The Bootstrap Trap: Every Workaround Hands Over A Larger Identity
Summary
Why non-human identity is hard, stated as a circular dependency rather than a cryptographic problem. Generating a keypair is trivial; getting the public half recognised by something that matters requires reaching a trusted authority, every route to which requires authentication, which requires the identity the agent does not have. That is a loop rather than a gap, and every common escape — the operator's credential, repository write access, a shared bot token, a vendor integration, a cloud credential, a project signing secret, a bespoke enrolment server — solves transport by creating a larger identity problem. The answer is not a better credential but a channel narrow enough to require nothing.
Key concepts
- The loop — creating a key is not creating an identity, because an identity is a relationship somebody agreed to
- Ambient authority and the confused deputy — the two named failure modes underneath every workaround
- Authority choreography — the constraint is transport rather than cryptography
- The gradient — I control this key, the project recognises it, the project delegates this mandate
Key ideas
- A system can use excellent cryptography and still have a weak bootstrap if the first instruction is to hand over a platform token.
- The workarounds are the mechanism behind documented incidents rather than a theoretical concern.
- Recognition is a decision rather than a computation, so a signature is never an endorsement.
- The remaining work is long, and the gain is that none of it needs a high-authority identity first.
On this site
Became the bootstrap page, which the site review named the most linkable argument available.