Decentralized Public Key Infrastructure (DPKI)

DPKI anchors cryptographic key material and revocation states to a distributed ledger or decentralized network rather than a centralized database. This ensures that no single administrative entity can unilaterally modify or delete key records. The ledger acts as an append-only, tamper-evident log where DID Documents and key hashes are timestamped and immutably recorded. This architecture prevents the silent key substitution attacks that plague traditional PKI, where a compromised CA can issue fraudulent certificates without detection.

Unlike traditional PKI where identifiers are assigned by a central authority, DPKI uses self-certifying identifiers that are cryptographically derived from the public key itself. A Decentralized Identifier (DID) is generated by the identity owner, who retains exclusive control over the corresponding private key. This eliminates the need for a registration authority to vouch for the binding between an identifier and its key. The identifier becomes a cryptographic commitment—anyone can verify that the controller of a DID possesses the associated private key without consulting a third party.

DPKI enables cryptographic key rotation while maintaining a persistent, stable identifier. When a private key is compromised or requires upgrading, the identity owner publishes a new key to their DID Document on the verifiable data registry. The previous key is revoked, and the new key is cryptographically linked to the same identifier. This is fundamentally different from traditional PKI, where a certificate renewal effectively creates a new cryptographic identity. DPKI's rotation mechanism supports forward secrecy and allows organizations to maintain long-lived identifiers across decades of cryptographic evolution.

Traditional certificate revocation relies on centralized Certificate Revocation Lists (CRLs) or the Online Certificate Status Protocol (OCSP), both of which introduce latency and single points of failure. DPKI implements decentralized revocation registries using cryptographic accumulators or bitstring structures stored on distributed ledgers. A verifier can independently check the revocation status of a credential by querying the registry directly, without routing through a CA. This architecture eliminates the OCSP stapling dependency and ensures that revocation information is globally consistent and instantly verifiable.

DPKI is designed to be ledger-agnostic, meaning the identity layer operates independently of any specific blockchain or distributed network. Protocols like the Sidetree Protocol and KERI (Key Event Receipt Infrastructure) abstract the anchoring mechanism, allowing DIDs to be registered on Bitcoin, Ethereum, Hyperledger, or even permissioned ledgers. This architectural separation ensures that an organization's identity infrastructure is not locked into a single vendor or consensus mechanism. The verifiable data registry becomes a pluggable component, enabling enterprises to select the trust anchor that meets their regulatory and operational requirements.

DPKI establishes a transitive trust model based on cryptographic proofs rather than institutional reputation. In traditional PKI, trust flows downward from root CAs through intermediate CAs to end-entity certificates—a chain that collapses if any link is compromised. DPKI replaces this with self-verifying proofs where each entity's public key is independently resolvable and verifiable against the ledger. A verifier does not need to trust a CA; they only need to trust the mathematics of the cryptographic algorithms and the integrity of the distributed ledger. This removes the trusted third party from the security equation entirely.