Ten Axioms for Digital Identity Design

Guest Post by Ben Taylor, CEO of LedgerDomain,
of the Trusted AI Agents Working Group

Abstract

AI terraforms the cybersecurity and fraud landscape by making many previously academic, impractical, or expensively social attacks trivially cheap. This essay presents ten hard constraints on today's identity system. All modern identity systems must include defenses against all ten of these constraints.

Prologue

Losing your fingers: January 2025, France

In the early hours of a Tuesday morning, David Balland and his wife were taken from their home and bundled into a delivery van by four men wearing balaclavas. His kidnappers chopped off his finger and sent it to his co-founder as proof of life, with a demand for ten million euros. Elite French police foiled the plot, and David was lucky to lose only a finger. ^[1]

David is the co-founder of Ledger, maker of the most widely used hardware cryptocurrency wallets in the world, designed to keep secret keys safe on well-managed hardware, and thus at a remove from every known digital-only attack method.

Globally, “wrench attacks” (named after Bruce Schneier’s caustic observation that a five-dollar wrench is sometimes more effective than a million-dollar cryptographic attack) ^[2]–jumped 75% in the last year, averaging two weekly attacks in France alone^[3]. Given the millions to be gained, plenty of attackers are going to these extremes.

Defining the axioms: September 1948, Pasadena

Shortly after World War II, twelve outstanding scientists joined Nobel laureate Linus Pauling at Caltech for the Hixon Symposium. The event included Warren McCulloch, who with Walter Pitts had proven that neural networks could compute any logical function; Karl Lashley of Harvard, whose work on memory set the behavioral frame; and John von Neumann, then building the earliest stored-program computers^[4].

Von Neumann was famous for stripping any domain to its mathematical skeleton, identifying the irreducible axioms, and reconstructing the systems. He had produced axioms for quantum mechanics and game theory, and was working on the fundamentsals for computing and even for life itself. The Hixon participants postulated that information has a cost, that memory has limits, that centralized control creates fragility, and that the security of a message rests on the secrecy of the key rather than the security methods. The resulting fundamental axiom is that any system which ultimately depends on one human being to cooperate is vulnerable to any adversary who can control that human being’s body. Scientists understood all of this in 1948. It's just as true today as it was back then.

Let us do what von Neumann would have done. Let us axiomatize the problem.

The ten axioms at a glance. Each is the irreducible constraint on one functional layer of an identity system.

Axiom One: The Janitor’s Key Ring

Every centralized identity system tends toward a single point of omnipotent access and a single point of failure.

Think back to your elementary school: lockers, locked classrooms, a locked principal’s office. Each area with secure and separate access. But what about the janitor with his enormous ring of keys?

This is not a one-off failure of implementation, but rather a necessary consequence of centralization. Every centralized system requires at least one actor who can override all the others. That actor isn't necessarily the person who is the highest paid or most authoritative, either. The janitor doesn't have seniority over the principal just as the DevOps System Administrator isn't the CEO. She's just the one person with everyone's access keys to everything.

Saltzer and Schroeder codified the principle of least privilege in 1975^[5]. The principle is taught in every information-systems curriculum but violated in almost every enterprise deployment, because recovering from catastrophe is easiest when a single key opens everything. Whethger it's a locked-out administrator, a corrupted database, or a security break. It's easy to manage when one person has the one, and much more complex and expensive, if you have to hunt down multiple people or multi-factor authentication procedures. The janitor is the convenient solution to the recovery problem. And, of course, there are a multitude of ingenious ways to get a hold of his keys. Compromising a master key opens every lock at once, which is why the major enterprise breaches of the last decade targeted elevated credentials, rather than limiting themselves to gaining control of individual user accounts.

The technical solution is rarely used. A system can require several independent parties to act together in an m-of-n arrangement. The internet’s own root of trust is built this way: the DNSSEC key anchoring the entire domain name system is protected by a Shamir scheme split among seven Recovery Key Share Holders across continents, five of whom must physically convene to reconstruct it. It’s a textbook design and, to our knowledge, its disaster-recovery path has never been exercised in real life.^[6]

Faced with a small risk of abuse versus the acute humiliation of being locked out of one’s own system, most people implicitly choose the master key. Ross Anderson documented the institutional version in 1994: retail banks whose systems failed not through broken cryptography but because the institutions would sooner accuse their own customers of theft than admit their security was in disarray^[7].

Axiom Two: The Melting Clock

Security is a cost-of-compute problem, and compute gets cheaper over time.

