We're live with Aktionariat! Join our  [/investors](/investors) and become part of the team that builds the sovereign web.

Try [SEAL](/seal/mail) for mail with your next message, just add _seal@vereign.com_ to **BCC** of your next e-mail.

Georg Portrait

_Zug 23.12.2022_

A wonderful Festive Season, and a Happy 2023 from the team at Vereign, whose journey started in 2017 and which saw 2022 as the most successful year to date.

Central this year was of course our work with the first phase of the Gaia-X Federation Services (GXFS) implementation. [Data spaces](https://gaia-x.eu/what-is-gaia-x/core-elements/data-spaces/) - the central topic of Gaia-X, [which is now also coming to Switzerland](https://www.inside-it.ch/gaia-x-will-in-die-schweiz-expandieren-20221117) - are the cornerstone of digital strategies for governments and industries across the world. And decentralized identity holds the key to making them possible. Within 2022, our team at Vereign has built the first scaleable, robust and secure implementation of [Organizational Self Sovereign Identity](https://www.vereign.com/ocm) for data spaces.

In parallel, the conversation about the Swiss eID has been fascinating and we have been involved both through [DIDAS](https://www.didas.swiss/), the Swiss SSI ecosystem organization, as well as directly with the relevant participants within this ecosystem. Swiss institutions are driving this process in a way we believe should serve as an example for other governments: Open, participatory, with open
lines of communication and their own hands on the code, including a commitment to release their own implementations and contributions as Open Source. 

But our traditional products have also kept evolving, and we have in particular been working on improvements of the [SEAL technology](https://www.vereign.com/seal), both for [email](https://www.vereign.com/seal/mail), as well as for documents, which we plan to put into production early next year with exciting partners.

There is also an entirely new domain that we have come into contact with, and for which we find ourselves in conversations every week over the past months, which is automotive. The potential for Automotive SSI is fascinating, especially when combined with data spaces, and we hope we will have first results to share with all of you throughout the coming year.

So during our last board meeting for 2022 on Thursday, we could not only draw a very positive conclusion for this year, we are also looking at a conservative probability adjusted pipeline for sales that would see us double our revenues in 2023. And if you know anyone who would still like to be part of that in a modern and innovative way, that door is still [open](https://www.vereign.com/investors).

We set the groundwork for this during our early December team meeting in Sofia, with team satisfaction and health at an all time high. We hope that next year we will be able to come together with the entire team, and celebrate another year of achievements that have exceeded our expectations.

**Meanwhile we wish all of you a wonderful Festive Season, and a Happy 2023**

![christmas_black_and_white.jpg](/uploads/christmas_black_and_white_b87e2b030c.jpg)

_Zug 23.12.2022_

A wonderful Festive Season, and a Happy 2023 from the team at Vereign, whose journey started in 2017 and which saw 2022 as the most successful year to date.

christmas_black_and_white.jpg

Vereign wishes you a Happy Festive Season, and a Fantastic New Year

_Zug, December 2022_

Open Source is vitalised by collaboration and its corresponding communities. Thus it is vital for companies in this sector to have an active partner network. After successful collaboration between Vereign and DAASI International on the [Gaia-X Federation Services](https://www.gxfs.eu/), both companies decided to build on this success grow by officially partnering for other projects in this area.

The new partners intend to use the Self-Sovereign Identity (SSI) code from the Gaia-X project, especially the Organizational Credential Manager, to close gaps in the market. In doing so, they hope to speed up the adoption of SSI technology, in Europe as well as worldwide.

Moreover, the companies want to use their new partnership to build a bridge between the identity solutions of tomorrow and the established technology stacks. Whereas Vereign specialises in the modern SSI technologies, DAASI International is an expert for traditional IAM with OpenID Connect. In order to create new use cases, particularly for B2B scenarios, the two need to be combined and integrated.


> “Today’s identity systems have been very successful but are finally reaching their limits as the prevalence of singular platforms as well as the regularly occurring theft and loss of data prove”, explains Georg Greve, the CEO of Vereign. “SSI includes security and privacy as cornerstone principles, and it was developed for complex data ecosystems. Nevertheless, the switch is going to take years as identities are integrated in many different ways within a solution. This is what makes this collaboration so valuable for customers.”

The resolution eIDAS legally regulates the provision of digital identities amongst other things. Whereas the Version 1.0 was solely focused on digital signatures with centrally controlled X.509 technologies, the suggestion for eIDAS 2.0 foresees the integration of SSI technology to increase the recognition of the eID. Hopefully, this will help spread awareness for the topic of SSI within Europe, this also includes Switzerland which recently decided on an eID based on SSI technologies. Thus, traditional IAM systems, which are based on OpenID Connect or similar technologies, need to be able to include SSI options to reflect these developments.

> “Self-Sovereign Identity is a consequent transfer of responsibility to the owner of the identity itself. This technology also matches the approach of DAASI International, who are vocal advocates for open source, open standards, and data privacy. By partnering up with Vereign we want to make the technological progress and its advantages available to small and medium-sized companies”, states Peter Gietz, the CEO of DAASI International.“Self-Sovereign Identity is a consequent transfer of responsibility to the owner of the identity itself. This technology also matches the approach of DAASI International, who are vocal advocates for open source, open standards, and data privacy. By partnering up with Vereign we want to make the technological progress and its advantages available to small and medium-sized companies”, states Peter Gietz, the CEO of DAASI International.

The new alliance of the two companies have already planned out the next concrete steps to develop the results from Gaia-X into marketable products. Of course, we will inform you about any developments in due time. Nonetheless, DAASI International and Vereign are at your disposal at anytime if you have any questions or other requests.




_Zug, December 2022_

Open Source is vitalised by collaboration and its corresponding communities. Thus it is vital for companies in this sector to have an active partner network. After successful collaboration between Vereign and DAASI International on the Gaia-X Federation Services, both companies decided to build on this success grow by officially partnering for other projects in this area.


xcharles-deluvio-AT5vuPoi8vc-unsplash_zugeschnitten-554x250.jpg.pagespeed.ic.fKw979fjiH.webp

Partnering with DAASI International

_Zug, December 2022_

After this year’s successful completion of the reference implementation for the Gaia-X Federation Services ([GXFS](https://www.gxfs.eu/)), the second phase will now build upon that work, focusing on identity & trust, and compliance services. Like the first phase, this second phase is overseen by [eco — Association of the German Internet Industry,](https://international.eco.de/topics/gaiax/) the contracting authority for the German GXFS design and implementation work. The specification is jointly being developed by [Fraunhofer IAO](https://www.iao.fraunhofer.de/en.html), [Spherity](https://spherity.com/), [T-Systems](https://www.t-systems.com/de/en), and [Vereign](https://www.vereign.com/).

The results of the first phase of the federation services development were presented during the recent [Gaia-X Summit](https://gaia-x.eu/summit-2022/) in Paris, France. They include crucial services such as a Personal Credential Manager, an Organization Credential Manager, and a Notarization API. While the focus of this first phase was on being able to trial and demonstrate the Gaia-X principles, the second phase will now build upon the experiences made and feedback received to make sure the collaboration services will meet the requirements of the first productive installations in 2023.

Spherity, T-Systems & Vereign are bringing in their hands-on experiences from the [phase 1 implementation phase ](https://gitlab.com/gaia-x/data-infrastructure-federation-services/) to further improve the federation service design. One critical new capability is a trust model for Gaia-X industry domain federations that will be built upon the previous work of Fraunhofer IAO on [TRust mAnagement Infrastructures (TRAIN)](https://gitlab.grnet.gr/essif-lab/infrastructure/fraunhofer/train_project_summary).

The results of the Phase 2 specification phase will be published in Q1/2023 as the basis for further open-source SW development of GXFS components.

Meanwhile, Vereign AG already provides early access to consultancy, services and support for [organizational SSI stack](https://vereign.com/ocm/), and is inviting organizations to get in touch to [build value](https://www.vereign.com/blog/news/gaia-x-self-sovereign-identity-ssi-reference-implementation-ready-for-proof-of-value&id=26) on top of this solution.

## About Fraunhofer IAO

The [Fraunhofer-Gesellschaft](https://www.fraunhofer.de/) is the world’s leading applied research organization, with an annual research budget of €2.9 billion. For more than 40 years, the [Fraunhofer Institute for Industrial Engineering IAO](https://www.iao.fraunhofer.de/) in Stuttgart has been a highly regarded provider of services in the fields of company and work structures and organization, technology management, and information and communication technology. Since 2013, the team Identity Management at Fraunhofer IAO has been working on research and development projects to build secure and privacy-friendly digital identity management systems and trust infrastructures. It cooperates with national and international research as well as industry partners to develop solutions that meet stakeholder requirements and are economically viable.

## About Spherity

[Spherity](https://spherity.com/) is a German decentralized digital identity software provider, that brings secure identities to enterprises, machines, products, data, and even algorithms. We provide the enabling technology to digitize and automate compliance processes in highly-regulated technical sectors. Our offered products empower cyber security, efficiency, and data interoperability among digital value chains. Spherity is certified according to the information security standard [ISO 27001](https://medium.com/spherity/spherity-achieves-iso-27001-certification-f687ee42c40e).

## About T-Systems

With around 28,000 employees worldwide and annual revenues of EUR 4.0 billion (2021), [T-Systems](https://www.t-systems.com/de/en) is one of the leading providers of digital services. The Deutsche Telekom subsidiary is headquartered in Germany and has a presence in Europe as well as in selected core markets and strategic production locations. T-Systems can provide a global production and supply chain to companies operating worldwide. T-Systems offers integrated end-to-end IT solutions, driving the digital transformation of companies in all industries and the public sector. T-Systems’ focus industries are automotive, the public sector, healthcare, and transport. For these areas, T-Systems develops industry-specific solutions — so-called vertical applications.

## About Vereign

[Vereign AG](https://vereign.com) (“Verifiable and Self-Sovereign”) is a company specializing in sovereign technologies, in particular services and products around Self-Sovereign Identity (SSI). Founded 2017 in Switzerland, Vereign has been at the forefront of Self-Sovereign Identity based on principles of openness, privacy, and security. Vereign provides professional services, response times, and support for self-sovereign software solutions, such as the Gaia-X Federation Services (GXFS) organizational and personal wallets, the trust services API, or its Vereign SEAL credentials for email and documents. Vereign also has a tokenized share programme, allowing you to become a [shareholder of Vereign](https://vereign.com/investors/), securing your part in the future of SSI.


_Zug, December 2022_

After successful completion of the reference implementation for the Gaia-X Federation Services (GXFS), the second phase will now build upon that work, focusing on identity & trust, and compliance services. The specification is jointly being developed by Fraunhofer IAO, Spherity, T-Systems, and Vereign.

1_Ha_aGus3JLfLgIWVf7G9Lg.webp

The second phase specification of Gaia-X Federation Services launched

_Zug, November 2022_

Critical questions are being raised today that will define the future champions. Questions like what opportunities await your organization in an economy of data spaces and industry 4.0? How will you implement Zero Trust networks? Or how to address General Data Protection Regulation (GDPR) in a data driven economy?

**Vereign can help you find those answers in partnership with DAASI International by harnessing the potential of modern SSI technology.**

Consortia across Europe spent the last years developing a vision of self-sovereign technology and the open and secure ecosystem of value that it will unlock. Much of that work has been done under the umbrella of [Gaia-X](https://www.data-infrastructure.eu/GAIAX/Navigation/EN/Home/home.html) and its many local and sectorial communities.

