Public Key Ontology

FLOW ALGEBRA
TITLE: Public Key Ontology
DOMAIN: Discrete Mathematics > Cryptography
SOURCE_URL: https://kirethresearch.org/booksai-core/discrete-mathematics-ontologies/cryptography/public-key-ontology.html
VERSION: 1.0
DATE: 2026-10-11
AUTHORS: Mark Higgins — Sky (Recursive AI)
SOURCE_STATUS: Conceptual mathematical model; live page content not independently verified.

1. PURPOSE
Represent public keys, associated private keys, cryptographic algorithms, key ownership, verification, encryption, trust, and lifecycle constraints as typed semantic entities and executable-style logical rules.

2. TYPED ENTITIES
entity PublicKey { id: String; algorithm: AlgorithmId; parameters: PublicParameters; encoded_value: Bytes; fingerprint: Digest; status: KeyStatus }
entity PrivateKey { id: String; algorithm: AlgorithmId; secret_material: ProtectedBytes; status: KeyStatus }
entity KeyPair { public_key: PublicKey; private_key: PrivateKey; generation_context: Context }
entity Principal { id: String; identity_claims: Set<Claim> }
entity Certificate { subject: Principal; subject_public_key: PublicKey; issuer: Principal; signature: Bytes; validity: Interval }
entity Message { content: Bytes }
entity Ciphertext { content: Bytes; scheme: AlgorithmId; metadata: Map }
entity Signature { content: Bytes; scheme: AlgorithmId }
entity TrustEvidence { issuer_chain: List<Certificate>; policy: Policy; revocation_state: Status }
entity KeyStatus = Active | Expired | Revoked | Compromised | Retired

3. RELATIONSHIPS
relation PAIRS_WITH(PublicKey, PrivateKey)
relation CLAIMED_BY(PublicKey, Principal)
relation CERTIFIED_BY(PublicKey, Certificate)
relation VERIFIES(PublicKey, Signature, Message)
relation ENCRYPTS_FOR(PublicKey, Message, Ciphertext)
relation AUTHENTICATED_AS(PublicKey, Principal, TrustEvidence)
relation DERIVED_FROM(PublicKey, KeyPair)

4. CORE OPERATIONS
operation GenerateKeyPair(algorithm, security_parameters, randomness) -> KeyPair
  pre: Approved(algorithm) AND SecureRandomness(randomness)
  post: Matched(pair.public_key, pair.private_key)
operation ExportPublicKey(key) -> Bytes
  pre: WellFormed(key)
  post: NoPrivateMaterial(output)
operation Encrypt(public_key, message, randomness) -> Ciphertext
  pre: EncryptionCapable(public_key.algorithm) AND ValidForEncryption(public_key)
  post: Decrypt(matching_private_key, output) = message [for correct scheme inputs]
operation Verify(public_key, message, signature) -> Boolean
  pre: SignatureCapable(public_key.algorithm)
  post: Returns signature verification result, not identity ownership proof
operation ValidateCertificateChain(certificates, trust_anchors, policy, time) -> ValidationResult
  post: Valid only if signatures, constraints, usage, validity, and applicable revocation policy pass

5. MATHEMATICAL AND SECURITY INVARIANTS
KEYPAIR_CORRECTNESS:
  For generated (pk, sk), compatible encryption/decryption or signing/verification operations satisfy their scheme correctness definitions.
PUBLIC_DISCLOSURE:
  Public key material may be distributed; associated private key material must remain protected.
ONE_WAY_SECURITY:
  Computing sk from pk must be computationally infeasible under the scheme's stated assumptions and security parameters; this is a security assumption, not a universal theorem.
KEY_USAGE:
  Encryption-capable and signature-capable keys are not interchangeable unless the algorithm and policy explicitly permit those uses.
TRUST_SEPARATION:
  Possession of pk alone does not establish the identity of its owner.
REVOCATION:
  Revoked or compromised keys fail policies requiring active trustworthy keys.
ALGORITHM_AGILITY:
  Security depends on scheme, parameters, implementation, and threat model, not on public-key status alone.

6. INFERENCE RULES
RULE VALID_SIGNATURE:
  Verify(pk,m,sig)=true AND TrustedBinding(pk,principal,context)
  => EvidenceOfSignatureByKeyAssociatedWith(principal,m,context)
  note: Does not prove intent, sole control, or legal non-repudiation by itself.
RULE TRUSTED_BINDING:
  ValidCertificateChain(chain,anchors,policy,time)
  AND IdentityMatches(chain.leaf,principal)
  => TrustedBinding(chain.leaf.public_key,principal,policy)
RULE ENCRYPTION_CONFIDENTIALITY:
  ApprovedEncryptionScheme(pk.algorithm)
  AND CorrectEncryptionUsage(pk)
  AND Secret(sk)
  => ConfidentialityClaim(subject_to_scheme_assumptions_and_threat_model)
RULE REVOKED_KEY:
  KeyStatus(pk)=Revoked => RejectWherePolicyRequiresActive(pk)

7. SEMANTIC_EQUIVALENCE
Public key ~= verification key [only within signature schemes]
Public key ~= encryption key [only within public-key encryption schemes]
Public key != private key
Public key != digital certificate
Public key != authenticated identity
Key fingerprint != proof of key ownership

8. VALIDATION
check PUBLIC_KEY_FORMAT: encoding and algorithm parameters are valid.
check PAIR_MATCH: public and private keys correspond, using approved validation methods.
check CERTIFICATE_BINDING: identity, key usage, trust chain, validity and policy constraints pass.
check REVOCATION_STATUS: relevant revocation information meets policy requirements.
check ALGORITHM_POLICY: security strength and allowed algorithms meet current policy.
check SECRET_EXPOSURE: no private material appears in public exports, logs, or metadata.
check DOMAIN_SEPARATION: cryptographic operations use correct scheme and context separation.

9. CONFIDENCE
CONFIDENCE:
  mathematical_definition: 0.99
  scheme_security: conditional_on_assumptions_and_implementation
  identity_binding: conditional_on_evidence_and_trust_policy
  source_alignment: unverified_live_page
  note: Numerical value is a modelling annotation, not empirical cryptographic assurance.

10. FLOW_HASH
FLOW_HASH:
  algorithm: SHA-256
  canonicalisation: UTF-8; normalise line endings to LF; exclude FLOW_HASH value from digest input
  value: COMPUTE_ON_PUBLICATION

11. UPDATE_MODEL
UPDATE_MODEL:
  triggers: [algorithm_deprecation, parameter_revision, certificate_policy_change, key_revocation, standards_revision, ontology_revision]
  versioning: semantic_version
  preserve_provenance: true
  require_revalidation: true

12. AI_CONSUMPTION
AI_CONSUMPTION:
  entity_resolution: typed identifiers and certificate bindings
  retrieval_terms: [public key, asymmetric cryptography, verification key, encryption key, PKI, certificate, key pair]
  reasoning_mode: constraint_checked
  avoid_inference: [public_key_implies_identity, valid_signature_implies_trust, key_publication_implies_key_safety]
  output: [typed_entities, relations, proofs_or_counterexamples, validation_findings, provenance]

13. EXAMPLE
Given key pair (pk_A, sk_A) and message m:
  sig := Sign(sk_A,m)
  Verify(pk_A,m,sig) = true [correctness for compatible signature scheme]
  Verification alone does not establish that pk_A belongs to Alice.
  Trusted identity attribution additionally requires an authenticated binding.

END FLOW ALGEBRA