{ "model": { "rank": 12643, "code": "thing-q471771", "model_id": "vr.tr.key-q471771", "name": "key", "purpose": "Let an agent reason about cryptographic keys by type, strength, lifecycle and custody, and never ask for, display or move a secret or private key.", "family": "Thing Registry", "category": "Information and virtual systems", "status": "research-draft", "kind": "thing", "plane": "INF", "domain": "INF.MED", "industry": "", "version": "", "url": "/models/thing/q471771/", "tier": 2, "score": 39, "payload": { "layer": "wikidata", "aliases": [ "private key", "public key", "hashed password", "session key", "weak key", "secret key", "SSH public key", "PGP public key", "bitcoin address" ], "aliasCount": 9, "merged": 9, "knownIn": 39, "facets": null, "markers": [], "lexicalClass": "", "senseRank": null, "alsoRegisteredAs": "vr.tr.key-artifact", "source": { "dataset": "wikidata", "item": "Q471771", "url": "https://www.wikidata.org/wiki/Q471771", "license": "CC0 1.0" } }, "research": { "vercy": "1.0-draft", "publication": { "status": "research-draft", "adjudicationStatus": "unreviewed", "publishableCanonical": false, "generatedAt": "2026-09-11T04:44:30Z", "providers": [ "Claude" ], "breadth": "written by Claude from model knowledge without web access - no source was read, every claim is a lead to verify", "pass": 2, "wave": 1, "engine": "claude" }, "metaModel": { "id": "THING-Q471771", "registryId": "vr.tr.key-q471771", "name": "key", "version": "0.2.0-wave.1", "entryKind": "thing", "family": "Thing Registry", "domain": [ "INF.MED" ], "status": "research-draft" }, "canonicalUrl": "https://ver.cy/models/thing/q471771/", "model": { "registry_id": "vr.tr.key-q471771", "name": "key", "purpose": "Let an agent reason about cryptographic keys by type, strength, lifecycle and custody, and never ask for, display or move a secret or private key.", "definition": "In cryptography, a piece of information that determines the output of a cryptographic algorithm, such as a secret key for symmetric encryption or a public and private key pair.", "what_it_is_for": "Encrypting and decrypting data, signing and verifying, and authenticating systems and people.", "affordances": [ "generate it, with a secure random source", "store and protect it, in hardware or key vaults", "rotate and revoke it", "publish the public half, while keeping the private half secret" ], "distinguishing_features": [ "Secrecy of the private or secret key is the whole point", "Public keys can be shared; private keys never", "Strength depends on algorithm and length", "A hashed password is not a key, though both protect access" ], "appearance": "A string of bits, usually shown as base64 or hex, or held inside a hardware security module or smart card where it cannot be seen.", "visual_identification": [ "PEM blocks such as BEGIN PUBLIC KEY or BEGIN PRIVATE KEY", "SSH public keys starting with ssh-ed25519 or ssh-rsa", "Fingerprints identify keys without revealing them" ], "physical_properties": [ { "quantity": "key length", "typical_range": "128-4096", "unit": "bits", "note": "AES 128-256, RSA 2048-4096, Ed25519 256" } ], "families_and_kinds": [ "symmetric secret keys", "asymmetric public and private key pairs", "session keys", "signing keys and encryption keys", "weak keys to be avoided" ], "related_models": [ { "relation": "is used by", "target": "cryptographic algorithm", "why": "the key parameterises the algorithm" }, { "relation": "is bound to", "target": "certificate", "why": "certificates bind public keys to identities" }, { "relation": "is confused with", "target": "key for a lock", "why": "a homonym" }, { "relation": "is confused with", "target": "password", "why": "passwords are human secrets; keys are machine secrets" } ], "identifiers": [ { "scheme": "key fingerprint", "value_or_pattern": "hash of the public key", "note": "identifies a key without exposing it" }, { "scheme": "key ID", "value_or_pattern": "system-specific", "note": "names a key in a vault or keyring" } ], "standards_and_regulation": [ "NIST SP 800-57 key management", "FIPS 140-3 cryptographic modules", "RFC 8032 Ed25519 and other algorithm standards", "Export control rules on cryptography" ], "failure_modes_and_hazards": [ "Leaked private keys, which compromise everything they protect", "Keys committed to source code or logs", "Weak or short keys", "Lost keys making data unrecoverable" ], "in_scope": [], "out_of_scope": [], "characteristics": [] }, "sources": [], "structure": { "bundles": [ { "id": "type-and-strength", "name": "Type and strength", "description": "What kind of key.", "rationale": "Type and length decide security.", "layers": [ { "id": "type", "name": "Type", "description": "Symmetric