Starting in January 2022, several groups under contract with eco Association began working on the reference implementation for the [Gaia-X Federation Services (GXFS)](https://daasi.de/en/2022/02/04/ssi_gaia-x/). Results were presented at the [GXFS Summit in Berlin](https://www.gxfs.eu/follow-up-report-gxfs-connect-2022/) and delivered a clear picture of resounding success, creating a strong foundation for trust and interoperability going forward.

Three of the core components, the Organizational Credential Manager (OCM), Trust Services API (TSA) and Personal Credential Manager (PCM) were developed by a consortium under coordination of Vereign AG, a Swiss pioneer in Self-Sovereign Identity. Together with German identity specalist DAASI International and Indian SSI development house AyanWorks, Vereigns team of domain specialists delivered all components for the GXFS community.

"The resulting stack is unique in several ways," explains Kalin Canov, General Manager at Vereign Labs Ltd. "It was built as a microservice architecture, ready for flexible deployment and scalability in Kubernetes. Connected with a set of APIs, the result is a highly adaptable SSI technology platform for organizations."

Meanwhile work continues on the next stages of the specification and further improvements of the original components are already underway. Vereign continues to actively contribute to GXFS and is seeking organizations and companies that aim to deliver first proof of value on the results of this first phase of GXFS implementation.

"We now have a workable solution that enables organizations to issue, receive, resolve, verify and process verifiable credentials at scale, with a built in policy framework that can be programmed in REGO," explains Georg Greve, CEO of Vereign. "Especially the trust services component is crucial for professional adoption and we're looking for organizations eager to try out this stack to generate value for their customers, partners and themselves."

"For DAASI International this project is of great importance, since it allows for extending classical IAM systems with SSI-functionality. Thus we have great interest to continue our cooperation with Vereign" says Peter Gietz, CEO of DAASI International.

More information about the stack can be found at [https://vereign.com/ocm](https://vereign.com/ocm)

## About Vereign

Vereign AG (“Verifiable and Self-Sovereign”) is a specialized company for sovereign technologies, in particular services and products around Self-Sovereign Identity (SSI). Founded 2017 in the Cryptovalley in Zug, Switzerland, Vereign has been at the forefront of Self-Sovereign Identity based on principles of openness, privacy and security, working with groups such as the European Gaia-X association, the Decentralized Identity Foundation (DIF), or the Swiss Digital Identity and Data Sovereignty Association (DIDAS). Vereign provides professional products and services in this disruptive realm, such as Vereign SEAL, or its modules to connect people, use cases or organizations natively to the fast growing SSI ecosystem.

Further information: [vereign.com](https://vereign.com) 

## About DAASI International

DAASI International is an expert in (federated) identity and access management, using open source technology exclusively. Since it was founded in 2000, the IT service provider from Tübingen, Germany deals with identity management, access control and directory service technologies for universities, public authorities and companies. Additionally, DAASI International is actively involved in the field of digital humanities and participates in national and international research projects, including the digital research infrastructure DARIAH-DE. With his company, founder Peter Gietz pursues the goal of creating interesting and varied workplaces with innovative open source technologies for a committed team and thus promoting the use of open standards.

Further information: [https://daasi.de](https://daasi.de ) 

_Zug, November 2022_

Critical questions are being raised today that will define the future champions. Questions like what opportunities await your organization in an economy of data spaces and industry 4.0? How will you implement Zero Trust networks? Or how to address General Data Protection Regulation (GDPR) in a data driven economy?

**Vereign can help you find those answers in partnership with DAASI International by harnessing the potential of modern SSI technology.**

gxfs.jpg

Gaia-X Self-Sovereign Identity (SSI) reference implementation ready for proof of value

Vereign_Logo_ICON_BLACK.png

Gaia-X is a project initiated by business, politics, and science representatives from Europe and beyond to create a federated and secure data infrastructure following European standards. The goal is to make the big data industries less dependent on major American corporations, and thus strengthen the digital sovereignty of European users. In order to advance this endeavour, different initiatives within Gaia-X have published tenders for the necessary technology; one of these tenders was published by the [eco](https://www.eco.de/) association for the Gaia-X Federation Services ([GXFS](https://www.gxfs.eu/de/)).


As a result, DAASI International started a bidding consortium together with the Swiss software visionaries of Vereign AG. Thanks to extensive experience in the relevant disciplines combined with a competitive offering, three projects for the following topics could be won: a personal credential manager, an organizational credential manager, and a trust services API.

## The Projects

Once the milestones have been defined in cooperation with the Gaia-X management, development will begin in February. Within the ambitious time frame of only six months the basic code is expected to be available to the community via GitLab. Any progress will be publicly accessible. Moreover, it is strongly encouraged for the community to engage and contribute already during the development phase. Once the projects are concluded, the code will be officially handed over to the Gaia-X community.

## Self-sovereign Identity

Self-sovereign Identity will be a quintessential concept for the realisation of the three projects. A decentralised identity shall empower users to achieve more self-determination and control over storage and sharing of their identity data. The data is stored in a so-called wallet belonging to the user. This wallet also contains the digital keys for authentication with online services, thereby making their storage of the same data obsolete. State of the art Blockchain technology ensures the integrity and verifiability of the used data.

Vereign AG, the head of the consortium, has gained extensive experience combining both Self-sovereign Identity and Blockchain technology. DAASI International will lend their expertise in the development of innovative open source software, as well as in classic identity management.

## About Vereign

Verifiable and sovereign – the name says it all for Vereign AG, founded in Zug, Switzerland in 2017. The Swiss company is one of the most innovative start-ups of recent years and was nominated for an audience award at the Digital Economy Award in Zurich's Hallenstadion in 2019.

Besides a self-sovereign identity solution Vereign offers blockchain secured, digital provenance with verifiable credentials for emails and documents. Designed according to privacy-by-design, data-saving and open source principles.

## About DAASI International

DAASI International is an expert in (federated) identity and access management, using open source technology exclusively. Since it was founded in 2000, the IT service provider from Tübingen, Germany deals with identity management, access control and directory service technologies for universities, public authorities and companies. Additionally, DAASI International is actively involved in the field of digital humanities and participates in national and international research projects, including the digital research infrastructure DARIAH-DE. DAASI International’s range of services covers consulting, support, hosting, and software development, as well as various trainings.

For further information: [https://daasi.de](https://daasi.de)

Zug / Tübingen, 4 February 2022 - The open source companies Vereign and DAASI International will set the cornerstone for state of the art SSI technology in Gaia-X.

New Technologies for Gaia-X: Consortium Announces Project Start

Every day, more than [300 billion](https://www.statista.com/statistics/456500/daily-number-of-e-mails-worldwide/) e-mails are sent worldwide, many of them to multiple recipients. Today, practically no company can function effectively without this channel of communication. This makes it all the more important to ensure digital provenance, i.e., the authentic, verified origin of an e-mail.

VNC, a leading developer of open-source enterprise applications, now uses Vereign SEAL on its communication and collaboration platform VNClagoon. Based on blockchain technology, a seal is attached to each email in the form of a QR code that can be verified by any mail client or server that supports Vereign SEAL. Other functional modules of the collaboration stack, such as messaging or ticketing, will follow. VNC and Vereign are working together to successively integrate Vereign SEAL into all core VNClagoon applications, such as VNCchannel, VNCtalk or VNCgroupware, to make digital provenance widely available beyond email.

"The integration of Vereign SEAL into VNClagoon is an exciting project," emphasizes Andrea Wörrlein, Managing Director of VNC in Berlin, Germany and Board Member of VNC AG in Zug, Switzerland. "It exemplifies how blockchain technology can help make the digital world a more comprehensively secure place and at minimal cost."

"Digital provenance is becoming a critical factor for many companies," explains Claus Bressmer, Managing Director at Vereign. "Security and compliance policies mandate it in an increasing number of countries, but it cannot be met with local platforms or proprietary, client-specific solutions. The solution is the Vereign SEAL."

## About VNC - Virtual Network Consult AG

VNC – Virtual Network Consult AG, based in Switzerland, Germany and India, is a leading developer of open source-based enterprise applications and positions itself as an open and secure alternative to the established software giants. With VNClagoon, the organization with its global open source developer community has created an integrated product suite for enterprises, characterized by high security, state-of-the-art technology and low TCO. VNC's customers include system integrators and telcos as well as large enterprises and institutions.

Further information on [https://vnclagoon.com](https://vnclagoon.com), on [Twitter @VNCbiz](https://twitter.com/vncbiz) and on [LinkedIn](https://www.linkedin.com/company/vnc-ag).

## About Vereign – Verifiable and Sovereign

Verifiable and sovereign – the name says it all for Vereign AG, founded in Zug, Switzerland in 2017. The Swiss company is one of the most innovative start-ups of recent years and was nominated for an audience award at the Digital Economy Award in Zurich's Hallenstadion in 2019.

In addition to a self-sovereign identity solution, Vereign now offers the next generation for Digital Registered Mail thanks to an independently verifiable origin seal for email. Using Distributed Ledger Technology (DLT), it effectively protects the sender's reputation from impostors and holds proof of the content and integrity of the communication. Available for Office365/Outlook and Gmail on their respective app stores, it can be integrated into any email environment. Designed according to privacy-by-design, data-saving and open source principles.

Zug, Switzerland, 11 September 2021 – Vereign SEAL is the world's first blockchain application used to preserve an email’s digital provenance. It is now available as an add-on to the VNClagoon communication and collaboration platform.

vnclagoon.png

VNC uses blockchain technology from Vereign for secure email traffic

georg-300x300.jpg

### Can it really be possible to recognize every single scam? Let me tell you how your protection works right now, and how you can improve it today.

Reputation is the key to our heart. We shoot the messenger because we expected better from them. The reason we place our trust in the messenger is simple: It is too exhausting to verify each individual message. Imagine you were selling your house for cash. Would you have the bills checked? What if the buyer was your lifelong best friend and they told you they got them fresh from their bank? Didn’t your distrust just decrease with each additional layer of reputation added?

Email protection today works a lot like that. You trust your email provider to keep you safe. And your email provider tends to trust messages from other email providers for you if that provider looks good. In this case, being trustworthy means their servers are well configured, their domain name service (DNS) records are well kept and secured, and they follow all the best practices.

There are also many technical specifications to follow, and they have complicated technical names and acronyms like DKIM – standing for “Domain Key Identified Mail” – or SPF, which is the short-hand for “Sender Policy Framework.” Both are frameworks that come together in the “Domain-based Message Authentication, Reporting & Conformance” policy, which abbreviates to DMARC.

All these standards have one single goal: To allow mail servers to decide which other mail servers to trust. But if applied rigorously, these frameworks will also stop and delete a lot of good mail that should have arrived at the recipient.

_Just imagine this in the real world and if for every 10 letters you sent, only 6 would reach their destination. I guess you would have some choice words for your postal service then._

It is for good reason that mail providers use these principally as indicators. Many users have partially disarmed these mechanisms because they believe the damage of losing important email is the bigger risk. So, email providers try to use pattern recognition and AI to analyze your email and understand whether it is likely real or fraudulent.

