP is internationally chartered
Ano de Início 2019
Stack Python (KERIpy reference); Python (KERIA production); Rust (keri-rs); TypeScript (signify-ts); additional language implementations in development; CESR (Composable Event Streaming Representation) as the wire format
Financiamento GLEIF (Global Legal Entity Identifier Foundation) for the vLEI production deployment; ToIP Foundation member organizations; various commercial implementers (ProSapien, Provenant, others); DARPA funded early research
Última Investigação 1 de jul. de 2026
Identity Protocol Atributos
Origins Self-sovereign identity / Decentralized key management (designed to solve the hard problem of key rotation through pre-rotation, with a ledger-less trust model for identifier verification)
Database Local Key Event Log (KEL) storage per identifier; LMDB is the default backing store in KERIpy; implementations may use other embedded key-value stores; no shared global ledger required
Query Language N/A — KELs are append-only event logs; lookups are by identifier and event sequence
Data Formats CESR (Composable Event Streaming Representation) — KERI's native wire format combining Base64URL text and CBOR binary; JSON serialization for tooling; events are CESR-serialized and cryptographically chained
Mobile Support Yes — Signify (the mobile/edge-agent component) is designed for mobile and constrained-device deployment; signify-ts targets browser and mobile JavaScript environments
Web Support Yes — signify-ts and KERIA's HTTP-based agent architecture support browser-based clients
Native Apps Yes — wallet implementations exist via KERIA agents; multiple commercial and open-source wallets support KERI (e.g. ToIP-aligned wallets and the GLEIF vLEI ecosystem tooling)
Terms Open Source / Free — Apache 2.0
Funds Not separately disclosed at the specification level; GLEIF's vLEI program represents the largest concrete funding stream for KERI-based infrastructure
Based On Pre-rotation key rotation pattern (KERI-original); CESR wire format (KERI-original); hash-chained event logs (KEL pattern, KERI-original); influenced by earlier self-certifying identifier research and Decentralized Key Management Systems (DKMS)
Permissions AID-controlled — control of an identifier is defined by control of the current KEL key state; delegated identifiers enable hierarchical permission patterns; multi-sig thresholds for multi-party permission; capability-style authorization layered separately (e.g. via ACDC chained authorizations)
Authentication & Identity Self-certifying identifiers (AIDs) where the identifier is cryptographically bound to its initial public key(s) via a self-addressing hash; authentication via signed events in the KEL; control is established and maintained through cryptographic key state
Storage Model Per-controller Key Event Log stored locally by the controller and by any witnesses they designate; watchers may also retain copies for verification redundancy; no global shared storage required
Interoperability High within the SSI ecosystem — KERI underlies the did:keri DID method and integrates with W3C VCs via ACDC (Authentic Chained Data Container); interoperates with ToIP's TSP and TRQP; bridges to did:webvh and other DID methods possible through KERI-based attestation
Data Portability High — AIDs are portable by design (ledger-less means identifiers are not bound to any specific infrastructure); KELs can be replicated to any witness or watcher; controllers retain custody of their keys and event history
Governance & Decision Making Trust Over IP Foundation stewardship (multi-stakeholder, foundation-governed); WebOfTrust GitHub organization for reference implementations; GLEIF governance for the vLEI deployment; pre-IETF standardization track for formal protocol specification
Protocol Maturity / Standardization Released / Production-active (GLEIF vLEI is the largest concrete deployment); reference implementations mature; pre-IETF-final (active standardization track at IETF); broad ecosystem adoption in the ToIP-aligned SSI community
Identity Standards KERI itself (self-defining standard); composes with W3C DIDs (via did:keri); composes with W3C VCs (via ACDC); ToIP's TSP and TRQP for trust spanning
DID Methods Supported did:keri (primary, KERI-native); KERI AIDs can also be used in did:webs and other web-anchored DID methods that reference KERI key state; KERI is the identifier substrate, not itself a DID method registry
Key Management Pre-rotation — KERI's signature key management innovation: the next key is committed in advance (as a hash) during the current key's establishment, eliminating the window of vulnerability in traditional key rotation. Post-quantum secure when paired with post-quantum signature algorithms. Supports delegated identifiers for hierarchical key management
Credential Types ACDC (Authentic Chained Data Containers) — KERI's credential format, designed for chained attestations with cryptographic linkage; ACDCs compose with W3C VC patterns; supports schema-based credential definitions
Verification Method KEL-based — verification traverses the Key Event Log of the signing identifier to confirm current key state, then verifies the signature against that key state; witnesses provide redundant attestation of KEL events; watchers monitor for KEL forks or anomalies
Privacy Features Selective disclosure via ACDC's chained-credential model; pairwise AIDs supported (one AID per relationship for unlinkability); GDPR-compliant by design — non-intertwined identifier trust bases mean an individual identifier's data can be truly forgotten without affecting other identifiers
Authentication Methods Signed event challenge-response with current KEL key state; mutual authentication via paired KEL exchanges; integration with DIDComm for protocol-level authentication; ACDC-based credential presentation
Revocation Mechanism Key rotation via signed rotation events in the KEL (rotates control to the pre-committed next key); ACDC revocation registries for credential-level revocation; ledger-less so no on-chain revocation lookup required
Agent Types Supported Humans, organizations (notably Legal Entities via vLEI), services, devices, software agents — any entity capable of holding and using cryptographic keys can have a KERI AID; GLEIF vLEI uses KERI for verifiable Legal Entity Identifiers at production scale
Wallet/Client Types KERIA-based agents (HTTP-accessible cloud agents); Signify edge agents (mobile/browser); various wallet implementations in the broader ToIP and GLEIF vLEI ecosystem; ProSapien's commercial offerings
Recovery Mechanisms Pre-rotation provides built-in single-key-compromise recovery (rotate to the pre-committed next key); multi-signature thresholds for multi-party control; delegated identifiers enable hierarchical recovery via parent controller; backup of KEL plus next-key seed material is the foundational recovery primitive
Compliance / Regulations GDPR-compliant by design (non-intertwined identifier trust bases enable true forgetting); GLEIF vLEI compliant with various regulatory frameworks for Legal Entity Identifier use; eIDAS 2.0 alignment work ongoing through ToIP and partner organizations
Credential Exchange Protocols ACDC exchange via DIDComm; native KERI exchange protocols (e.g. mailbox-based message exchange); VC-API compatibility for broader W3C VC ecosystem interop; ToIP's TSP for protocol-level credential spanning
Trust Framework Trust Over IP (KERI is foundational to ToIP's identity stack); GLEIF vLEI ecosystem trust framework (authoritative for Legal Entity verification); composable with national and sectoral SSI trust frameworks via ACDC chained attestation
Cost Model Specification is free; reference implementations are open-source; operational costs are deployment-specific (witness/watcher infrastructure, agent hosting); ledger-less design avoids on-chain transaction fees
Censorship Resistance High — KELs can be replicated across any chosen set of witnesses (no global gatekeeper); ledger-less means no chain-level censorship vector; controllers can move their AID's witness set if any individual witness becomes adversarial