  An identity system based secure overlay for the Internet is presented. This
includes a primary root-of-trust in self-certifying identifiers. It presents a
formalism for Autonomic Identifiers (AIDs) and Autonomic Namespaces (ANs). They
are part of an Autonomic Identity System (AIS). This system uses the design
principle of minimally sufficient means to provide a candidate trust spanning
layer for the internet. Associated with this system is a decentralized key
management infrastructure (DKMI). The primary root-of-trust are self-certifying
identifiers that are strongly bound at issuance to a cryptographic signing
(public, private) key-pair. These are self-contained until/unless control needs
to be transferred to a new key-pair. In that event an append only chained
key-event log of signed transfer statements provides end verifiable control
provenance. This makes intervening operational infrastructure replaceable
because the event logs may be therefore be served up by ambient infrastructure.
End verifiable logs on ambient infrastructure enables ambient verifiability
(verifiable by anyone, anywhere, at anytime). The primary key management
operation is key rotation (transference) via a novel key pre-rotation scheme.
Two primary trust modalities motivated the design, these are a direct
(one-to-one) mode and an indirect (one-to-any) mode. In the direct mode, the
identity controller establishes control via verified signatures of the
controlling key-pair. The indirect mode extends that trust basis with witnessed
key event receipt logs (KERLs) for validating events. The security and
accountability guarantees of indirect mode are provided by KERIs Agreement
Algorithm for Control Establishment (KACE) among a set of witnesses.
