[Update December 2023: Qui Identity is now goConfirm]
Last week I discussed why we opted not to build Qui on a blockchain, in favour of a technology called KERI.
The KERI ecosystem is robust, but there’s one feature that I find particularly exciting for Qui: Blinded pre-commitments.
KERI relies on public and private keys, and blinded pre-commitments ensure rotation keys are not exposed until their use, while confirming them as designated for control purposes in a previous event.
This makes it nearly impossible for me to determine an appropriate signing key for your rotation event ahead of time; I would need to reverse a hash digest and then a verification key, or use brute force. This is important because rotation events control which signing keys are used to verify your identity, and if I could forge one I could assume control of your identifier.
A KERI identifier cannot be severed from its logs; that’s important. In a centralized architecture, an authority maintains a mapping of identifiers to some identifying information. For example, your webmail provider stores a way to verify your passphrase (identifying information) and binds that to your email address (identifier). But what if one day their application is down? What if they stop offering their service? What if they go out of business? You lose access to your email, and you lose your address.
This is impossible with KERI. A system may stop being usable or discontinue a service with KERI, however, your identifier remains valid, and so does your data. If you still retain control of your rotation keys or passphrase, you can easily rotate from one custodian to another (or yourself).
That’s right: Built into our platform is the functionality to leave and take your identifier and data linked to it to another service, or — and here’s the crowning jewel — take your data entirely into your custody.
User-controlled identity can only be truly user-controlled if it doesn’t depend on someone else’s platform for storing or using identity credentials. With KERI, it’s possible for users to be the custodians of their own data. This is our plan at Qui: As we roll out more functionality, we’ll make it possible for people to take as much control over their own data as they are comfortable with. A path to giving users complete control is critical to Qui’s goals.
Here’s an explanation of KERI, from Krijn Soeteman
https://ksoeteman.nl/2022/08/self-sovereign-identity-can-do-just-fine-blockchain-less/