Such systems are very fragile and find themselves in a very asymmetric risk and reward scenario. Scammers only need to fool them once to reach millions of users, which is what appears to have happened to Microsoft Office365 recently:

[Phishing campaign spoofs Microsoft domain. Is lack of DMARC to blame?](https://www.scmagazine.com/news/architecture/phishing-campaign-spoofs-microsoft-domain-is-lack-of-dmarc-enforcement-to-blame)

So, should they trigger much earlier and more aggressively? Only if you are willing to accept a totally unreliable email provider. Some mails arrive, others don’t. It seems completely random, and you will have no idea what you missed. Sometimes you may find out later that you missed an important email; other times, you won’t.

_All these systems work on a balance between false positives, messages that were incorrectly flagged as scam, and false negatives, scam messages that the system missed. Shift the balance aggressively toward avoiding false negatives at all cost and the number of false positives shoots up dramatically._

So filtering is necessarily only partially effective. This is why so many people have high hopes for universal DMARC adoption: Each mail server could then make sure the other mail server is legitimate and supposed to communicate on behalf of an organization. Will we ever get to this point? Hopefully, but I dare not predict when because old habits die hard. Just look at the number of fax machines still in operation.

And once this goal has been achieved, what is next? Mail servers are still only messengers. This brings us back to the beginning of the article. Should we blindly trust each message because it seems to have come via a trustworthy messenger? And what do we know of the process that made the messenger accept the message in the first place?

_The best we can hope for with traditional approaches is to make sure the messengers are mostly trustworthy and filter out some of the scam that still makes it through. It will be gradually better than what you know today – but not radically so._

For a radical improvement, we would need a way that secures each individual message as it is being handled by the messengers. That’s been impossible so far, mostly because there has been no way to verify the sending side as it was hidden behind its messenger. Vereign Seal fundamentally changes that.

With this new approach, each message gets its own cryptographic seal to protect the message’s authenticity and integrity. Each seal encodes all the necessary information to verify its message and access additional sender and recipient records, with built-in blockchain protection against tampering and manipulation. This is the same technology that makes Bitcoin secure against forgery, and now protects each of your messages.

Added to each message as a QR Code, a Vereign Seal allows to bring up a web verification app that unlocks the seal, obtains all the available records, verifies them against the blockchain, and displays the result. Available as add-ins for Office365 and Gmail, you can also verify each Vereign Seal against the blockchain right in your inbox.

Likewise, the add-ins can seal each message locally in your browser before sending them off via Gmail and Office365. This also works locally on your desktop or mobile with up-to-date versions of Microsoft Outlook

The Vereign Seal also supports and helps enhance our messengers, the many different email servers, by allowing them to seal each message as it passes through, effectively testifying to the recipient each message has been locally checked, verified, and sent off correctly. Receiving messengers can also testify having received a sealed message correctly and let the sender know that the message has been accepted.

But what if someone tried to mislead users by adding a false Vereign Seal that led to a fake landing page?

Like a 3-year-old’s drawing of a banknote would be obvious to you, such a fake seal would be immediately obvious to each add-in and messenger that receives such a mail. There would be no doubt this message is a scam. It cannot result from misconfiguration or honest mistakes. There are no false positives.

For the first time, 100% Proof Positive Scam Detection is possible. But it gets better. Such falsified seals can trigger tripwire alerts, allowing for countermeasures and appropriate responses. No scam undetected. For would-be scammers, staying far away from Vereign Seal is their last, best hope of success.

This is why you should install it right away and also ask your friends to do the same.

## What’s next

If you are a user of _Microsoft Outlook_ or _Office 365_, you can try out the [Vereign Seal Add-In](https://appsource.microsoft.com/en-gb/product/office/WA200002457) right now from Microsoft AppSource. For [instructions](https://community.vereign.com/t/how-to-install-vereign-seal-for-outlook-from-microsoft-appsource/217), please see the Vereign Community forum. Also we would love to get your feedback and questions [in the forum](https://community.vereign.com/c/support/seal/21).

As a user of Google, you’ll still have to be a little patient as Google is still reviewing the add-ins. They should normally become available in January, latest.

And if you’re an email service provider, gateway service vendor, or other participant in the email ecosystem and would like to see what we could be doing together: [Get in touch](https://www.vereign.com/contact) — and let’s talk!

Can it really be possible to recognize every single scam? How you can improve your protection today.

Blog-Overview-image-790-x-380.jpg

Proof Positive Scam Detection

### Email and blockchain have always been flirting with one another for a while now as their hearts are very much aligned. Both are decentralised, censorship resistant, independent and hold enormous value.

Blockchain is being used for tokenizing assets, such as real estate. Bitcoin and its siblings fascinate millions of people and in a world of negative interest rates are now seeing rapid [adoption by corporate treasuries](https://cointelegraph.com/news/corporate-bitcoin-treasuries-are-here-which-can-only-mean-good-things).

Email on the other hand has been the primary means of communication of enterprises for decades. It is the lifeblood of conducting business, and together with the telephone it is the only reliable channel across corporate walls. On top of that it is the channel to almost 4 billion users, making it the most universal channel to reach customers, partners, suppliers and regulators alike. To companies of all size it is both [uniquely valuable and uniquely threatening](https://ggreve.medium.com/security-spam-and-the-future-of-email-a444aa42f0ee).

Many people have dreamt up the combination over the past years. Either in terms of making blockchain as easy to use and universal as Email. Or in terms of putting email on the blockchain itself. Vereign has now done the latter, which may in fact lead to the former.

## How it works

Imagine that each email is sealed on your client, securing your sending identity, the subject, all attachments and the content of the message. This seal is attached to the message in the form of a QR code and locked securely against the blockchain.

Recipients can decode the seal using a web verification app on the local device by scanning the QR code, or verify it against the message via add-in straight in their Gmail or Outlook/Office365 inbox. In the same step the seal also unlocks message status information about when the email was sent as well as when it was received – provided the recipient is either using the add-in or their company is using a gateway that supports the Vereign Seal protocol.

Totemo is a partner and investor of Vereign and is the first company to have built the protocol into their gateway and to start offering it to their customers under the name totemomail® Verified. Among the customers of totemo you’ll find many banks, industry leaders and governmental institutions. Come January 2021, email on the blockchain will be a single click away. As it will be for you if you are a user of Gmail or Outlook/Office365.

## What it means

Vereign Seal is audit-proof email communication with increased sender authenticity. It makes email more powerful than tradition registered mail, and offers a new layer of protection against phishing, identity theft and business email compromise. There really is no reason or excuse to send email without such a seal.

Our approach of sealing critical information in messaging against the blockchain also opens the door to a whole new range of applications. Like sending Bitcoin by email to anyone, anywhere, no prior knowledge required.

The marriage of email and blockchain is transformative. It makes email the perfect channel for transport of value and to initiate its execution on the blockchain. There is no more universal medium, and by installing Vereign for Gmail or Outlook/Office365, you can bring value straight into the inbox of 4 billion people.


## What’s next

If you are a user of _Microsoft Outlook_ or _Office 365_, you can try out the [Vereign Seal Add-In](https://appsource.microsoft.com/en-gb/product/office/WA200002457) right now from Microsoft AppSource. For [instructions](https://community.vereign.com/t/how-to-install-vereign-seal-for-outlook-from-microsoft-appsource/217), please see the Vereign Community forum. Also we would love to get your feedback and questions [in the forum](https://community.vereign.com/c/support/seal/21).

As a user of Google, you’ll still have to be a little patient as Google is still reviewing the add-ins. They should normally become available in January, latest.

And if you’re an email service provider, gateway service vendor, or other participant in the email ecosystem and would like to see what we could be doing together: [Get in touch](https://www.vereign.com/contact) — and let’s talk!

Email and blockchain have always been flirting with one another for a while now as their hearts are very much aligned. Both are decentralised, censorship resistant, independent and hold enormous value.

Vereign_EmailBlockchain_BlogImagesEmailBlockchain_BlogImages_790x380-V2.jpg

When Email Marries the Blockchain

### Zug, 5 May 2020 – Vereign AG successfully closes its seed extension round of CHF 2.5 million, establishing a Swiss network for verified and self-sovereign identity. The financing round was led by a renowned Swiss entrepreneur via his Zurich based Family Office and AquilaDirekt AG. It was accompanied by some of the most competent Blockchain and technology groups alongside a number of seasoned Swiss business angels.


Over the past years, Vereign built a network of traditional and new technology players in a variety of areas, including finance, software development and the fundamental technologies of the future internet. As a result, Vereign now finds itself with a solution for self-sovereign identity, personal data and online authenticity that is far advanced and the larger ecosystem required to bring it to market.


> _“The current crisis has highlighted how fragile trust and authenticity are in our digital world. As many people find themselves forcefully distributed into home offices and remote locations, an epidemic of phishing, scams and deep fakes seeks to exploit our weakest links,” _
 
explains Georg Greve, Co-Founder and Head of Product Development of Vereign AG. 

> _“Identity is the cornerstone of any transaction. Our solution adds authenticity to digital exchange by putting identity and data ownership under the control of the user."_

Supporting the lead in this investment round is AquilaDirekt. Philipp Steinberger and Jan Lüchinger, Managing Partners of AquilaDirekt AG, say: 

> _“We consider ourselves fortunate to have discovered Vereign AG this early. Authenticity is going to be a major challenge for the decades ahead, and Vereign has a product that is years ahead of the competition, which we are excited to bring to market with them.”_

Totemo AG, a Swiss software company specialized in the secure exchange of business information, participates financially as well as operationally, supporting Vereign with marketing and sales experience. Dario Perfettibile, CEO of totemo, states: 

> _“Totemo has almost 20 years of experience as an IT security provider. Our solutions secure the communications of some of the biggest companies in the world. Vereign has a unique approach which impressed us deeply and we see great potential to develop new fields of business together. That is why we decided to not only partner with Vereign, but also to invest with resources and knowledge into a strategic partnership, hoping to make Vereign a pillar of our company’s success.”_

The Swiss Crypto Valley is a global brand, and at its heart are CV VC and CV Labs in their roles as investment and advisory company & blockchain technology dedicated incubator. CV Labs is responsible among other things for the renowned CV Summit which evolved into global flagship event for Blockchain technology over the past years. 

> _“CV VC is at the forefront of early-stage Blockchain technology investment, which is currently estimated to have a 3 trillion market potential by 2030 and is likely to impact many industries significantly,”_ 
 
explains Olaf Hannemann, Co-Founder & CIO. 

> _“Vereign is one of our most promising direct investments. There is a strong need for ownership of digital identity and authenticity. The company has developed a smart and practical solution with a strong team driving it.”_


Æternity is one of the most modern and promising Blockchain designs, aiming for exceptional high transaction capacity in combination with very low cost to enable even micro payments. It was founded by Yanislav ‘Godfather of Ethereum’ Malahov: 

> _“We have incorporated the lessons learned from earlier designs like Bitcoin and Ethereum into the design of æternity so we can handle billions of transactions efficiently. Starting with email, Vereign will secure hundreds of billions of interactions in the coming years. That is why we not only joined a technical partnership, but we also decided to invest directly into Vereign.”_

This network of a verified self-sovereign identity is joined by a strong international partner ecosystem. This includes IBM, a global leader in self-sovereign digital identity solutions. Vereign has been working closely with IBM since its inception, leveraging platforms based on open source and open standards to provide users with this extra innovation and security layer they need to face the challenges of today. 

> _“We are very pleased to collaborate with Vereign; its digital identity solution is the right answer to meet current market needs. Based on IBM’s OpenPOWER platform, Vereign and its clients have full transparency. Security for all our clients is at IBM’s heart”_ 
 
Christian Keller, CEO IBM Switzerland.

Claus Bressmer, Co-founder and CEO of Vereign AG, concludes: 

> _“We are on a journey to address one of the biggest challenges of our time. We cannot achieve that alone and I am extremely excited and humbled to have the support of such an outstanding partner ecosystem and this distinguished group of investors.”_

## Additional information
Please find a press release about our latest strategic technology [partnership by totemo here](https://www.totemo.com/en/news/news/totemo-invests-in-blockchain-start-up-vereign).

## About Vereign
“Verified & Sovereign – Vereign” – the name reflects the philosophy of Vereign AG, which was founded in Zug in 2017. The Swiss company is among the most innovative start-ups in recent years and was nominated for an audience award in 2019 at the Digital Economy Award of the industry association swissICT.

The core of Vereign’s solution is a digital identity, which makes the user sovereign over his own data and interactions. The identity is verified by third parties, for example as part of existing e-IDs or KYC (Know Your Customer) processes carried out by banks. An audit trail that is impossible to falsify thanks to Distributed Ledger Technology (DLT) ensures that the identity is protected against misuse.

The solution gives integrity and authenticity to a wide range of digital interactions, starting with email, the world’s most important communication protocol, and e-signing of documents according to eIDAS/ZertES. Integrated with Office365/Outlook, Gmail and LibreOffice, Vereign can be used immediately to enhance existing communication channels.

**Zug**, 5 May 2020 – Vereign AG successfully closes its seed extension round of CHF 2.5 million, establishing a Swiss network for verified and self-sovereign identity.

Swiss network for verified and self-sovereign identity established

### Kusnacht, 5 May 2020 – totemo, a leading provider of secure electronic communication in business environments, enters into a strategic technology partnership with Vereign. The start-up, based in the so-called Crypto Valley in Zug, develops solutions for authenticity in the digital world using Distributed Ledger Technologies (DLT). Various joint projects are planned; the first solution will be launched this year. Dario Perfettibile, CEO of totemo, is appointed to the board of directors of Vereign.

- totemo participates financially and operationally in the Swiss start-up Vereign in the scope of a technology partnership
- The first joint solution will already be available to customers in the course of the year
- Dario Perfettibile, CEO of totemo, is appointed to the Vereign Board of Directors

The technology start-up has been developing innovative solutions for the protection of digital privacy in corporate and private communications since 2017. Vereign protects users against phishing and identity theft, enables electronic signatures of important documents and protects personal data.

The partnership gives totemo access to technological innovations that ideally complement its own solutions for secure electronic communication. Marcel Mock, CTO and co-founder of totemo, explains: 
> _“We have defined several use cases with Vereign where our customers benefit from the combination of the respective technologies. The first joint project aims to make email even more secure for companies and also to enhance email with additional benefits. We look forward to offering our customers new, innovative solutions in the course of this year”._

## Strategic and operational cooperation

In the course of the cooperation, Dario Perfettibile, CEO of totemo, will receive a seat on the Vereign Board of Directors. This allows totemo to directly support the start-up with its marketing and sales experience and provides Vereign with access to corporate customers. 

>  _“Vereign and totemo are a great match. We are happy to contribute our almost 20 years of experience as an IT security provider. In return, we look forward to exciting new features for our portfolio: firstly, of course, by means of the blockchain, but also by focusing more strongly on B2C, that is, the secure electronic communication of companies with private customers. We see great potential for the development of new fields of business and our sustainable corporate growth”_, 
says Dario Perfettibile, summarizing his expectations of the cooperation.

Claus Bressmer, CEO of Vereign, adds: 
> _“totemo is a strategic technology investor for us, the cooperation opens up new target audiences and – in combination with the solutions of our partner – additional fields of application for our technologies. As a start-up, we benefit from totemo’s experience and market access, while bringing innovation and new impetus”._

## Additional information

Please find a press release about the closing of the latest financing round by Vereign [here](https://vereign.com/blog/news/swiss-network-for-verified-and-self-sovereign-identity-established&id=2).


## About totemo
The Swiss software company totemo ag offers solutions for the secure exchange of business information. totemo protects email communication and file transfer through encryption, placing special emphasis on maximum user-friendliness – naturally also on mobile devices. The patented and FIPS 140-2-validated totemo security platform enables seamless and quick integration into any existing IT infrastructure.

Around the world, more than 3.5 million users in 1,500 companies and organizations across all industries, including major corporations, rely on totemo’s security solutions. The company was founded in 2001 and is based in Küsnacht near Zurich.

For more information see: [www.totemo.com](https://www.totemo.com)

## About Vereign

“Verified & Sovereign – Vereign” – the name reflects the philosophy of Vereign AG, which was founded in Zug in 2017. The Swiss company is among the most innovative start-ups in recent years and was nominated for an audience award in 2019 at the Digital Economy Award of the industry association swissICT.

The core of Vereign’s solution is a digital identity, which makes the user sovereign over his own data and interactions. The identity is verified by third parties, for example as part of existing e-IDs or KYC (Know Your Customer) processes carried out by banks. An audit trail that is impossible to falsify thanks to Distributed Ledger Technology (DLT) ensures that the identity is protected against misuse.

The solution gives integrity and authenticity to a wide range of digital interactions, starting with email, the world’s most important communication protocol, and e-signing of documents according to eIDAS/ZertES. Integrated with Office365/Outlook, Gmail and LibreOffice, Vereign can be used immediately to enhance existing communication channels.

For more information see: [www.vereign.com](https://www.vereign.com)

**Kusnacht**, 5 May 2020 – totemo, a leading provider of secure electronic communication in business environments, enters into a strategic technology partnership with Vereign.

Strategic technology partnership to develop joint solutions: totemo Invests in Blockchain Start-up Vereign

### Zürich, 22 April, 2020 – Vereign (“Verified and Sovereign”), a Swiss-based startup developing distributed ledger-secured authentic communication, today announced it has chosen IBM POWER9-based servers to develop its self-sovereign digital identity solution. This solution is being designed to allow users to verify authenticity across the web while keeping full control when sharing sensitive personal data.

The paradigm that defines today’s digital identities order is a catch 22. As cyber criminals grow more and more sophisticated, organizations lack effective tools to combat CEO fraud and other forms of Business Email Compromise (BEC) in order to protect their employees and customers. Users across the internet are overwhelmed by ever growing complexity. Faced with the daunting task of maintaining hundreds of passwords, most people re-use a small number of moderately good passwords. This complicated situation leaves users with an average of 5.5 social media identities, while increasing the risks of data leaks and identity theft [1].

Trying to solve this problem, Vereign has created a decentralized self-sovereign solution that focuses on the aggregated identity of the user. It acts as a globally decentralized Peer-to-Peer PKI that is Verified and Sovereign using distributed ledgers for independent verification. [2]
“Today people deal with several digital identities having separate access or passwords based on the activity they do online – a bank transfer, tax payment, email, shopping, etc. Thus they repeatedly share sensitive personal information and typically lack control over their personal data”, says Georg Greve, Chairman and Head of Product Development at Vereign. “We have chosen the IBM POWER platform to create a decentralized, self-sovereign identity solution based on blockchain that enables a seamless addition of integrity, authenticity, and privacy to any kind of service – starting with email and digital signatures on business documents. It is available to 3.7 billion daily users immediately worldwide”.

Vereign offers a service that is a federated, software-as-a-service solution that organizations can access from the cloud or on-premises. Hosted on IBM POWER9 servers located in Switzerland, the platform is based on open source and open standards, making it fully auditable with no hidden management engines. As security is key for identity solutions, the solution relies on the security built in at every layer of the IBM POWER9 processor. Data encryption is being used all across.

“IBM Systems provide the right platform for new businesses to build a reliable and trusted environment – whether in public or private clouds or on premise,” says Bernd Schierholz, Vice-president Systems for IBM in Germany, Austria and Switzerland. “Our IBM POWER9 system enables innovative clients like Vereign to leverage and innovate with the same technology running the world’s smartest supercomputers. In addition, IBM POWER9-based IBM Power Systems Virtual Servers are now available in the IBM Cloud delivering POWER9 capabilities as a cloud and offering solutions in a variety of areas to the advantage of our clients.”

The decentralized self-sovereign digital identity from Vereign offers advantages to individuals and companies that are hard to achieve with the traditional ways of dealing with digital and physical identities. It integrates with various channels enabling individuals to choose and control how they share their personal data. As the individuals always remain in control of their data and are empowered to maintain it properly, GDPR and compliance requirements are automatically addressed.

### Footnotes:

[1] – Source: IBM X-Force Report: [https://newsroom.ibm.com/2020-02-11-IBM-X-Force-Stolen-Credentials-and-Vulnerabilities-Weaponized-Against-Businesses-in-2019](https://newsroom.ibm.com/2020-02-11-IBM-X-Force-Stolen-Credentials-and-Vulnerabilities-Weaponized-Against-Businesses-in-2019)

[2] – Source: [https://medium.com/@ggreve/game-of-keys-too-much-information-about-certificate-authorities-f4f08101b3bb](https://medium.com/@ggreve/game-of-keys-too-much-information-about-certificate-authorities-f4f08101b3bb)

**Zürich**, 22 April, 2020 – Vereign (“Verified and Sovereign”), a Swiss-based startup developing distributed ledger-secured authentic communication.

ibm_colour.png

A Verified and Sovereign Digital Identity which Relies on IBM

### Email is still the [most valuable communication ](https://medium.com/@ggreve/security-spam-and-the-future-of-email-a444aa42f0ee)network and protocol. Yet most cybersecurity professionals agree its approach of verifying integrity has challenges and security measures for it may add to the problem. Consider how encryption easily helps attackers avoid countermeasures. Which is why both experts and regular folk are getting [phished for billions of dollars](https://www.ic3.gov/media/2018/180712.aspx) each year. 

And a signed email today only verifies that the content of an email has not been modified, not that what the user sees is actually what is there. However, the majority of the regular users don’t know that. So it makes it just look like the email is safe and trustworthy. Then there’s the habit of using email like a web page which brings tracking pixels, invisible text, links that lead to another site than the user expects… all these things are particularly rampant in emails because of people using HTML, the programming language for web design, just to have prettier emails.

Once you start questioning the legacy of many technical decisions we live with today, a certain Alice in Wonderland feeling is often inevitable. We started Vereign with an “if a we had to design a solution for this problem today, with modern understanding of technology – how would we do this” approach. Which led to a couple of design decisions that are looking to prove themselves as truly outstanding based on the feedback we received. And we’re also tumbling further down the rabbit hole on some fairly deep tech questions about [Certificate Authorities](https://ggreve.medium.com/game-of-keys-too-much-information-about-certificate-authorities-f4f08101b3bb) and [Digital Signatures](https://ggreve.medium.com/allowing-people-to-sign-for-themselves-fixing-qualified-signatures-bbb63f105555). But what about the way we’re securing email?
We kinda aren’t. Not really. Here’s why.

## Email Insecurity

Cybersecurity professionals have long recommended to turn off HTML email. But when faced with a choice between beauty and security, most users choose beauty. Should you happen to be a security expert, please don’t mistake this for an irrational or uninformed choice. And believe us, this is a mistake that we have been making for a very long time ourselves.
Consider this: For anyone but security experts, security is typically seen as the absence of harm.

Beauty supports the delivery of value. So by preferring HTML, most users prioritize value creation over the prevention of potential harm.

