Chapter 5 · 1/4
Trust lists
Who says whom to trust? The list of lists, national lists, signatures, versions and freshness.
6 min
In the previous chapter we saw that a credential is protected by a A mark made with the issuer's private key that cannot be changed afterwards.. The signature tells us two things: the document has not changed, and some key signed it. The real question remains open: whose key is it, and is that institution allowed to issue this document?
An employer in Almaty looks at a credential signed by a university in Tashkent. They know the university's name, but not its key. Anyone can create a key and write "Example University" under it. Trust lists close exactly this gap.
What is a trust list?
A A signed, public list naming the institutions, verifiers and wallet providers that can be trusted. is a signed register of who, in a country, may issue credentials, request them and offer wallets. Each entry carries the institution's name, its official registration number, its certificate and the credential types it may issue. The list is public; it is not a secret database.
When a verifier receives a credential, it checks the list: "Does the key behind this signature belong to an institution that is listed as allowed to issue this type?" If yes, the credential can be trusted. No calls, no e-mails, no weeks of waiting.
The list of lists
Every country has its own list, because each country decides which of its institutions are trustworthy. But a verifier cannot get to know dozens of national lists one by one. So there is a layer above them: the The top-level list that says where each national list lives and which key signs it.. It gives the address and the signer of every national list. A verifier pins a single root key; everything else follows from the chain: list of lists → national list → institution certificate → credential.
The European Union has used this model for years: the EU list of lists points to the member states' lists. Tamga Network uses the same format, so the two worlds speak the same language.
Versions, chaining and freshness
When a list changes (an institution joins, or loses its authorisation) a new version is published. Each version carries the A fingerprint of data: change one letter and the digest changes completely. of the previous one, so the versions form a chain. History is never deleted. If someone tried to restore an old list or quietly change a line, the chain would break and everyone would see it.
Lists also carry an expiry date. They are re-signed at least every 90 days even when nothing changes, and changes are published within 24 hours. A public An append-only, public log to which the digests of list and status-list publications are added every hour. is updated every hour as well. If the list a verifier holds is stale, or cannot be reached, the verifier does not say "valid"; it says "cannot decide right now". That is the safe side: a credential that cannot be checked is neither accepted nor counted as rejected.
No personal data on the list
Trust lists contain institutions, not people. Which student received which credential, or who showed a credential where, is never written to the list or the anchor log, not even as a digest. The list answers one question only: who is authorised.
On the next page we look at how the lists of different countries recognise each other. To see the live list now: trust.tamga.network.
Summary
- A signature alone is not enough; you also need a signed list saying the signer really is an authorised institution.
- The list of lists points to national lists; each national list names that country's institutions, verifiers and wallet providers.
- Lists are versioned and chained to the previous one; a stale or altered list is noticed, and verification answers "cannot decide right now".
Go deeper
Technical details and binding rules: