{"file":"docs/seed/Credential_Payload.txt","start":1,"end":163,"lines":[{"number":1,"text":"The four-keypair Credential Payload"},{"number":2,"text":""},{"number":3,"text":"Each logical CRE8 Key receives these components."},{"number":4,"text":""},{"number":5,"text":"1. Authentication keypair"},{"number":6,"text":"K_auth_private"},{"number":7,"text":"K_auth_public"},{"number":8,"text":""},{"number":9,"text":"Algorithm: Ed25519"},{"number":10,"text":""},{"number":11,"text":"Purpose:"},{"number":12,"text":""},{"number":13,"text":"Sign API requests."},{"number":14,"text":"Prove possession."},{"number":15,"text":"Prevent bearer-token authentication."},{"number":16,"text":"Bind request method, path, body digest, timestamp, nonce, and Credential ID."},{"number":17,"text":""},{"number":18,"text":"It cannot:"},{"number":19,"text":""},{"number":20,"text":"Mint children."},{"number":21,"text":"Change permissions."},{"number":22,"text":"Sign authored content as an Author."},{"number":23,"text":"Decrypt messages."},{"number":24,"text":""},{"number":25,"text":""},{"number":26,"text":""},{"number":27,"text":""},{"number":28,"text":""},{"number":29,"text":""},{"number":30,"text":""},{"number":31,"text":""},{"number":32,"text":"=========================================="},{"number":33,"text":""},{"number":34,"text":""},{"number":35,"text":""},{"number":36,"text":""},{"number":37,"text":""},{"number":38,"text":""},{"number":39,"text":""},{"number":40,"text":"2. Delegation keypair"},{"number":41,"text":"K_delegate_private"},{"number":42,"text":"K_delegate_public"},{"number":43,"text":""},{"number":44,"text":"Algorithm: Ed25519"},{"number":45,"text":""},{"number":46,"text":"Purpose:"},{"number":47,"text":""},{"number":48,"text":"Sign child-minting requests."},{"number":49,"text":"Sign permission assignments."},{"number":50,"text":"Sign policy reductions."},{"number":51,"text":"Initiate child rotation."},{"number":52,"text":"Request child suspension or revocation."},{"number":53,"text":""},{"number":54,"text":"It cannot by itself:"},{"number":55,"text":""},{"number":56,"text":"Perform routine API operations."},{"number":57,"text":"Publish authored content."},{"number":58,"text":"Decrypt messages."},{"number":59,"text":""},{"number":60,"text":""},{"number":61,"text":""},{"number":62,"text":""},{"number":63,"text":""},{"number":64,"text":""},{"number":65,"text":""},{"number":66,"text":""},{"number":67,"text":"=========================================="},{"number":68,"text":""},{"number":69,"text":""},{"number":70,"text":""},{"number":71,"text":""},{"number":72,"text":""},{"number":73,"text":""},{"number":74,"text":""},{"number":75,"text":"3. Authorship keypair"},{"number":76,"text":"K_author_private"},{"number":77,"text":"K_author_public"},{"number":78,"text":""},{"number":79,"text":"Algorithm: Ed25519"},{"number":80,"text":""},{"number":81,"text":"Purpose:"},{"number":82,"text":""},{"number":83,"text":"Sign authored objects."},{"number":84,"text":"Sign credentials or statements."},{"number":85,"text":"Sign versions and amendments."},{"number":86,"text":"Co-sign collaborative objects."},{"number":87,"text":"Establish provenance."},{"number":88,"text":""},{"number":89,"text":"A publication API call should normally require both:"},{"number":90,"text":""},{"number":91,"text":"K_auth signature + K_author signature"},{"number":92,"text":""},{"number":93,"text":"Compromise of only the authorship key would therefore not let an attacker submit forged material through the live CRE8 API."},{"number":94,"text":""},{"number":95,"text":""},{"number":96,"text":""},{"number":97,"text":""},{"number":98,"text":""},{"number":99,"text":""},{"number":100,"text":""},{"number":101,"text":""},{"number":102,"text":"=========================================="},{"number":103,"text":""},{"number":104,"text":""},{"number":105,"text":""},{"number":106,"text":""},{"number":107,"text":""},{"number":108,"text":""},{"number":109,"text":""},{"number":110,"text":"4. Confidentiality keypair"},{"number":111,"text":"K_box_private"},{"number":112,"text":"K_box_public"},{"number":113,"text":""},{"number":114,"text":"Algorithm: X25519"},{"number":115,"text":""},{"number":116,"text":"Purpose:"},{"number":117,"text":""},{"number":118,"text":"Receive encrypted messages."},{"number":119,"text":"Receive encrypted shares."},{"number":120,"text":"Encrypt keyring packages."},{"number":121,"text":"Establish recipient-specific shared secrets."},{"number":122,"text":""},{"number":123,"text":"It cannot:"},{"number":124,"text":""},{"number":125,"text":"Authenticate API requests."},{"number":126,"text":"Sign content."},{"number":127,"text":"Mint children."},{"number":128,"text":"Change policy."},{"number":129,"text":""},{"number":130,"text":""},{"number":131,"text":""},{"number":132,"text":""},{"number":133,"text":""},{"number":134,"text":""},{"number":135,"text":""},{"number":136,"text":""},{"number":137,"text":"=========================================="},{"number":138,"text":""},{"number":139,"text":""},{"number":140,"text":""},{"number":141,"text":""},{"number":142,"text":""},{"number":143,"text":""},{"number":144,"text":""},{"number":145,"text":"5. Credential ID"},{"number":146,"text":"credential_id"},{"number":147,"text":""},{"number":148,"text":"A random, immutable, public identifier, for example:"},{"number":149,"text":""},{"number":150,"text":"cre8_k_7PK1BHZ4..."},{"number":151,"text":""},{"number":152,"text":"It is used to locate:"},{"number":153,"text":""},{"number":154,"text":"The logical Key."},{"number":155,"text":"Current component versions."},{"number":156,"text":"Public keys."},{"number":157,"text":"Status."},{"number":158,"text":"Policy."},{"number":159,"text":"Parent."},{"number":160,"text":"Descendants."},{"number":161,"text":"Historical signatures."},{"number":162,"text":""},{"number":163,"text":"The Credential ID is never a password or bearer secret."}]}