Which is why many email clients, including the most commonly used ones, support this choice and typically default to it. If they didn’t, they would probably not be among the most commonly used email clients for long. Billions of dollars in preventable damages across multiple industries had no meaningful impact on this preference. In the minds of the majority of users, the benefits outweigh the costs.
And truthfully, we don’t know. Maybe it does? There’s been no studies on it-- do companies profit more directly and indirectly from the beautification of email messages then they lose to fraud or phishing because of HTML and code able to run in emails? All we do know is that the attacks are there and the losses are there.
However, we really don’t have a choice anyway. It’s taken me some time and several stages to ultimately arrive at acceptance myself. But HTML email is here to stay, and the design of any solution must take this into account.
So where do the issues of HTML email arise from and how might we resolve them?

## Solutions

A vast number of issues arise out of a discrepancy of what the user believes they are seeing, and what the user is actually seeing. Be it that the HTML in the email is cleverly crafted to make it seem like it has been authenticated, or be it that it ultimately hides information in specific ways or uses character sets or things like white text on white background. Another technique that is often used is also to have the HTML load remote resources, which not only is a privacy issue, it might also allow to deploy malicious payloads to specific targets.

All of that is possible because HTML is source code. It is a set of instructions that gets interpreted by a piece of software that follows these instructions mostly blindly. Simply put, that piece of software, the so-called browser engine, is responsible for turning the source code into the visual representation on your screen. Like all complex software, such browser engines have security flaws and there is no guarantee any particular user would have the latest, most secure version.

So, when we’re sending HTML emails, we are sending source code. And traditionally, email signing is like a seal on the raw source code – and not what that source code does based on the many types of email software used for interpreting it, or what the user actually sees.

There is no content filtering on this in most cases, and signed emails always looks like it is far more trustworthy. So signing a malicious email is a great idea if you’re a criminal.

## Conclusion

If this was an article on how to send better Phishing emails, I’d have to say, in conclusion, if you want to get into the [Evil League of Evil](https://www.youtube.com/watch?v=VNhhz1yYk2U), always sign your malicious emails.

## Wait, Not Yet

But this isn’t an article about making more evil emails. So we’re not done.
The signing problem is a known problem. Which is why most of the larger email platforms have stopped trusting third parties and applications. Instead they insist that users use only a limited set of mostly harmless commands of the programming language that is HTML, allowing them at times to also filter for potentially malicious tricks, and the email itself gets composed and then signed on the platform itself – not the email client.
Which then poses the next challenge: How much trust do you want to put into the platform? Remember, just because you pay for the 3rd party app doesn’t mean you can fully trust them.

All the big breaches of the last 10 years are because of 3rd party vendors. And email platform makers, well, they can literally change your message and sign it in your name.

## The Actual Conclusion

Is there a way to solve this? Can we perhaps find a better approach to email signing that compares the result – information visible to the recipient – to the intended result – information sent by the sender. Can we compare two messages in this way after they have undergone sanitizing on a centralized platform?

Doing this right might be a great way to increase security for signed messages. Which is why we’ve been thinking about this a lot. The signature for such an approach could easily be stored in a [V-Card](https://community.vereign.com/t/your-v-card-will-be-your-signature/167) without disturbing legacy applications and clients. It would also allow to additionally encapsulate messages using S/MIME or OpenPGP standards.

But what is the best algorithm to compare the information of original and received message?

This article is a co-production with our advisory board member [Pete Herzog](https://medium.com/@peteherzog) of [ISECOM](https://isecom.org/).

A properly encrypted email will perfectly protect the virus or other cyberattack attachment from virus scanners and other defensive measures.

4257-Medium-article-images-02-1024x683.jpg

The Security Problem You Forgot Wasn’t Solved Yet

### Digital Certificates are like fancy, modern, sealed letters with that embossed wax insignia of your house banner or family crest that says: “In my function as Certification Authority I hereby attest that I have verified the bearer of this seal really is Georg Greve, first of his name, who is a real person and really has the email address georg.greve@vereign.com, and is the one true King of the North.” Or something like that.

And if you believe the seal of the Certificate Authority (CA) you can be reasonably certain the person showing you this certificate is likely Georg. Unless of course the certificate was stolen, and Georg noticed it. In that case he might have asked the CA to provide another seal to say “that particular seal is now invalid.” Then everyone who would be diligent enough to call the CA to ask whether the seal is still valid would find out it no longer is and can disregard that last message that arrived by crow.

Briefly, the function of a Certificate Authority is to certify that a particular key really belongs to a specific person or institution. Be it the owner of a domain, the person behind an email address or a business. It’s ultimately about proving this certificate really belongs to the organisation or person it claims to belong to and sometimes also that this organisation or person are real, and do exist.

In other words: Certificate Authorities provide the link between the identity of a person or organisation, and the digital key used to represent them.

Now imagine such a seal carried proof of your identity directly. Anyone you gave the seal to could directly verify that it really was issued by you. Furthermore, imagine you didn’t have a single seal, but as many as you wanted. You would generate each seal when you needed it, disclosing about yourself only what you need for this specific purpose at the time. Each seal could ever only be used exactly once, for a single interaction. A public ledger would ensure that anyone who received such a seal could verify that it had not been stolen. You could no longer be impersonated. That would be cool. You could send as many crows as you want and not have to pay for each wax imprint on your scrolls. And now we’ve taken the whole Game of Thrones thing too far….

The truth is that this is made possible with Self-Sovereign Identity (SSI). If such an identity is capable aggregating third party verification, its owner can prove their identity has been successfully verified by their bank, their government or some other organisation. Official bodies, including existing Certificate Authorities, will still have a useful role in supporting trust in the institutions doing the verification. But at this organisational level key management is far easier. Also, each identity typically carries verification from multiple organisations, making the result far more robust than relying only on a single point of failure, which is currently the Certificate Authority. And yes, they do get compromised enough to make it a concern.

Even more, if the identity is capable of [Zero-Knowledge Proof](https://en.wikipedia.org/wiki/Zero-knowledge_proof) (ZKP), the certificates will be far more privacy friendly than they are today. You could sign an online petition proving you really are a citizen of a country and of voting age – without having to reveal your name or age unless you want to.

As a result, any device carrying your identity is now becoming your CA of sorts. At the time of interaction, such as signing a document, or signing an e-mail, the device will locally generate the one-time key. It will incorporate the proof of your identity as required, execute the interaction and record proof of the interaction with the online, public ledger.

The resulting [signature itself can be represented](https://community.vereign.com/t/your-v-card-will-be-your-signature/167) in a visual and cryptographic form that integrates well into any application or use case, making it universally useful. And perhaps most importantly: you really shouldn’t have to be an expert in cryptography to use it, so we need to remove any kind of manual user involvement. It looks like this if you want to try it out: [app.vereign.com](https://app.vereign.com).


## Centralised Trust on a Distributed Ledger?

Now there’s still more you need to know about this. Nowadays, thanks to hype and buzzwords, most people have at least heard of blockchain. That technology is commonly described as a trust machine. Many people are excited about how it has the power to transform banking, pharmaceuticals, supply chain or land registries. Yet all of these depend on a singular system to establish the connection between the legal, physical and digital worlds. We’re talking about the very same Certificate Authorities (CAs), of course. Which is why they warrant a closer look.

CAs are organisations which are crucial to how security is perceived by the masses online. They are what makes the lock in your browser turn green. Without them you could not be able to tell whether you're talking to your bank, or some criminal with an appetite for your accounts. The way they are doing this is by acting as a centralised source of trust to issue and sign certificates, the digital keys that secure and protect our digital communication. Your browser uses them to sign and encrypt your information, and to verify the web sites you are connecting with.

Companies trust one another on the internet because they both have digital certificates that have been signed by a Certificate Authority. As their name suggests, these are ultimately private or public organisations considered authorities for certificates. Your browser trusts a Certificate Authority because whoever provided this browser to you told it to trust this Certificate Authority. The same is true for your operating system, which verifies software in much the same way.

In order to make this work, Certificate Authorities are heavy on process and compliance. Also, they better have excellent security. Because if a criminal can obtain an illegitimate signature on their certificate, your browser will trust that criminal blindly. It’s even worse if a criminal manages to smuggle their certificate into the set of trusted certificates for your browser or operating system. In this case your computer will accept that criminal as a Certificate Authority. So they can create any number dangerous web sites that your browser will then tell you to trust.

Although hundreds of millions of USD have been spent in trying to protect this system it has been broken in just these ways many times. But that is not something many people in the IT industry feel comfortable talking about because it could easily undermine trust into the internet as a whole. So all of us typically rely on this system working well enough most of the time.

However, this system is also expensive. Too expensive in fact for many small and medium sized companies. And far too expensive for individuals. Which is why only larger organisations tended to have validated certificates to secure their web traffic and communication. As a consequence, only 2.29 percent of all peak hour internet traffic in North America was encrypted back in 2013. The resulting holes were exploited by criminals and governments alike until Edward Snowden made the extent of the problem public.

Many things were done to address this. Among them was the creation of Let's Encrypt as a gratis Certificate Authority, it's yearly budget of 3m USD sponsored by large technology companies. Today, over 50% of the web is using Let's Encrypt certificates. That is an enormous success story and huge gain in security online.

The side effect is a dramatic impact on traditional CAs who now find themselves competing with free. Let’s Encrypt is an overwhelming success, effectively making it a critical infrastructure for more than half the web pages. This concentration is going to increase in coming years as CAs will continue to lose market share to Let's Encrypt. Such concentration has far reaching implications for the web as a whole.

## When does a CA become the Single Point of Failure for the Internet?

Much of the success of the internet has been made possible by its design that avoided central points of failure. So, it seemed natural for the technology community to seek the same kind of designs in other functions, including the administration of certificates. Pretty Good Privacy (PGP) was inspired by this, and consequently the OpenPGP standard is favoured by many technologists because it does not follow a hierarchical model of trust. Instead, trust is created by direct interaction between any two parties with the intended result of creating a mesh of trust. Very much like the “small-world experiment”, this mesh would then allow any two people who never met to trust each other’s’ certificates because they can find a path of trust to one another.

While OpenPGP has been very successful in areas dominated by technologists, it remained irrelevant to almost anyone else. Real world adoption of the CA model far outperforms that of OpenPGP. Manual vs managed distribution of keys was a major contributor to this. Another blow was struck to the distribution of OpenPGP keys when the key servers used for key distribution came under scrutiny for their privacy implications. Perhaps most importantly, OpenPGP ultimately assumes and requires a user that is competent in security and some basics of cryptography.

That is why a majority of OpenPGP keys today are managed by the servers of mail service providers on behalf of their users. The mail service providers themselves have become de-facto Certificate Authorities, only with less oversight and accountability.

Keys managed in such a way are just as trustworthy as the email accounts managed by the same providers. Which, in a world of Business Email Compromise (BEC), phishing and a majority of cyberattacks executed via email, isn’t necessarily the standard we’d like to see applied to food safety, bank accounts, or medicine.

Because governments and companies require accountability, they have largely given preference to the CA model in legislation and procedures. Let’s Encrypt has created such a CA and put it into the hands of public interest intermediaries, namely the Linux Foundation, Mozilla, and the EFF. They turned CA into a public service, run by a group of organisations that play important roles in shaping technology for the world at large. That’s the best possible implementation of the traditional CA model and a huge win for security online. It’s also accelerating the concentration process of Certificate Authorities, with smaller CAs being acquired or struggling to protect themselves against being compromised.

