henkvancann
commented
5 months ago What is the legal status of what you do with KERI, how does it meet regulations and law?
KERI wizard answer curated:
The legal status of KERI (Key Event Receipt Infrastructure) is important for its acceptance and integration into existing legal frameworks. KERI, as an open source decentralized identifier system, must adhere to various legal and regulatory standards, particularly those concerning digital identity, data protection, and cybersecurity. Here's how KERI meets these requirements:
Legal and Regulatory Compliance
Data Protection Regulations (GDPR in Europe):
Data Minimization and User Control: KERI ensures that users have control over their data. Users can manage their cryptographic keys, with which all sensitive data can be encrypted without binding to the control of the keys, thus maintaining privacy and minimizing data exposure.
Consent Management: Users must give explicit consent for any data sharing, aligning with GDPR requirements for data subject consent. They do so by allowing access to encrypted data and supplying public keys to verify signatures.
Right to Be Forgotten: Although KERI uses immutable ledgers, the system can be designed to revoke and retire identifiers to comply with the right to be forgotten by making identifiers inactive without altering historical data.
Electronic Identification, Authentication and Trust Services (eIDAS) Regulation:
Qualified Electronic Signatures: KERI can integrate with Qualified Electronic Signature (QES) providers, ensuring that signatures made using KERI infrastructure are legally binding across EU member states.
Interoperability and Certification: KERI's infrastructure can be certified under schemes such as those provided by eIDAS to ensure its components meet high-security standards. The use of common protocols and standards ensures interoperability with other digital identity solutions.
Cybersecurity Standards:
Certification and Auditing: KERI components can undergo certification processes to ensure they meet cybersecurity standards such as those outlined in the EU Cybersecurity Act. Regular audits and conformity assessments could be done, but are not needed, because KERI is inherently and proven secure.
Encryption and Key Management: KERI start off from the precondition that a controller needs to his/her secrets secret. The use of strong but seasoned cryptographic functions ensure that all data is securely encrypted. KERI advises for private keys to be managed in secure environments, complying with global standards for cybersecurity.
Meeting Specific Legal Requirements
Mutual Authentication and Secure Transactions:
Authentication Protocols: KERI uses robust mutual authentication protocols to ensure that both parties in a transaction can verify each other's identities securely. This aligns with legal requirements for secure electronic transactions.
User Awareness and Authorization: The system includes mechanisms for controller (user) awareness and explicit authorization. All transactions are peer to peer and signing happens on the edge. Thus users know about who is requesting their data and for what purpose, thereby creating transparency and informed consent.
Integration with National and International Frameworks:
Interfacing with National ID Systems: KERI can interface with national identity systems and electronic identification cards (e.g., EU Member States' identity cards), providing seamless integration and compliance with national legal frameworks.
Compliance with the European Digital Identity Framework: As detailed in the European Digital Identity (EUDI) Wallet architecture, KERI supports the functionalities required for electronic identification and trust services within the EU.
EUDI Wallet Functionalities
KERI aligns with the proposed functionalities of the EUDI Wallet, which include:
Storage and Management of Personal Identification Data: Securely storing and managing qualified electronic attestations and personal identification data, both locally and remotely.
Cryptographic Functions: Providing secure cryptographic functions for identification, authentication, and electronic signatures.
User Interface for Awareness and Authorization: Ensuring users are aware of and authorize data transactions, promoting transparency and user control.
Conclusion KERI's infrastructure is designed to meet stringent legal and regulatory requirements by integrating advanced cryptographic techniques, robust authentication mechanisms, and comprehensive user control features. By adhering to GDPR, eIDAS, and other relevant cybersecurity standards, KERI ensures that its operations are legally compliant and secure, fostering trust and acceptance among users and relying parties alike. This compliance is essential for its adoption in various regulatory environments and its integration into national and international digital identity frameworks.
Forgetting
There are three ways that forgettability can be provided by the identity system. The proposed identity system could eventually support all three methods of forgetting.
The first way is to just to delete the encryption keys. Once all copies of the encryption key is deleted there is no way to decrypt the data. Another approach is to make the data nonretrievable by deleting certain number of shares in thresholdstorage protocols. The users might need to explicitly waive the right to have the encrypted data deleted and accept key deletion as sufficient for forgetting.
Another way is to use time limited ledgers. The transaction ledgers can be checkpointed every certain period of time so that the ledger is essentially closed out and started over. Current transactions are brought forward and entered anew in the ledger but stale transactions are deleted. As mentioned previously, a distributed consensus pool can act as a trusted third party enabling triple signed transaction receipts. In a triple signed transaction, both sides of the exchange and the notary all sign the transaction. A receipt can be generated that is proof of the transaction. The transaction can be deleted from the ledger, but each party can keep a copy of the receipt that proves all three parties agreed to the transaction. This allows transactions to be “forgotten” from the public ledger.
The final way is to use a mutable database in concert with the metadata transaction ledger. The consensus pool manages the transactions in the database including change or delete transactions. The metadata includes a full audit trail including the delete transactions. This is analogous to accounting systems where transactions can’t be deleted but a subsequent transaction can undo the previous transaction. The ledger of transactions is immutable but the data in the database is mutable.
from: https://github.com/SmithSamuelM/Papers/blob/master/whitepapers/Identity-System-Essentials.pdf
kentbull
Questions about KERI:
What is the legal status of what you do with KERI, how does it meet regulations and law?
How to integrate KERI in a solution, anticipating the requests eIDAS organisational wallets, at scale, have?
ARF eIDAS - a comparison with KERI features
Is Bridging possible and if so what a the integration cost
What enables KERI: what do you need to get going, what are the infrastructural costs, etc.
A main question is: Eidas2, EUDI wallet and basically the ARF is becoming mandatory for EU in all levels of industry. If you force all companies on EUDI, how GLEIF want to enforce keri in addition to the companies?
Does KERI really brings so much value in comparison to the law-enforced eidas regulation, that companies would think for vLEI?
This issue tries to answer these DICE sponsor questions. These people are in businesses that'll earn money in the future to control EUID holders for governments. It's a federated design (eIDAS). To become a member of the gang (QI) they have to conform to an ARF. I've fed our KERI Wizard (chatGPT) all these documents and started asking the questions. Here are the results of the questions in chat GPT 'KERI wizard': https://chatgpt.com/share/1cdcb4db-467c-4fc4-a208-8174ffc93bcf
What I do here in this issue, copy each answer in the comments below, find the gibberish (hallucinations of chatGPT), take it out and amend the content in general. So you don't need to check the chatGPT result, it's in the comments of this issue already and then we improve it here.
My question to you is: could you go over the answers and point me to KERI parts, features or characteristics that I forgot to mention? You can comment on each comment.