KID Identity Commands

File: commands/identity.rs Crate: kinetic-cli | Stage: 14

What Is a KID Here?

The CLI creates and manages Kinetic Identity Documents — post-quantum DID credentials using ML-DSA-65. These are separate from the node identity (identity.key) — they are user-facing cryptographic identity documents that link a .kin name to a public key.

identity create

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/identity.rs` — Lines 62–~120
}

1. ml_dsa::SigningKey::<MlDsa65>::generate() — generates a post-quantum ML-DSA-65 keypair.
2. Derives the DID string: "did:kin:" + hex(SHA-256(public_key_bytes)).
3. Constructs a KineticDid from the DID string.
4. Builds a KidDocument (the actual DID document with public key embedded).
5. Saves the signing key bytes to <output>.key (default: kid.key) with 0o600 permissions.
6. Saves the DID document as <output>.json (default: kid.json).

Note

This command is fully offline — no daemon required.

identity publish

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/identity.rs` — Lines ~120–~220
}

1. Reads the kid.json file (the DID document).
2. Reads the manifest.json file if it exists (a capability manifest — list of permissions the KID grants).
3. POST /api/kid on the daemon with the KID document and manifest.
4. The daemon stores it and publishes it to the DHT under the name’s zone record.

Required arg: --name saif.kin — the name the KID belongs to.

identity resolve <did>

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/identity.rs` — Lines ~220–~250
}

GET /api/kid/<did> from the daemon. Prints the resolved KidDocument JSON. Falls back to printing an error with the daemon URL if unreachable.

identity revoke

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/identity.rs` — Lines ~250–~330
}

1. Reads the KID file and the signing key.
2. Sets kid.revoked = true and updates the updated_at timestamp.
3. Signs the updated document with the ML-DSA-65 key.
4. Saves the revoked document to <output> (default: revoked_kid.json).
5. POST /api/kid with the revoked document — publishes the revocation to the network.

identity rotate-key

#![allow(unused)]
fn main() {
-> See: `kinetic-cli/src/commands/identity.rs` — Lines ~330–~440
}

1. Reads the existing KID and the old signing key.
2. Generates a new ML-DSA-65 keypair.
3. Updates the KID document to embed the new public key.
4. Signs with the old key (proving authority to rotate).
5. Saves the new private key and the updated KID document.
6. Publishes via POST /api/kid.

Important

Key rotation preserves the DID identifier — the did:kin:<hash> stays the same since it was derived from the original public key. Only the verificationMethod embedded in the document changes.

Quick Reference