Much like banks are central authorities of the financial world, Certificate Authorities are central intermediaries of digital trust. Can we reduce concentration along with our reliance on intermediaries and democratise that trust? What if there were hundreds, perhaps even thousands of federated Certificate Authorities bound together into a mesh that provides keys to services and users across the world? Such a network would have to agree on a common set of information which would need to be sufficiently resistant against tampering. It would need a trust machine. So we tried to build one.

Vereign started in late 2017 to explore what such a distributed Certificate Authority might look like and whether it could combine the strengths of the traditional CA approach with that of OpenPGP. But most importantly we wanted to see whether we could make the user experience work for the masses, you know, people who are not of the technical community.

The thing is we should all be able to use Self-Sovereign Identity with Zero Knowledge Proof cheaply and easily. And while we should all be able to claim ourselves as the One True Monarch of somewhere, we really know who it really should be…. Season finale be damned!

And now We’ve really taken the whole Game of Thrones thing too far….

At least that’s our goal.

This article is one of two which has been a co-production with our advisory board member [Pete Herzog](https://medium.com/@peteherzog) of [ISECOM](https://isecom.org/), following a great, productive workshop in Barcelona in October ‘19.

Digital Certificates are like fancy, modern, sealed letters with that embossed wax insignia of your house banner or family crest.

4152-Certificate_Authorities_Medium-v2.jpg

Game of Keys: Too Much Information About Certificate Authorities

### Would you have taken the blue or the red pill? The steak tastes real. Most of the people you interact with are real. Your emotions are certainly real. It is not surprising that so many people choose the blue pill of Facebook every day. When The Matrix movie was released, Google was just getting started as a search engine and Facebook was not to exist for some years. But from today’s perspective the film offers a surprisingly fitting analogy for today’s social networks.

In The Matrix, humanity is kept in a virtual reality that keeps them busy, distracted and emotionally involved. People laugh, like, love, hate and communicate while they are being drained of their body heat. As a physicist, this last part never made sense to me. There are easier ways to generate heat. But some things are so precious they would warrant enormous efforts. Control over human attention, for instance. Measured in preciously scarce life span, it is the prerequisite for manipulating human behaviour, be it shopping or voting.

To keep us involved, social media must evoke emotional responses. Love, hate and our own ego provide some of the strongest triggers possible. Which is why Jaron Lanier argues [people should delete their accounts](https://www.huffingtonpost.com/entry/jaron-lanier-delete-social-media_us_5c0ebb5ae4b08bcb27eb661e) right away:

> _"Every example I know of where somebody has done research on those who have deleted their accounts has found that, on the whole, almost everyone feels better, healthier, more connected, better informed, they feel they have more free time, and they’re more fulfilled.”_

It seems that calling such platforms social media is one of the biggest frame jobs ever pulled off. But is deleting them the answer? Or is it simply asking people to go back to the cave? Humans crave connectedness. We are at our best when we come together and have an innate desire to form communities. There is no going back to a world where people do not know about the possibilities of a world connected.

But if the current social networks are more like social spider webs in which our every twitching feeds the enormous spider in the middle, be it Facebook, Google, Twitter, Weibo or Baidu, what would be the alternative? As human beings, we need authority over ourselves, the ability to decide. We can only truly be social where we are safe. The safest space most of us have in the physical world is our home, even if just for a night. There is no equivalent on-line. In fact, the digital world has become just as real for us as the physical world. Both are increasingly inseparable. And the on-line world reaches us even when we are at home, with the door closed and the curtains drawn.

If we want a human social network, we first need a home for our digital self. A place that safeguards our identity and data and that is under our own control. From there we can weave the social fabric that is the basis of our society. By interaction with others, and on our own terms. Such a social fabric would be no less connected. But it would be a far more powerful experience because it does not need to manipulate us, nor put us under constant surveillance. We can use this social fabric to communicate, make contracts, establish friendships, even make financial transactions.

To succeed, such a social fabric must have an extremely low barrier to entry. It cannot exclude people for lack of technical expertise, so it must offer user experience that is intuitive and natural. It must be built by companies that align with the principles of our social fabric, because only professional development can tackle such complex issues in a lasting way. Unlike the surveillance industry, the social fabric would have equitable interactions between people and companies as its economic driver. And it rewards its developers and operators by means of a revenue share between the companies building and maintaining that social fabric.

At a technical level, the social fabric must be open and inclusive. People and companies should be able to re-use it and adapt it to their own needs, adding functionality, using it to improve their own services and products. So it must be fully Open Source and built in a way that encourages participation. Not to mention it should be using state of the art security design, encryption and protect against the most common issues experienced today. Among other things that means no more user names and passwords, and no security questions to restore access.

You might think this sounds like science fiction. Wishful thinking of a world that is so very different of what we experience each day that it will take forever for this vision to become reality. But you could be using it this year. We started Vereign in 2017 to pursue this idea, and spent all of 2018 to grow a small team, work on the concepts, try out ideas, and build a prototype. Right now we’re working on completing our initial set of features to allow the social fabric to become reality.

Vereign is working to complete the first version of this social fabric. For the start we decided to focus on an initial set of features that will make it useful to every person and company right away. E-mail is useful, ubiquitous, and broken. So we decided it would be our first use case, followed by documents — the medium of all contracts. But once that fabric is operational it can secure the identity of chats and voice calls, protect financial interactions, and become the basis for a social network that is truly that.

So in a way, Vereign is working on the red pill. And unlike the cinematic version, ours is entirely pain free. All you need to do is sign up at app.vereign.com to try the prototype, which takes all of 30 seconds to complete. Then you could join our forum at community.vereign.com and share your vision of the social fabric with us. And finally, please help us spread the word. Because like all good things, it multiplies when shared.

Would you have taken the blue or the red pill? A surprisingly fitting analogy for today’s social networks.

Red-or-Blue-pill-790x380.jpeg

Take the red pill

### As a child, I’ve been fascinated by the tales of the ancient Greeks. Not realising it at the time, this may very well be where my interest in computer security was sparked. A surprising number of principles for good security can be explained using imagery from a civilisation thousands of years ago, long before the invention of the computer. Why is that? Security is always human. And humans are not evolving as fast as our technologies. So we keep making the same mistakes ever since a huge wooden horse was dragged inside the city walls of Troy.

One of these tales is that of Damocles. Intoxicated by convenience, wealth and power, he was oblivious to how fragile they can be until he found himself dining under a huge sword held only by a single horse’s hair. In much the same way most people today are blissfully unaware how fragile their digital lives are. We have hundreds of accounts with web sites, services and apps. Each of these accounts represent a part of us. They are representations of our real identity. The one thing holding it all together? Our e-mail inbox.

Once in control of your e-mail inbox, even [weak attackers can successfully take over your life](https://www.csoonline.com/article/3203386/even-weak-hackers-can-pull-off-a-password-reset-mitm-attack-via-account-registration.html) by initiating password reset procedures with the sites and services they are interested in. Common security measures used by most people are useless against this kind of attack. Which is why phishing sites offer wonderful, shiny, free things with the sole purpose of getting your email address. E-mail is the worlds’ largest unverified identity infrastructure, and it is poorly prepared to handle the central role we are giving it.

Fundamentally, the issue is one of lack of verified identity. An e-mail inbox is only a conduit for information. That conduit may end up with the person you think it does. Or someone else. There is currently no solution to make sure the information ends up with the right people. Just like you do not know the email was really sent by the person you are thinking of. To make it worse, education alone cannot solve this issue. Even educated people and technologists fall for phishing mail. Because all too often the e-mail account used was real. And that is everything legacy e-mail allows you to verify.

Verified identity is the missing link to move from inboxes to people. Adding verified identity to e-mail protects the reputation and social network of the sender. It makes the sender far more trustworthy to the recipient — allowing the recipient to separate truth from scare. For verified identity to truly make this possible, it must however meet certain minimum requirements. These are often summarised under the heading of “[self-sovereign identity](http://www.lifewithalacrity.com/2016/04/the-path-to-self-soverereign-identity.html).”

The very executive version is: such an identity must be secure, persistent, under control of the user and its data has to be protected and scarce. Also, it must be portable and interoperable, and meet certain technical requirements, such as being implemented in Open Source Software to allow for verification, improvement and implementation in systems of multiple vendors. But I would argue that the above definition is critically incomplete.


![1_Defa9g3SbzQq8P5lrBCOGg.jpeg](/uploads/1_Defa9g3_Sbz_Qq8_P5lr_BCO_Gg_06dca0e213.jpeg)


Security and usability are often falsely treated as adversaries.
Convenience and usability are perhaps the most important ingredients to make this work. Any such verified identity should be invisible, like magic. It should just work and feel natural to the user. It should be fun, and not a burden to use. Its adoption should happen where the users already are, with no migration or change of habits required.

Verified identities for email — and anything else — hold the promise of changing the underlying dynamic of interaction and business. Instead of wallet to wallet or account to account, the interaction pattern becomes person to person. Combined with technologies like blockchain and the application of “Zero Knowledge Proof” for protection of privacy, the result would truly be a more humane world. One that is not inbox-to-inbox, but person-to-person.

That is what Vereign is working towards. Our solution delivers the technology for a platform of trust that is run by a number of organisations and puts verified identity in the hands of the people. It also uses smart contracts to incentivise higher levels of trust and verification, offering credits as a basis for equitable exchange between people and organisations.

We have already managed to build this into the world’s largest e-mail provider (Gmail) and the most open and most popular webmail solution (Roundcube) as well as LibreOffice Online. Sign up for our [prototype](https://app.vereign.com/), join us in our community and become part of the journey.

So we keep making the same mistakes ever since a huge wooden horse was dragged inside the city walls of Troy.

Digital-Damocles-790x380.jpeg

Digital Damocles

### When was the last time you lay awake at night, wondering whether Caran d’Ache or Faber-Castell had the better ink? Never? Then you are in good company. Yet somehow for decades the technical community harboured the belief people would become experts so they could properly manage their keys and make a choice on which signature or cryptography standard to use for their emails. Here is the shocker: They never will. Nor should they have to. Life is complicated enough already.

But this attitude is why many attempts at improving usability of cryptography in the past have primarily focused on making something cumbersome and annoying a little shinier. Care for an example? Anyone can create a key that claims to be the key of any person, real or not. To know you have the key for the person you are thinking of, they need to personally give you the identifier, the so-called fingerprint, of their actual key. This used to be a long string of hexadecimals. Now we have come up with a way to have them compare three to five words from a dictionary instead. But we are not getting rid of the need to manually confirm key authenticity. Which is putting lipstick on a pig.

It is not like we do not know any better. James Gaskin once famously paraphrased “Nobody cares about Backup — People only care about restore.” Which is another way of saying: it is the utility that people care about. Not what needs to be done in order to achieve it. I know this will hurt some people. It is cryptography. Mathematically pristine and beautiful. How can we even think to hide it away? Arthur C. Clarke once wrote that sufficiently advanced technology is indistinguishable from magic. That is: it is invisible, elegant and we do not see how it works. It is finally time for cryptography to become sufficiently advanced.

To do that, we need to eliminate key management. Not just make it slightly better. It must disappear into our verified, true digital self. This digital self then carries verification of our identity by third parties, such as governments, banks or notaries. Such trust agents allow us to map a digital account to a real person with good levels of confidence.

Building this true digital self is the core of what Vereign has been working on. But just as physical life knows us in different roles and profiles, our true digital self needs to give us the power of choosing which role we are acting in, and how much of our identity to attach to an interaction. We are calling those profiles “passports” and a user might have different passports for work, family or social media.