Claude Shannon proved in 1949 that exactly one cryptographic system is unconditionally secure: the one-time pad.8 Everything else is secure only insofar as the costs of breaking the encryption are too high, or impossible to assemble within the time frame needed to produce the secret key. Today, a variety of actors, including nation-state adversaries, anticipating quantum computing are collecting data they can't read today in anticipation of being able to read it tomorrow. Such bad actors are collecting and storing reams of encrypted traffic, particularly bulk-signed or ambiently-verifiable traffic such as DKIM-signed emails. Theyt calculate that it will be useful once they get their hands on quantum computers running Shor’s algorithm. This bulk-collection is colloquially refered to as “Harvest Now, Decrypt Later” strategies^[8].

One famous example is the Enigma machine used by the Nazis in World War II. More than 150 quintillion configurations offered apparently infinite security–but Alan Turing's Bombe machine dramatically lowered the time and human brainpower required to find the key matches for the daily code. One modern reconstruction estimates that a brute-force requiring centuries at the time, run on modern computers, can be executed in roughly three minutes^[9].

Every system has a compute horizon. Shannon proved only one escape exists, and it is impractical at scale. Our response is to keep rotating keys and keep upgrading algorithms, in the belief that current attacks and future attacks need to be mitigated orthogonally. In our own work, we build systems whose historical records remain verifiable after the methods that created them are superseded, keep realistic expectations about post-compromise security and not overindexing on current costs to attack. The clock is always melting. Zoom out and design for it in the long-term.

Axiom Three: The Witness Problem

A secret is only as secure as the moment of its creation. Each time it is used counts as an exposure.

Every key has a birth event. Someone generated it; something witnessed the generation; the security of everything the key ever protects reaches backward to that moment. In 2019, for example, attackers compromised SolarWinds’ build environment. For eighteen months, malicious code was inserted at compilation, before the legitimate certificate was applied. SolarWinds itself then signed the poison and shipped it to 18,000 organizations including the Pentagon and the Treasury^[10]. No downstream verification could detect it, because the verification tool was itself the product of the corrupted genesis. The U.S. government’s Venona project expressed the same axiom differently: Soviet one-time pads were reused. The key was witnessed more than once, and that alone unraveled years of otherwise impenetrable traffic^[11].

The design principle is simple in the abstract: the key owner should generate their own keys. The analogy is the voting booth: the poll worker confirms your eligibility and hands you a ballot, but you mark it in private. The authority establishes identity; the individual holds the genesis. This is partial self-sovereignty. Any system where a third party generates your keys has extended the attack surface backward into their infrastructure.

But genesis is only the first "witness event". Imagine the "witness set" of a secret as a list of vulnerable entities: every person, device, and service that has ever had the opportunity to observe it. Two facts follow. The witness set always grows; ones witnessed, something cannot be un-witnessed. Every intelligent witness eventually becomes a correlated witness: whatever a networked, retaining, AI-adjacent system saw, the adversary can eventually see. Venona was not a genesis failure, but rather a failure of re-witnessing. The only way to cover every practical precaution at once is to prefer witnesses that are few, dumb, offline, and destroyable.

Consider emailing a sensitive document through a free webmail service. One act adds your device, the provider’s storage and scanning pipelines, the recipient’s device, both parties’ archives, and every future breach of either account. This one act involves many witnesses, all intelligent, all online, none destroyable^[12].

Now consider a dumb non-networked USB flatbed scanner and a factory-fresh thumb drive, handed over in person. This involves two witnesses, both dumb, both offline, one destroyable. The same doctrine indicts the personal smartphone, the most heavily witnessed environment a human has ever carried. Smartphones include third-party keyboards functioning as keystroke witnesses; camera synchronization with with a photographed seed phrase to the cloud; clipboard replication across devices; and interoperable apps. Malware can convert a device’s entire observation history to the adversary retroactively. Researchers have recovered keystrokes from ordinary call audio at 93–95% accuracy^[13].

Increasingly the consensus is to pay a little more for better witnesses and shorter witness-sets. Generate keys on dedicated silicon. Never photograph or screengrab a secret. Never allow one into a clipboard. Mute the microphone while typing a password. The device that performs signing operations should never browse. A hardware wallet casts this rule into silicon (and specialist production fabs).

Axiom Four: The Secret Limit

Humans can hold approximately six secrets before one escapes.

In 1956 George Miller published the most cited paper in cognitive psychology: working memory holds roughly seven chunks before the oldest is displaced^[14]. A seventh secret evicts one of the others. This is one reason that password reuse across contexts is essentially universal to human actors.