or asymmetric.", "findings": [ { "id": "type-finding", "name": "Key type", "description": "Algorithm and use.", "questions": [ { "text": "Which algorithm and use is this key for?", "kind": "definition" }, { "text": "Is it the public or the private half?", "kind": "boundary" } ] } ] }, { "id": "strength", "name": "Strength", "description": "Length and algorithm.", "findings": [ { "id": "strength-finding", "name": "Strength", "description": "Length and current guidance.", "questions": [ { "text": "Is its length adequate under current guidance?", "kind": "measurement" }, { "text": "When should it be replaced?", "kind": "action" } ] } ] } ] }, { "id": "custody", "name": "Custody", "description": "Where it lives and who can use it.", "rationale": "Custody is where keys are won or lost.", "layers": [ { "id": "storage", "name": "Storage", "description": "HSM, vault, file.", "findings": [ { "id": "storage-finding", "name": "Storage", "description": "Where the key is held.", "questions": [ { "text": "Where is the private key stored, and is it protected by hardware?", "kind": "definition" }, { "text": "Who has access to it?", "kind": "provenance" } ] } ] }, { "id": "handling", "name": "Handling rules", "description": "Never display or transmit secrets.", "findings": [ { "id": "handling-finding", "name": "Handling rule", "description": "Rules for agents.", "questions": [ { "text": "Is key material present in this data, and should it be redacted?", "kind": "boundary" }, { "text": "What should an agent do instead of handling the key?", "kind": "action" } ] } ] } ] }, { "id": "lifecycle", "name": "Lifecycle", "description": "From generation to destruction.", "rationale": "Keys must be rotated and retired.", "layers": [ { "id": "generation", "name": "Generation", "description": "Randomness and ceremony.", "findings": [ { "id": "generation-finding", "name": "Generation", "description": "How the key was generated.", "questions": [ { "text": "How was the key generated, and with what randomness?", "kind": "provenance" }, { "text": "When was it created?", "kind": "provenance" } ] } ] }, { "id": "rotation", "name": "Rotation and revocation", "description": "Replacing and revoking.", "findings": [ { "id": "rotation-finding", "name": "Rotation", "description": "Rotation schedule and revocation.", "questions": [ { "text": "When is it rotated, and how is it revoked if compromised?", "kind": "action" }, { "text": "How is revocation communicated?", "kind": "action" } ] } ] } ] }, { "id": "trust", "name": "Trust", "description": "Binding keys to identities.", "rationale": "A key is only as trustworthy as its binding.", "layers": [ { "id": "binding", "name": "Binding", "description": "Certificates and fingerprints.", "findings": [ { "id": "binding-finding", "name": "Identity binding", "description": "How the key is bound to an identity.", "questions": [ { "text": "Which certificate or fingerprint binds this public key to its owner?", "kind": "provenance" }, { "text": "How was the fingerprint verified?", "kind": "provenance" } ] } ] }, { "id": "incident", "name": "Compromise", "description": "Suspected leaks.", "findings": [ { "id": "incident-finding", "name": "Incident response", "description": "Steps after compromise.", "questions": [ { "text": "What must happen if this key is suspected compromised?", "kind": "action" }, { "text": "What data does it expose?", "kind": "boundary" } ] } ] } ] } ] }, "openQuestions": [ "Should key types be separate entries?", "How should key metadata be recorded without ever recording key material?", "What must an agent do when it encounters a secret key in data?" ], "statistics": { "bundles": 4, "layers": 8, "findings": 8, "questions": 16 } }, "draft": { "generator": "vr.draft.v3", "status": "draft-generated", "researched": false, "archetype": "work, medium or creative form", "method": "Written from the archetype playbook - what this kind of thing needs beyond identity and provenance - and from the structure that recurred across 6,333 models already researched by two engines. Applied to this entry by rule. No source was read for this thing and no claim here is researched. This entry carries no facets of its own, so they were inferred from its domain - a guess about a whole domain applied to one thing.", "facetsInferred": true, "nextPass": "A researcher replaces this draft with a sourced specification. Treat every sentence below as a proposal to argue with.", "purpose": "Give an agent a durable, checkable way to recognise a key, record what state it is in, and decide what may be done with it.", "whatItIs": "Let an agent reason about cryptographic keys by type, strength, lifecycle and custody, and never