Trust Anchor

A Trust Anchor is an authoritative entity, represented by a public key and its associated data, that a relying party accepts as the starting point for verifying a chain of trust, based on the model in RFC 5914.

A verifier does not re-establish trust from scratch every time it checks a credential: it follows a chain of certificates or attestations back to a Trust Anchor it has already decided to trust, and if that chain resolves cleanly, everything below it is trusted by extension. In the EUDI ecosystem, a Trusted List published by a member state acts as a registry of Trust Anchors, telling relying parties which public keys back qualified trust service providers, so they do not need a separate trust relationship with every issuer individually. A Trust Anchor is not itself a certificate: RFC 5914 defines it as the combination of a public key, the name of the entity it belongs to, and any constraints on what that entity is allowed to assert, packaged in a Trust Anchor Information Object or a self-signed certificate used as a convenient container for the same data. Because everything downstream depends on it, a Trust Anchor cannot be discovered on the fly; a relying party has to obtain it out of band, through a Trusted List, a hardcoded root, or another channel it already trusts, before it can verify anything. This also makes Trust Anchor rollover a deliberate operation: when a member state rotates the key behind an entry in its Trusted List, relying parties need to pick up the new Trust Anchor before the old one expires, or verification for that issuer breaks. Trust Anchors are the reason an EUDI Wallet verifier can accept credentials from an issuer it has never dealt with directly, since trust travels through the Trusted List rather than through a bilateral agreement with every issuer.

• datatracker.ietf.org

Back to the glossary