Passkeys are a genuine advance against this axiom. A FIDO2 passkey, held in device hardware behind a biometric or PIN, cannot be verbally surrendered. The private key never leaves the Secure Enclave^[15]. There is no string of words to extract. Compare bitcoin’s BIP39 seed phrase – twelve or twenty-four words designed to be memorable so you can rebuild your wallet after the house fire–and equally surrenderable under coercion. The attacker only needs you to speak.

Passkeys solve the surrender problem. They do not solve the coercion problem. That distinction is Axiom Five.

Axiom Five: The Embodiment Problem

You can build a credential that cannot be surrendered. You cannot build a credential that cannot be coerced.

Let’s go back to David Balland. He built the best hardware the industry offers. His keys were never transmitted, never in the cloud, never on a network, never in a clipboard. None of it mattered when the proverbial “guy with a wrench” knocked on his door. Every system that relies on one human being to cooperate is vulnerable to any adversary who can control that human being’s body. Cryptography operates at the level of mathematics; coercion operates at the level of pain, fear, and people you care about.

Surrender resistance means, in practice, that the credential cannot be communicated. Passkeys achieve this; there is nothing to give. Coercion resistance means the credential cannot be used by an adversary who controls the owner’s body. Passkeys do not achieve this; a hand can be placed on a sensor, a face held to a camera. The five-dollar wrench still works. Partial measures exist: SOE radio operators embedded pre-agreed errors in transmissions to signal capture^[16]; the Edge wallet’s Duress Mode reveals a convincing decoy account under a separate PIN^[17].

But people are stronger together (or apart). If significant action requires, say, three of five designated parties–a spouse in one country, a lawyer in another, a colleague, a device in a vault, then no single adversary can effectively control enough of those bodies to meet the requirement. A gang can hold one person hostage at a vastly lower operational cost and risk than simultaneously holding five hostages across multiple continents.

Coercion is a broad category that includes its lawful variant: subpoenas, national-security letters, exit bans. No single legal system should be able to compel a quorum, any more than a single crime group should be able to easily seize a quorum. Combined with time-locked transactions that give co-signers room to veto, the m-of-n model makes single-person coercion structurally insufficient.

Axiom Six: The End of Obscurity

AI eliminates the last refuge of security by hiding.

Kerckhoffs stated the principle in 1883: a system should be secure even if everything about it, except the key, is public^[18]. Security through obscurity is a bet that the adversary will be distracted. Until recently, it was reasonable to assume that most information goes unnoticed. Systematic analysis was expensive. Logs were generated but not read. Feeds were recorded but not watched. Patterns were present but not detected or correlated.

AI has ended this reasonable assumption. At trivial cost or delay, AI consumes every log, correlates every metadata trail. Most relevant to human bodies, , and most relevant to David Balland, it identifies from public blockchain data, social media, and property records exactly who holds significant cryptocurrency and (merged with a few offchain records bought trivially on the open data brokerage market), where those humans live. The wrench epidemic is the direct consequence of this shift in data-driven attack "feasibility": the target-acquisition problem that once made such attacks so expensive can be purchased by the token.

The same force closes the loop on Axiom Three: every intelligent witness a secret has ever had is now a witness the adversary can eventually interview. Kerckhoffs was prescient in 1883. AI has made his principle mandatory. Any system that depends on the adversary not knowing who holds the secret has already failed in our age of trivial deanonymization from data exhaust.

Axiom Seven: The Hybrid Trap

The combination of any centralized system with any decentralized system produces the worst properties of both.

Stated plainly as a rule of composition, decentralization is not inherited by adjacency. If a centralized system is recognized as fragile and distributed attributes are added on top, is that more secure?

Apply a simple diagnostic, call it the phone-home test. If verifying an identity, a credential, or a certificate requires contacting that identity, credential or certificate's issuer at the moment of verification, the system is "hybrid", and this axiom applies.

Modern OAuth is the everyday example of this hybridity. Even for portable attributes packaged for end users as verifiable credentials, every presentation flow phones home to the identity provider's authorization server. This phone home is required to validate that the credential is still valid (non-revocation check), and to fetch the signing key. These authorization servers typically are managed services owned by a handful of middleware providers. The end-user's identity and claims are both portable in theory. However, in reality the claims and identity are residents of Mountain View and therefore subject to log-gobbling machine-learning vigilant for anomylies and temporal coincidences.

The phone-home is not a mere engineering convenience. It is the foundational building block of every surveillance society. Every call home is a record; every record, a log of behavior; every log, accumulated and aggregated at the convenience of various queriers, a tool of control at scale. It is definitely a convenient architecture, espeically for parties other than the data subject and the verifier.