ask for, display or move a secret or private key.", "characteristics": { "substance": "information", "origin": "conceptual", "agency": "inert" }, "whatYouCanDoWithIt": [ "read and interpreted", "observed and measured" ], "distinguishingFeatures": [ "Names folded into this entry, which a task may need to split apart again: private key, public key, hashed password, session key, weak key, secret key, SSH public key, PGP public key, bitcoin address.", "9 finer distinctions are held as aliases rather than separate entries, because telling them apart needs a task that asks for it.", "Described in 39 Wikipedia languages, which is a measure of how widely the thing is known, not of how important it is." ], "openQuestionsForResearch": [ "Which of the bundles below does a real task actually need, and which are ceremony?", "What does this thing have that the facets do not capture at all?", "Which neighbouring kind is most often confused with a key, and on what evidence are they told apart?" ], "whatItIsMadeOf": "content that has to be carried by something else", "physicalCharacter": [ "Does nothing on its own; everything it does, something else did to it.", "These come from the domain this entry sits in rather than from the entry itself, so treat them as a first guess about the whole domain applied to one thing." ], "whatCanBeDoneWithIt": [ "read it and act on what it says", "observe it, measure it, record its state" ], "howItIsRecognised": [ "What is seen is a copy or a performance, not the work. Recognising the work means recognising the content through whatever is carrying it." ], "relatedModels": [ { "relation": "covers", "note": "Finer kinds folded into this entry because telling them apart needs a task that asks for it. Each is a model waiting to be split out when one does.", "targets": [ "private key", "public key", "hashed password", "session key", "weak key", "secret key", "SSH public key", "PGP public key", "bitcoin address" ] } ], "standing": "Described in 39 Wikipedia languages, which measures how widely it is written about rather than how important or how common it is. 9 finer distinctions are held inside this entry as names rather than as separate models.", "structure": { "bundles": [ { "id": "identity-and-classification", "name": "Identity, naming and classification", "description": "How an agent tells one key from another, and a key from things that resemble it.", "rationale": "Recognition comes before every other claim. Without stable identity nothing else in the model can be trusted to be about the same thing twice.", "layers": [ { "id": "naming-and-identifiers", "name": "Names and identifiers", "description": "The names this thing goes by and the identifiers that survive translation and time.", "findings": [ { "id": "preferred-name-and-aliases", "name": "Preferred name, aliases and local names", "description": "Which name to use, which names mean the same thing, and which merely sound similar.", "questions": [ { "id": "preferred-name-and-aliases-q01", "text": "What identifies and describes the name of a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "preferred-name-and-aliases-q02", "text": "Who or what asserted this about the name of a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "preferred-name-and-aliases-q03", "text": "What may an agent decide or do once the name of a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] }, { "id": "stable-identifiers", "name": "Stable identifiers and external keys", "description": "Identifiers that keep pointing at this kind of thing across systems and languages.", "questions": [ { "id": "stable-identifiers-q01", "text": "What identifies and describes an identifier for a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "stable-identifiers-q02", "text": "Who or what asserted this about an identifier for a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "stable-identifiers-q03", "text": "What may an agent decide or do once an identifier for a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "classification-and-granularity", "name": "Classification and granularity", "description": "Where a key sits among kinds, and how finely a task needs to cut it.", "findings": [ { "id": "kind-and-parents", "name": "Kind, parents and neighbouring kinds", "description": "The classes this thing belongs to and the ones it is next to.", "questions": [ { "id": "kind-and-parents-q01", "text": "What identifies and describes the kind of a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "kind-and-parents-q02", "text": "Who or what asserted this about the kind of a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "kind-and-parents-q03", "text": "What may an agent