A practical threat model across cryptographic, identity, delegation, network, and availability domains. Each vector maps to a mitigation strategy implementers can apply and verifiers can enforce.
Center is higher severity. Click a category in the legend to jump to its vectors and mitigations.
The threats you should expect to face, and the mitigations that keep verification meaningful under adversarial conditions.
severity · CRITICAL
vectors · 3
Vector
Private key extraction
Mitigation
Prefer hardware-backed storage where available, and keep key material out of logs and diagnostics.
Vector
Memory scraping
Mitigation
Minimize key lifetime in memory; use constant-time comparisons and wipe buffers when practical.
Vector
Side-channel leakage
Mitigation
Use mature implementations and avoid secret-dependent branching in verification paths.
severity · HIGH
vectors · 3
Vector
DID impersonation
Mitigation
Bind identifiers to public keys so impersonation requires the corresponding private key.
Vector
Lineage forgery
Mitigation
Check exact signed parent links using authoritative keys, then current owner/self-root approval and every required revocation. Signature-only offline checks do not establish current trust.
Vector
Document tampering
Mitigation
Canonicalize before signing so any modification invalidates verification.
severity · HIGH
vectors · 3
Vector
Privilege escalation
Mitigation
Design delegation so child authority cannot exceed the parent (least privilege, monotonic narrowing).
Vector
Stale delegations
Mitigation
Prefer time-bounded grants and explicit rotation/revocation paths for long-lived authority.
Vector
Orphaned authority
Mitigation
Define revocation behavior for descendant identities and document the expected verifier behavior.
severity · MEDIUM
vectors · 3
Vector
MITM on transport
Mitigation
Use authenticated encryption and verifier-side signature checks; never trust the network for authenticity.
Vector
Resolution poisoning
Mitigation
Resolve exact keys and purposes from an approved authority. Schema and a self-signature alone cannot turn a caller-supplied key or owner into trusted identity.
Vector
Replay attacks
Mitigation
Issue audience-bound challenges and atomically consume both nonce and proof ID in durable storage. Short expiry alone does not prevent replay or coordinate replicas.
severity · LOW
vectors · 3
Vector
Resolution outage
Mitigation
Pinned local material can support signature checks. Required current root, owner and revocation evidence must remain fresh and available; an outage refuses the protected operation.
Vector
Abusive traffic
Mitigation
Rate limit, isolate hotspots, and design systems so verification degrades gracefully under load.
Vector
Dependency failure
Mitigation
Keep required authority and replay stores available. Missing or stale authority fails closed; do not downgrade to syntax, cached approval or signature-only access.
Please report vulnerabilities privately so fixes can ship before public discussion.