This isn't just about login screens and credential-presentation front-ends. The web’s own certificate plumbing phones home for structural trust (like the S on every HTTPS call). Every OCSP revocation check tells a certificate authority which site the user is visiting, right now. When the Dutch certificate authority DigiNotar was breached in 2011 and its forged Google credential was turned against the public, the Fox-IT investigators identified the roughly 300,000 surveilled users–almost all in Iran–from the OCSP logs themselves[^20 ]. The phone-home built to protect them flipped to expose the victims.

A particularly dramatic example from the cryptocurrency world: the Ronin Network advertised five-of-nine multisig. In fact one company, Sky Mavis, operated four of the nine validators, and had been allowlisted in November 2021 to sign for a fifth. When attackers breached Sky Mavis in March 2022, all five required signatures were reachable and so was $625 million in assets^[19]. "Decentralized" on the label. Janitor behind the curtain. The worst of both worlds.

Axiom Eight: Zooko’s Trilemma and Its Resolution

Human-meaningful, decentralized, and secure – choose any two. Until recently.

Zooko Wilcox-O’Hearn described the constraint in 2001: any naming system delivers at most two of three properties: names that are human-meaningful, decentralized, and secure ^[20]. Domain names are meaningful and secure, but a central registrar hands them out. Bitcoin addresses are decentralized and secure, but no human reads 1A1zP1eP…. Nicknames are meaningful and decentralized, but nothing stops two people from claiming “Dr. Smith,” or a scamming impostor from claiming it before the actual Dr. Smith in any context where money is on the line. For decades you genuinely had to choose. The trilemma was axiomatic; a certain style of architecture followed logically for decades.

The resolution is to stop demanding one name do all three jobs, and split the work across two layers, which in many use cases can be achieved as simply as using two names bidirectionally linked, or linkable by offline, offchain secure transactions like VC presentations. A W3C Decentralized Identifier anchored in a microledger supplies the decentralized, secure half of the token: a machine-readable identifier no registrar controls and no impostor can forge. A verifiable credential supplies the human-meaningful half: a signed, checkable claim pinning a readable label – “Dr. Jane Smith, licensed dispensing pharmacist” – onto that identifier. A contact card that can prove itself, in the cryptographic sense of "prove".

Neither layer satisfies all three properties alone; stacked in the right context, say over a nonce or a binding agreement to delete evidence after a period of time, they do. And note what the stack does not require: the credential verifies by signature, not by calling anyone and adding witnesses to the set: it passes the phone-home test. This is also why passkeys work: device-bound key below, human-facing login above.

Zooko’s Trilemma, resolved: a decentralized, secure identifier below; a human-meaningful credential above.

Axiom Nine: The Perimeter Fallacy

Security models assume the threat is outside. With AI agents, the caller is in the house.

The castle, with its walls, moat and gate, is the oldest security metaphor and enterprise networking inherits it directly. Zero Trust, in Kindervag’s canonical 2010 framework, stipulates what we already know: the caller is in the house^[21]. AI agents are the new “caller in the house,” particularly as software vendors at every layer of the stack (including operating systems!) are all but forcing non-deterministic logging and transcription features into every piece of software we touch. Your agent, are now authorized to read email, write code, query databases, call APIs, and execute transactions, all from inside the perimeter that was designed to exclude any unauthorized actors and the coordinated threats they might knowingly or unknowingly be supporting. Even worse, some company or software supposedly working on your behalf has deployed multiple agents connected to you. You may or may not have any type of consent or even awareness that these agents are acting as representations of your intent. The attack surface is a continuously changing map of what each agent can reach. Securing it requires not just a bigger, better moat but also an immutable audit log: a cryptographically verifiable record of what each agent can reach, has reached, and has sent beyond the perimeter.

Axiom Ten: The Dead Key Problem

Identity systems that don’t maintain historical state are doomed to forget.

All keys die. They are revoked, rotated, or expire. Key mortality is how security renews itself. But dead keys leave living records: every signature made by a dead key was real when it was made, and could be contributing to the resurrection of a lost key.

If the key that signed a clinical-trial record in 2020 has rotated forty times by 2035, fully verifying that record requires an unbroken chain of certificate archives through every migration and acquisition in between. In practice the chain breaks if a single rotation event was badly logged or recorded by a less-than-rigorously duplicated logging system, and that 2020 record becomes unverifiable. An unverifiable record is worthless to a regulator, a court, or an auditor. The signature industry’s own patch concedes the point twice over: the PAdES long-term-validation standard exists because default signatures stop verifying – and it works precisely by embedding the validation evidence in the document itself, removing the phone-home, so the record could be verified offline, decades later, by anyone^[22].