decide or do once the kind of a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] }, { "id": "distinguishing-features", "name": "Distinguishing features", "description": "What separates a key from the things most often confused with it.", "questions": [ { "id": "distinguishing-features-q01", "text": "What identifies and describes what distinguishes a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "distinguishing-features-q02", "text": "Who or what asserted this about what distinguishes a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "distinguishing-features-q03", "text": "What may an agent decide or do once what distinguishes a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "state-and-lifecycle", "name": "State and lifecycle", "description": "The states a key passes through and the events that move it between them.", "rationale": "Most decisions about a thing depend on what state it is in now, which is a claim with a time on it, not a property.", "layers": [ { "id": "lifecycle-stages", "name": "Lifecycle stages", "description": "From coming into existence to ceasing to be one of these.", "findings": [ { "id": "stages-and-transitions", "name": "Stages and transitions", "description": "The stages worth naming and what moves a key between them.", "questions": [ { "id": "stages-and-transitions-q01", "text": "What identifies and describes the lifecycle of a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "stages-and-transitions-q02", "text": "Who or what asserted this about the lifecycle of a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "stages-and-transitions-q03", "text": "What may an agent decide or do once the lifecycle of a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "observations-and-status", "name": "Observations and current status", "description": "What is observed about a key, how often and by whom.", "findings": [ { "id": "observation-record", "name": "Observation record", "description": "How an observation of a key is recorded so that it can be superseded rather than overwritten.", "questions": [ { "id": "observation-record-q01", "text": "What identifies and describes an observation of a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "observation-record-q02", "text": "Who or what asserted this about an observation of a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "observation-record-q03", "text": "What may an agent decide or do once an observation of a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "content-and-access", "name": "Content, encoding and access", "description": "What a key says, how it is encoded and who may read it.", "rationale": "An informational thing carries content that can be copied, versioned and withheld, none of which its physical carrier explains.", "layers": [ { "id": "content-and-encoding", "name": "Content and encoding", "description": "The content itself, its format and its language.", "findings": [ { "id": "content-and-format", "name": "Content, format and language", "description": "What a key contains and in what form it is held.", "questions": [ { "id": "content-and-format-q01", "text": "What identifies and describes the content of a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "content-and-format-q02", "text": "Who or what asserted this about the content of a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "content-and-format-q03", "text": "What may an agent decide or do once the content of a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "access-and-rights", "name": "Access, rights and retention", "description": "Who may read, copy or change it, and for how long it is kept.", "findings": [ { "id": "access-rules", "name": "Access rules and retention", "description": "The permissions attached to a key and the period it survives.", "questions": [ { "id": "access-rules-q01", "text": "What identifies and describes access to a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "access-rules-q02", "text": "Who or what asserted this about access to a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "access-rules-q03", "text": "What may an agent decide or do once access to a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] }, { "id": "work-and-manifestation", "name": "Work, version and copy", "description": "Which level of key a statement is about.", "rationale": "The work, the edition, the file and the copy in hand are four things; rights and content attach to different ones.", "layers": [ { "id": "levels", "name": "Levels of the thing", "description": "Work, expression, manifestation and item, in plain terms.", "findings": [ { "id": "level-rules", "name": "What belongs at each level", "description": "Which