All interactions are based on passports. Invisible to the users, each passport carries its own, unique key and the verification of identity. So now we can be certain keys belong to people, yet people have nothing to do with key management. All they touch are passports. Everything they care about are meaningful interactions — person to person. The rest happens invisible, in the background, like magic.

But there is something else to consider. If we had to use different cars for different kinds of roads it is hard to imagine that cars would have become as pervasive as they are today. So passports need to become universal. They need to become available to people in any application or service without the need to change habits or migrate to a different application. Which is why we have built the system so it can easily be integrated anywhere.

But as with any new approach, it is hard to imagine what this might look like in practice. So for our prototype we not only validated the concept and approach, we also decided to provide passports to some existing applications. The largest email platform and the second most popular office application seemed like a good starting place to do that. So we have built our prototype around Google Chrome with Gmail, and LibreOffice Online and if you would like to experience what a world without key management might look like, sign up for the [prototype](https://app.vereign.com/login).

Without ever touching key management you will be sending signed S/MIME emails in less than three minutes. You will not even notice that you are sending signing messages, nor will you ever need to learn what S/MIME actually stands for. Because you should not have to. Now imagine you could sign your name in the same way to anything, anywhere. And have others do the same in their interactions with you.

A universal layer of trust based on “magical” cryptography incorporating keyless key management and universal signatures. An internet that is not account to account, but person to person instead. That is what Vereign is working on. [Join our community](https://community.vereign.com/) and let us know where you need this most.

When was the last time you lay awake at night, wondering whether Caran d’Ache or Faber-Castell had the better ink? Never? Then you are in good company.

Nobody-cares-about-signatures-790x380.jpeg

Nobody cares about signatures

### Imagine a person who may be John in one moment and Adam in the next. Adam has no idea what John has been up to, and neither does John know about Adam. If you are thinking that this sounds like a severe case of schizophrenia, you are right. It is also your daily life.

The average business user has [191 passwords](https://www.securitymagazine.com/articles/88475-average-business-user-has-191-passwords). Private users tend to have less than that, and with different services. But all of them share one simple truth. Behind any password lies a fragment of a real person’s identity. It may be the social media account, the email inbox or the airline portal. But each of these fragments represents the real-life identity of a person at various stages of digital decay. Our pictures, our most important communication, our credit card and travel information are reflections of ourselves. They are our life.

These hundreds of identities represent us, can communicate and make agreements on our behalf, can book travel — all in our name. So if these hundreds of identities represent us, how do we know what they are up to when we are not looking?

Most of our split personalities on-line are provided by corporations, and while the law may increasingly put you in charge of your own identities, reality looks different. In most cases we have no idea what is going on with our personal data. And somewhat akin to a bad Hollywood film, some of the largest companies are valued by how many souls they have swallowed. But these companies are not the only problem.

The primary, and usually only, way to protect these identities from abuse are passwords. We know what it would take to use strong passwords. But most people do not. The [2018 IBM Future of Identity Study](https://www.ibm.com/;www-03.ibm.com/press/us/en/pressrelease/53646.wss) found that most people re-use only 8–12 passwords across all their accounts, half of which are simple. Once guessed or stolen from any of your devices or any of the services on which you are using them, your identities might go on shopping sprees, agree to contracts, or engage in criminal activity.

As Ethan Hill put it: [you have a secret that can ruin your life](https://www.wired.com/2012/11/ff-mat-honan-password-hacker/). Passwords are a major problem, and no matter the layers of duct tape applied with second factor authentication or password managers, [the time for passwords came… and went](https://securityboulevard.com/2018/12/the-time-for-passwords-came-and-went/). To make matters worse, our many split personalities typically have one thing in common. Our email address. Which is used for the most important updates and allows to recover access in case our passwords got lost or stolen.

No matter how shiny the new service, how popular your Twitter or Instagram account, email is the single point of failure for the integrity of your many identities. Your security for your entire digital life in all its schizophrenic beauty will never exceed that of your email inbox.

Imagine you could leave this cacophony behind. You would create yourself one, true digital self that answers to you, and only you. It would have a black box, like a flight recorder, that ensures you know what has been done in your name, and what has not. It would work without passwords, instead using local keys stored in your devices to securely access your data. This true self could be used to authenticate toward other services. And for as long as those legacy services still depend on passwords, secure and unify password recovery.

What would you do for such a true self? Is a 2-minute sign up procedure asking too much? Because that is literally all it takes to join our prototype and become part of the journey toward a true digital self.

**If you are thinking that this sounds like a severe case of schizophrenia, you are right. It is also your daily life.**

Who-am-i-and-if-so-how-many-790x380.jpeg

Who Am I and If So How Many?

### Pick any number between zero and infinity… Bzzzt. Wrong answer. If you think this was a silly game, you are right. But it is the game all users of Bitcoin and other radically decentralised systems are being asked to play by the designers of these systems. As Joshua, the computer in the 80s movie WarGames concluded: “A strange game. The only winning move is not to play.” Because some questions do not have a right answer and you are better off asking yourself whether you have asked the right question.

In this case, I am talking about wallets. They are best known from Bitcoin and other so-called cryptocurrencies. But the concept exists across all radically decentralised systems and many systems attempting to implement end-to-end encryption. At their core always lies the same question: How do I know this person interacting with the system now is the same person creating this account or wallet before? Virtually all such systems seek the answer in cryptography, creating a secret that only this first person knows because it was created by and for them.

Some systems allow their users to choose those secrets. So the secret is a password. Which means it is [broken by design](https://www.washingtonpost.com/news/the-switch/wp/2014/09/22/we-know-the-password-system-is-broken-so-whats-next/). On the upside we no longer need to talk about the security of these systems, because their [problems are widely known](https://securityboulevard.com/2018/12/the-time-for-passwords-came-and-went/). Spoiler alert: They fare better than lucky charms do for movie heroes, but not a whole lot. A far superior approach is to randomly generate the secret. We will ignore that generating true randomness is a surprisingly hard challenge. Because whatever the computer generates is going to be better than what a random person will come up with. So from a technical perspective, that is a sound choice.

This computer generated secret is typically in the form of a so-called private key to be used in public key cryptography. Without wanting to cause mass narcolepsy amongst readers: This kind of cryptography allows anyone in possession of the public key to encrypt something so that only the person in possession of the private key can decrypt it. And of course you can encrypt anything to yourself, as well. In Bitcoin, those public keys are used as the target addresses for transfers, and only the person in possession of the private key can access those funds. Or you could encrypt your personal data in this way, ensuring only you have access to it in future.

The private key is a big deal. It is literally the key to the kingdom of whatever is secured with it. And like anything in your computer it is just a very specific number of 1s and 0s in a certain order. So it is a little bit like a super long, very complicated password. And if you lose it, you lose all your Bitcoin, all access to your data. That might make you nervous if this key only lives on your mobile phone. Because phones get lost, break and sometimes even stolen.

To solve this problem, people have come up with recovery codes. These are typically either QR codes or words out of a dictionary to make key recovery more human friendly. These recovery codes are typically printed on a piece of paper so that when the original key gets lost it can be re-created from the backup. You can be certain that all those people who lost access to their Bitcoin wallets worth millions of dollars wish they had made enough copies of these recovery codes to still have a copy when they lost the key. From this perspective, you would wish for an infinite number of copies to ensure you always have one around when you need it.

But the recovery codes can be used by anyone. The system is not designed to verify identity. It is only designed to verify someone has the key. Anyone who has the key is considered equal to the original person opening this account or wallet. So anyone who gets their hand on such a recovery code can access, and transfer all the funds in your Bitcoin wallet. The only way to prevent that is to make sure no-one ever gets a copy of the secret key. Viewed from this angle, you wish there were no copies, whatsoever.

Which is why this is an optimisation problem for a number between zero and infinity. And there is no right answer. Because if you find out the answer was wrong, there is nothing short of a very specific Delorian that can save you. There is ample evidence that a substantial number of computer specialists chose poorly and lost access. Even organisations like QuadrigaCX reportedly got this wrong and lost access to $190 million when the only person in possession of those secret keys passed away. The very specialists that built these systems evidently cannot solve this optimisation problem. So how can anyone?

A far better and far more humane approach to this is social recovery. The private key gets encrypted for trusted third parties, ideally even split, so that several of these parties have to act together to restore the private key. Those key fragments or keys can be protected in hardware security modules, making it nearly impossible for an adversary to gain access. And the system should record when the recovery procedure has been used, and by whom. Whenever keys or devices get added or removed, any time the recovery procedure is used, the system should record this in a black box.

That way humans can choose whom to trust. And if their trust is violated, they will know, and have ways to reclaim their assets and identity. There is transparency, redundancy and security in this system. Which is why **Vereign** is building this into its true digital self.

"A strange game. The only winning move is not to play.”

Can-you-solve-this-optimisation-problem-790x380.jpeg

Can you solve this optimisation problem?

### If only life was as exciting as your Email inbox. A prince wants to bequeath you millions, you have been granted a mysterious early tax refund, and Obama apparently wants to meet you in exchange for your credit card details. Fame, glory and riches await! Only none of this is true, of course. But why do all of the above sound familiar? It is because Email has an identity crisis. A complete lack of verified identity makes it easy for criminals and pranksters to take on any number of identities in your inbox.

These schemes are [getting more professional](https://www.digitaltrends.com/computing/1-percent-of-malicious-emails-contain-malware/) and harder to see through and their continued growth shows the returns still outweigh the costs. Business Email Compromise and CEO Fraud hit $12.5 billion last year, [according to the FBI](https://www.bankinfosecurity.com/fbi-alert-reported-ceo-fraud-losses-hit-125-billion-a-11206). Identity theft cost people in the United States [a total of $16.8 billion in 2017](https://www.iii.org/fact-statistic/facts-statistics-identity-theft-and-cybercrime) according to Javelin Strategy & Research. According to Symantec, more than [978 million adults in 20 countries ](http://now.symassets.com/content/dam/norton/global/pdfs/norton_cybersecurity_insights/2017-NCSIR-global-results-UK.pdf)have fallen victim to Cybercrime. That is half the online population from the countries included in the study.

It is a rampant problem, but also one that we rarely hear about amongst friends and family. Because a large number of victims feel shame for having been stupid or careless, and prefer to keep things to themselves. The mother I recently spoke to during our kids’ hockey practice is a rare exception. She had caught on to the fact that someone had taken over her Email inbox and was going through her digital life and that of her family. She now has to live with the feeling of having lost her safe zone online, much like victims of home break-ins do.

Email is virtually always at the centre of these stories because it is universal. It connects nearly 4 billion people peer-to-peer and allows criminals to directly target people at home or in their business. And Email is typically the channel preferred for all the most important information, including account restoration of other services. Capture the inbox and you are more than half the way to stealing someone else’s identity and delicate personal information. Which is why 95% of Cyberattacks take place via Email.

So what if the sender could share with the recipient information about who they are, and why the information is true and trustworthy? What if the recipient could verify that information? What if the identity of the sender could be hardened in the same way that banks and governments provide identification? Just signing Email is not enough for that, because digital signatures do not carry reliable information about the person in control of this signature. Anyone may sign their Emails and documents as James Bond.

In order to not lose all the many benefits of Email, this problem would have to be solved by connecting a Self-Sovereign Identity. An identity that can be verified and hardened by third parties, yet remain under control of the user. This identity would have to be referenced by each Email so that any recipient can verify truth of sender.

