Lesson 4 of 15
Core MechanicsΒ·Lesson 4

πŸ”— Trust Chains

How linked, signed statements form an unbreakable chain

Build a Trust Chain β€” Step by Step

A Trust Chain is an ordered sequence of Entity Statements, starting with the subject's Entity Configuration and ending at a Trust Anchor's Entity Configuration.[1] Each intermediate link is a Subordinate Statement that cryptographically vouches for the entity below it.

Step 1 of 6

Step 1 β€” Leaf Entity Configuration

The leaf entity publishes its self-signed Entity Configuration at .well-known/openid-federation.

[0]Leaf Entity Config
iss: login.uni.edu
sub: login.uni.edu
signed with: K_leaf

Self-signed: iss == sub. Contains authority_hints: ["uni.edu"]

How Verification Works

Verification proceeds top-down β€” start from the Trust Anchor whose key you already trust, and work your way down to the leaf.[2]

Step 1 of 5

1. Start at Trust Anchor

Pre-configured K_ta is already trusted. Verify link [3] (TA Entity Config) is self-signed with K_ta.

Sources & References

  1. OpenID Federation 1.0, Section 4 β€” Trust Chain
  2. OpenID Federation 1.0, Section 10.2 β€” Validating a Trust Chain