facts hold for the work and which only for one copy.", "questions": [ { "id": "level-rules-q01", "text": "For key, which facts belong to the work itself, which to a version, and which to a single copy?", "kind": "boundary" }, { "id": "level-rules-q02", "text": "What identifier exists at each level, and which one is being cited?", "kind": "definition" } ] } ] }, { "id": "versions", "name": "Versions, editions and variants", "description": "How versions differ and which is canonical to whom.", "findings": [ { "id": "version-record", "name": "Versions and canonicity", "description": "Differences that matter and who calls one authoritative.", "questions": [ { "id": "version-record-q01", "text": "Which versions or editions of key exist, and how do they differ substantively?", "kind": "definition" }, { "id": "version-record-q02", "text": "Who treats which version as authoritative, and for what purpose?", "kind": "provenance" } ] } ] } ] }, { "id": "authorship-and-rights", "name": "Authorship, rights and permitted use", "description": "Who made key and what may be done with it.", "rationale": "Rights are jurisdictional, time-limited and attached to a level, and an agent that ignores that will copy what it may not.", "layers": [ { "id": "authorship", "name": "Authorship and contribution", "description": "Who contributed what, and in what capacity.", "findings": [ { "id": "contribution-record", "name": "Contributors and roles", "description": "The people and bodies behind it, with their roles.", "questions": [ { "id": "contribution-record-q01", "text": "Who authored or contributed to key, in what roles, and how is that attested?", "kind": "provenance" }, { "id": "contribution-record-q02", "text": "Where authorship is disputed or anonymous, what is recorded instead?", "kind": "boundary" } ] } ] }, { "id": "rights", "name": "Rights and permissions", "description": "Which rights subsist, where, until when, and what they permit.", "findings": [ { "id": "rights-record", "name": "Rights, term and permitted acts", "description": "The regime in force and what it allows.", "questions": [ { "id": "rights-record-q01", "text": "What rights subsist in key, in which jurisdictions, and until when?", "kind": "definition" }, { "id": "rights-record-q02", "text": "Which acts are permitted without further permission, and which must an agent refuse?", "kind": "action" } ] } ] } ] }, { "id": "provenance-and-evidence", "name": "Provenance, evidence and time", "description": "Where every claim about a key came from and when it held.", "rationale": "A claim without a source and a time cannot be superseded, only overwritten, and an agent that overwrites loses the ability to explain itself.", "layers": [ { "id": "source-and-authority", "name": "Source and authority", "description": "Who said it, on what evidence, and how strongly.", "findings": [ { "id": "claim-provenance", "name": "Claim provenance and confidence", "description": "The authority behind each claim about a key and how confident it is.", "questions": [ { "id": "claim-provenance-q01", "text": "What identifies and describes a claim about a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "claim-provenance-q02", "text": "Who or what asserted this about a claim about a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "claim-provenance-q03", "text": "What may an agent decide or do once a claim about a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] }, { "id": "time-and-versions", "name": "Time, versions and supersession", "description": "When a claim was true, when it was learnt, and what replaced it.", "findings": [ { "id": "validity-and-supersession", "name": "Validity period and supersession", "description": "How an old claim about a key is retired without being erased.", "questions": [ { "id": "validity-and-supersession-q01", "text": "What identifies and describes the validity of a claim about a key, and in what units or vocabulary?", "kind": "definition", "answer_data": [ "identifiers", "types and classes", "values with units", "explicit unknowns" ] }, { "id": "validity-and-supersession-q02", "text": "Who or what asserted this about the validity of a claim about a key, by which method, and when was it true?", "kind": "provenance", "answer_data": [ "authority", "method", "evidence", "event time", "knowledge time" ] }, { "id": "validity-and-supersession-q03", "text": "What may an agent decide or do once the validity of a claim about a key is known, and what must it refuse?", "kind": "action", "answer_data": [ "permitted actions", "preconditions", "refusals", "escalation" ] } ] } ] } ] } ] }, "statistics": { "bundles": 6, "layers": 12, "findings": 14, "questions": 38 } } } }