Registry

The registry is Signet's list of everyone who has enrolled. It holds no names, and witnesses check every change to it before anyone relies on it.

What it holds

  • One entry per person. An entry is a commitment to a secret that only the person's device knows. It reveals nothing about the person, and the list of entries is public.
  • One tag per document. A tag derived from the identity document lets the registry accept each document only once. Only the registry and the witnesses see tags. They never appear in the public log.
  • Two details of the document: its expiry month, so the entry can be removed when the document expires, and its issuing authority.

The registry never holds the person's name, document number, photo or secret.

How entries change

The registry applies changes in batches, and each batch becomes one entry in an append-only log.

  • Enroll. The device proves that the document is genuine. The registry adds an entry if the document's tag is new.
  • Expire. When the document expires, its entry is removed.
  • Rotate. The person can replace their secret, for example if they think it has leaked. The old entry is removed and a new one added, and the person's private identifier changes at every business.

The public log shows only that an entry was added or removed, never why.

Checkpoints

After each batch, the registry signs a checkpoint: the size and root hash of its log. The log is a Merkle tree hashed as in Certificate Transparency (RFC 9162), and checkpoints use the C2SP formats for transparency logs. Two kinds of proof work against a checkpoint:

  • an inclusion proof shows that an entry is in the log;
  • a consistency proof shows that a later log only added entries to an earlier one, without changing, removing or reordering any.

Witnesses

Before a witness co-signs a new checkpoint, it checks that:

  1. the registry signed the checkpoint;
  2. the log only grew since the last checkpoint the witness co-signed;
  3. every change in the new entries produces the published tree root;
  4. every change is backed by valid evidence: a valid proof from a document never enrolled before for each new entry, a valid proof for each rotation, and an expiry that is due.

If any check fails, the witness does not co-sign. Devices and businesses accept a checkpoint only when enough witnesses have co-signed it, and devices fetch checkpoints from the witnesses as well as from the registry. So the registry cannot add a person who never enrolled, and it cannot show one device a registry that the witnesses have not seen.

Witnesses can be independent parties or businesses that use Signet. At launch, Signet runs the witnesses, with public code.

Epochs

The registry marks one tree root in each fixed period as that period's epoch root. Devices prove against the current epoch root, and a business accepts only a recent epoch root with enough co-signatures. This has three effects:

  • every device that proves in the same period uses the same root, so the root reveals nothing about when a device last updated;
  • the registry cannot give one device a root of its own, because the business would reject it;
  • a new entry can be used from the next epoch root onwards.