The Inca understood the problem centuries before it involved silicon and global supply chains. Their empire administered twelve million people across two and a half million square miles largely through the quipu – knotted-string records of census, tribute, and stores – verifiable by any trained reader, anywhere, at any time^[23]. The specialists who kept them, the quipucamayoc, were marked to be identifiable within a crowd: symbolically stretched earlobes weighted with gold earspools, they were referred to as the orejones, “the big-eared ones.” Extending the analogy, we could say the quipu was the audit log and transactional ledger – what happened, when, in what quantity – while the quipucamayoc embodied the key transparency log, the trusted identity layer authorizing the reading and writing of records^[24]. It was a pretty airtight system operating at impressive scale, until the great Spanish Wrench Attack.

Microledger architectures like our did:webplus system address this directly: every DID document contains a cryptographic hash of its predecessor, anchoring each version of an identity’s key state permanently to its history, and taking measures to mitigate the risk of broken links in the event chain for any actor even across service rotations, service interruptions, and legal entity lifecycles. A dead key lives on in the chain. The chain is the institutional memory the quipu was built to provide. No quipucamayoc dies without leaving the record of every key they ever held^[25].

Coda: The Architecture We Can Finally Build

The Hixon Symposium produced no security framework. It produced something more durable: axioms about information, control, memory, and trust that were correct in 1948 and remain correct now. Our ten axioms are not new – many predate the Inca. What is new is the urgency, and it comes from the character of the adversary: an AI that never blinks, never tires, and never stops correlating has dissolved the protections that obscurity and inconvenience once provided. The wrench epidemic is the physical expression of the same surveillance infrastructure that serves nation-state espionage – the same tools, now available on the open market with little in the way of security checks.

TL;DR: We’re only human. It’s easy to let our guard down, to let someone else generate our key for us, and to leave a copy under the mat in case we lock ourselves out. Let’s resolve to generate our own keys, and not make copies. And let's set up our systems to split those keys amongst our trusted friends – not just hand them to somebody who makes more money selling our secrets than protecting them. We should also log in yearly on our own country’s independence day to upgrade our security, so we stay ahead of the bad guys.

Why exactly ten, and why these? Because every identity system, whatever its implementation, is the same five things: (1) secrets, held by (2) humans, arranged in (3) structures, evolving through time(4), bound to meaning (5), always susceptiple to adversaries with exactly three channels of attack. Each axiom is the irreducible constraint on one part of that anatomy: two for the adversary, two for the human, three for structure, two for time, one for meaning.

Why exactly ten: two constraints on the adversary, two on the human, three on structure, two on time, one on meaning.

The systems that answer the adversary simultaneously – distributed, verifiable, historically durable, multi-party, with no single point of omnipotent access, no phone-home in the verification path, and no single human body as a required and sufficient condition for any significant action – can be built today. What is required is the commitment to a clean break: to stop building janitors’ key rings, to stop delegating secrets to human memory, to stop accepting phone-home architectures that double as surveillance infrastructure – and to build, finally, the identity architecture that earns the trust we are asked to place in it.

A humbly-presented example for analysis

Our did:webplus design adds a verifiable, append-only history to did:web using ordinary web infrastructure: the microledger behind Axiom Ten. It is open source and running across the U.S. pharmaceutical supply chain today. We welcome feedback in the form in GitHub issues or direct messages on DIF's members-only Slack, about did:webplus as much as about these axioms as principles for building.

There are other examples at DIF of microledgers and secure decentralized Public Key Infrastructures, but we are quite proud of did:webplus as a self-contained example of the kind of architecture we have been promoting in our vertical, and support others building everywhere before it's too late.

Acknowledgements

Our thanks to the Decentralized Identity Foundation for providing a forum for this work, and to Grace Rachmany, Kim Hamilton Duffy, Dr. Juan Caballero, Dr. Victor Dods, and Alexander Colgan for their engagement. Kim Cameron’s “Laws of Identity” (2005) taught that identity systems obey discoverable principles and that the repeated failures of identity schemes were the predictable consequence of violating those principles. ^[26] Christopher Allen’s “The Path to Self-Sovereign Identity” (2016) animated the decentralized identity movement. ^[27] Anyone building in this field stands on the shoulders of both c, ourselves included.

Sources and Notes