Trust anchor
A trust anchor is a certificate or key that the verifying party explicitly trusts and to which other certificates must be traceable.
Certificates that evidence brings along can never be their own anchor; they are only intermediates. Only when the path ends at an anchor of the verifying party is a timestamp proven in the verification model.
Example
A verifying party sets the root certificate of its timestamp authority and the keys of two issuers as trust anchors. Only evidence whose path ends at one of these anchors counts as proven.
How it differs
A key inside the evidence itself is self-asserted; a trust anchor is set by the verifying party. A root certificate is a common form of anchor.
In practice
- Obtain anchors only from trusted sources, for example directly from the issuer or from an official list, never from the evidence itself.
- Keep the number of anchors small and document why you trust each one. Every additional anchor widens the circle of possible issuers.
- Check regularly whether anchors have expired or been replaced, and remove anchors you no longer need from your configuration.
Role in KYA
For every report, KYA states whether a key comes from an anchor of the verifying party or was merely embedded. Without an anchor, the origin is not proven, even if the signature checks out.
Related check: Timestamp (timestamp_assurance). Is the RFC 3161 timestamp valid, bound to the content and traceable to an anchor of the verifying party?
Frequently asked questions
What is a trust anchor?
A key or certificate that a verifying party explicitly trusts and from which it verifies other keys.
Why is a valid signature not enough?
Because it only shows that content and key match. Who owns the key is proven only by the path to a trust anchor.
Who sets trust anchors?
The verifying party, according to its rules. KYA loads no anchors itself but uses those the verifying party provides.
Can evidence bring its own anchor?
It can include a key, but then the origin is only self-asserted. KYA reports this; only what the verifying party sets itself counts as an anchor.
What happens if an anchor is compromised?
All evidence built on it loses its meaning. The verifying party must remove the anchor immediately and reassess the affected evidence.
Where do I find trustworthy anchors?
Directly from the issuers, for example on their website or in their technical documentation, and in official lists of recognized trust services. Check the source before you provide an anchor.