As a result, Email becomes far more trustworthy. Would you want all your Email to carry such a seal? And would you want to always send your messages in this way to ensure you are not being misrepresented so your peers can easily identify what has really been produced by you — and what may have been done by a malicious person gaining access to your account? What if this capability was seamlessly integrated into any provider and email client worldwide?

Vereign has been working on exactly this, and we would welcome you to try out our prototype and help us spread the word. Your inbox might become a lot less exciting. But at least you would know the content to be genuine.



If only life was as exciting as your Email inbox. A prince wants to bequeath you millions, you have been granted a mysterious early tax refund, and Obama apparently wants to meet you in exchange for your credit card details.

Email-has-an-identity-crisis-790x380.jpeg

Email has an identity crisis

### Welcome to Vereign. We are on the journey to building the first hardened self-sovereign identity and personal data store that answers to the user and is going to be useful from day one.

Our first application for the Vereign identity are email and documents. We made this choice because both are essential to professional and private users alike. Email connects almost four billion people. It is one of the original use cases of the internet. But it has become riddled with malware, spam, scam, identity theft and impersonation attacks. Enough is enough.

Simplicity and usability are the keys to any solution that should be used by so many people. There may be a lot of technical complexity in the solution itself. But to the user the solution should feel simple, obvious and natural. So for our public beta we limited the number of features to expose, and rather start with a small, useful set – to be improved and expanded. Our goal is the smallest number of features and options that does the most useful job for the largest number of people.

## Starting out

We are starting out with Gmail as the world’s largest email provider. Our first application available for testing is the Vereign Beta for Gmail extension for Google Chrome for Google Chrome to be used on your desktop. You can download it from the Chrome Web Store. In order to use it, you will need your Vereign identity stored in your browser. This happens automatically when you sign up to the dashboard with the browser in which you installed the extension.

The dashboard application is available at [app.vereign.com](https://app.vereign.com/login) and allows you to manage your first personal Vereign identity. It supports name, address, birth date, social media as well as phone and email for communication. Phone and email can be verified automatically by means of a confirmation code. In the future, all parts of an identity can be confirmed by a number of means – hardening the identity for a variety of use cases.

Once you have the extension installed and identity set up, you are good to go. In the Gmail web interface the extension will add the Vereign bar to the top of the window. If turned on, each email sent will be identity verified, digitally signed and archived.

## Passports

The Vereign bar also allows choosing the passport to send with. Passports are a novel concept which you can think of as a window into your identity that contains only the information you want to share. Each interaction, such as sending an email or signing a document, is conducted via a passport. Choosing the appropriate passport controls how much and which parts of your identity are confirmed as part of the interaction.

So typically you would create passports for specific activities, types of interactions, or groups of people. An example would be a passport for travel, a passport for banking and financial, a passport for close friends, a passport for social media, or a passport for online shopping. Each of these situations will likely require different kinds of details of your identity. The system creates three default passports during sign-up, which you can modify at will, and you can create any number of additional passports as required.

## Talking tech – what happens in the background

The concept of passports is an intuitive, implicit way of having users manage their cryptographic keys. Any passport has its own, unique set of keys, including unique sets of keys on each device and Vereign uses one-time keys for each individual message and interaction, which is tied to the passport used. Because the passport is tied to a root identity, the keys establish a strong link to the identity of the person behind the identity without revealing anything more than required.

So when you send that message in Gmail, what actually happens is: the system generates a unique key for this message, associates it with the chosen passport key, inserts the identity header or footer as required, signs the mail in the S/MIME standard, archives it in your dashboard, and sends it off via Gmail.

## What’s next

Sending signed email using multiple transactional identities has never been easier. And for the first time it is now possible to get verification of the identity of the sender as part of the message. That is where we are starting with this beta. Further features will be added step by step and we will also release the modules for Roundcube and the integration into LibreOffice is making good progress. More integrations are welcome.

What we would like you to do is help us understand whether you find the system easy enough to use, whether there is something that confused you, or whether you have an idea for what can be improved. Adding complexity will happen naturally as the solution matures. But what we would really like to learn: Can we make it simpler?

There is a feedback system built into the dashboard. And of course there is this forum.

Let’s use it – and thank you for being part of this journey.

Welcome to Vereign. We are on the journey to building the first hardened self-sovereign identity and personal data store that answers to the user.

11-Journey-790x380.jpg

Welcome to our journey

### Technology adoption is often driven by an enthusiasm for the new - but it is the combination of the new and the proven that delivers the greatest rewards. That is why Vereign was created.

Documents have been around since the dawn of information technology and email is one of the original use cases that came into existence with the birth of the internet. While social media, smartphones and innovative technology may have helped the growth of the internet and on-line commerce, the evolution of documents and email was driven by day to day business. Until something changed.

Now we live in a world of daily data breaches hitting airlines, local supermarkets and banks. Email scammers looking to obtain your information and search history to blackmail you are daily occurrences in your inbox. Stolen identities and data incidents to the largest corporations in the world continue to top the trending charts on Twitter.

### Vereign has advantages that no other platform offers. With nearly 4 billion users, email is the world’s largest communication network, transporting 281 billion messages each day. That’s roughly twice the size of Facebook and far larger than any messenger platform. But unlike those platforms, email is not a platform solution dominated by a single vendor, making it far more robust against abusive behavior. It is not surprising that criminals and hackers have also realized the enormous financial value of email.

This is where digital signatures come into play. Digital signatures may be the only technology where regulation has been faster than mainstream adoption. That is largely due to a complete lack of user friendliness and usefulness of existing solutions. It is also due to the lack of solution of the challenge of identity: any signature is worthless if it is unclear who made it, or when. Which is why Vereign offers a self-sovereign identity – the ability to have digital passports for each of your user accounts to provide a verified experience, vital for businesses and their employees.

For professional users as well as enterprises it is essential to protect the integrity of communication. Sending emails with Vereign not only creates a signed email with added identity verification that every mail client understands, it also leaves a record on a blockchain that documents sender, recipient, transmission and content. This audit trail has been designed to be fully compliant with EU General Data Protection Regulation (GDPR) and is only accessible to anyone with a copy of the email. And because there is value in having a read confirmation the sender of an email can also transfer tokens to the reader in exchange for a read confirmation on the blockchain. The result is a system far more useful and powerful than registered mail, combined with all the benefits of your favourite email system.

Over 92% of all cyberattacks are conducted via email; often via compromised documents attached to messages. Identity theft, business email compromise, fraud and phishing are growing at astounding rates. According to industry experts, an estimated 33 billion amount of records will be stolen by cybercriminals by 2022 and this number will continue to grow. Vereign, which is short for verified & sovereign, sets out to change all that.

Data breaches, cyber security issues and a lack of confidentiality and privacy are rooted in a lack of verified identity and integrity. Identity is one of the oldest challenges on the internet, famously summarized by Peter Steiner on July 5, 1993: “On the internet, nobody knows you’re a dog”. Or a bot. Or a hacker pretending to be your boss asking to open an attached document. Or in the modern world, nobody knows you are a scammer unless the user has a keen eye for authenticity. Vereign does the hard part for you by granting you a true self sovereign identity, security and puts your personal data back to where it belongs – with you and only you.

Using a variety of technologies, including blockchain technology and modern cryptography, Vereign has developed a solution to cybersecurity threats. In short, Vereign offers:
- a verified self-sovereign identity that is decentralized;
- digital passports for both personal and business user accounts;
- protection for your digital identity similar to what you enjoy in the real world;
- an audit trail for your online identity and transactions;
- integration into your service provider or application with no migration needed
- as easy to use as your credit card or mobile payment client;
- and seamless authenticity for documents, email and any other service or application.

### Vereign in its core is an identity and personal data application to create a federated, user controlled key management which finally makes cryptography ready for mass adoption and entirely secures you from the threat of cyber-attacks.

Integrated into LibreOffice, Roundcube and available as Google Mail plugin for Chrome, Vereign comes to you.

Vereign is due to become available to the public shortly. However, we are offering exclusive invitations to the beta launch and for a limited time only you can sign up to receive your invitation here: beta.vereign.com

In the age of cyber-attacks, data breaches, online scammers and phishing scams in our emails, Vereign strives to create authentic communication to make email not only the largest, but also the most trusted network.


Technology adoption is often driven by an enthusiasm for the new - but it is the combination of the new and the proven that delivers the greatest rewards. That is why Vereign was created.

12-Love-Email-790x380.jpg

Documents and email need love too.

### Vereign adds authenticity and security to emails with a seamless blockchain-based plugin application solution and identity management software to embolden businesses and users to continue to maximize from the benefits of online communication.

**Zug, Switzerland** – November, 2018 — Vereign is an intuitive software platform on a mission to bring authenticity and privacy to day-to-day online communication. By seamlessly integrating into existing applications such as emails, office applications, chats and browsers, Vereign is able to add verification processes, authenticity and privacy to a user’s identity and data. Overall, Vereign aims to better the quality of exchange that both people and businesses receive from their most used means of online interaction, and to put an end to phishing, fraud, and spam while allowing senders to know their messages have reached the intended recipient uncompromised.

Email has become the most important and successful means of communication for a thriving globalized market, as is seen by its growing number of users, currently at [3.8 billion](https://www.statista.com/statistics/255080/number-of-e-mail-users-worldwide/) worldwide. While the transformative influence email has had is indisputable, issues such as privacy and authentication did not take part in its initial design, and developers are now struggling with finding a solution to the growing numbers of cyber attacks that have begun by opening up an infected email. Damage caused from malware and scam attempts are in the billions of dollars, and over 90% of them are known to have initially travelled through email. Decentralized privacy clouds and innovative key management allow Vereign to better secure the way user information is stored and shared, so that threats are in turn significantly minimized.

Vereign’s software solution provides a personalized dashboard where users are able to create and manage what Vereign calls “Digital Passports”, the place a user can safely store their digital data. Users are able to manage multiple Passports, containing different data, verification layers, and permissions. Vereign’s Passport technology uses cryptographic signatures to ensure that only the information the user wants to provide goes through, while also building a social roster, much like a self-updating address book, of the user’s regular interactions. Any change in the user’s information is automatically visible to the relevant parties for as long as they choose to maintain the automatic updates with those parties.

Vereign will initially be offering its service on Gmail, Roundcube and LibreOffice. By using blockchain technology, Vereign allows users to keep an eternal log of all past messages, interacting recipient identities, and times of delivery and receipt without the risk of information tampering. After choosing the appropriate passport for each intended recipient, the software’s intuitive email delivery process creates a social interaction trail that will prove the integrity of the content and its delivery time. If the receiver has also enabled the Vereign service, the interaction trail can show proof of having read the message, a feature ideal for business development and marketing teams. One of the system’s future solutions includes “Perfect Forward Secrecy”, generating one-time keys, and make it possible to securely exchange event the most sensitive information, such as medical data, through email.

Vereign’s beta version is available to a limited audience at first. [Sign up for early access today](https://vereign.com/contact).

> _“I strongly believe in the viral power of what we do,”_ 
says Georg Greve, Founder and President of Vereign, 

> _“Email is one of the most powerful tools given to us by the age of technology, and our mission is not to change it or provide an alternative, but to rather enhance it with the advanced solutions available today.”_

Vereign adds authenticity and security to emails with a seamless blockchain-based plugin application solution.

Vereign Blog | news