The open standard
A verifier is only credible if its rules are public. With KYA they are, completely.
In short
KYA's formats, rules and test vectors are open: specification under CC BY 4.0, engine and vectors under Apache 2.0.
What is open
| Part | License | Where |
|---|---|---|
| KYA verification profile 1.0 | CC BY 4.0 | Verification profile |
| Engine verify-core | Apache 2.0 | In the repository, in the browser at /assets/core |
| 62 test vectors | Apache 2.0 | Test vectors |
Building blocks
- Verification profileClaims profile, receipt chain, evidence pack, timestamp binding, report.
- Test vectorsReal signatures and timestamps that define what is valid.
- LandscapeSD-JWT VC, status lists, RFC 3161, AP2, Verifiable Intent and FIDO.
- Know Your Agent approachesSkyfire, Akamai, Visa, Mastercard, Google and FIDO compared neutrally.
- Verifiable Intent vectorsGenerated with the official reference, with its verdict.
- Web Bot Auth vectorsBased on the test vectors published by Cloudflare.
- ChecksThe normative logic of status, verdict and level.
Versioning
Formats carry their version in the kind field, rules their policy version. A certificate keeps the version under which it was produced; tightening creates a new version, never a retroactive re-evaluation.
Contributing
A format is added when there is a public specification and a test vector with a real signature. No fee, no preference. Send a request
Open and verifiable
KYA's standard consists of three parts: the verification profile, which describes what is checked; the test vectors, against which any implementation can be measured; and the engine as a reference. All three are public. Whoever builds a second implementation can test it against the same vectors and show that it reaches the same results. The article Agent protocols compared shows how KYA relates to other approaches.
For implementers
Whoever creates or verifies evidence finds everything needed in the standard: the verification profile with the requirements for each check, the test vectors with expected results, JSON schemas for reports, packs and chains, and the engine as a reference. An implementation counts as matching if it passes all test vectors with the expected verdicts.
Frequently asked questions
Who may use the verification profile?
Everyone. The verification profile is available under CC BY 4.0, the test vectors and the engine under Apache 2.0.
How are changes to the standard published?
Through versioned releases with a changelog. Each version states which checks and formats it covers.
Is there a second implementation?
An independent second implementation is being sought. The public test vectors are the basis for it.
What does matching the verification profile mean?
An implementation matches if it passes all public test vectors with the expected verdicts and levels. This can be demonstrated automatically.
How does the verification profile differ from a vendor specification?
The verification profile describes what is checked, regardless of who issues the evidence. Vendor specifications describe their own format; KYA maps supported formats onto the same checks.
Where can I find the versions of the standard?
On the versions page. It lists all releases of the verification profile and the engine with their changes and dates.
Can I contribute to the standard?
Yes. Feedback on the verification profile and test vectors is welcome and reaches the operator through the contact page. A neutral governing body is being sought.