Agent Identity
One routable address per workload, published in DNS and the public registry, checkable by a stranger with no key.
In this chapter
- The Address as IdentityWhere the name comes from, and why forward and reverse DNS have to agree before anything trusts the bits.
- Create an IdentityMint a routable address for one agent, capture the key it hands back once, and confirm it in public DNS.
- Verify an IdentityAsk one keyless endpoint whether an address really belongs to a Whisper agent, and read the evidence it returns.
- The Proof ChainEvery record and endpoint a stranger can check, what each one asserts, and the command that reads it.
- Verify Without Trusting UsRe-derive the whole answer on your own machine from the DNSSEC root, and read the trust level on each row.
- Revoke an IdentityCut an agent off the network for good, then prove to anyone that the cut happened.
- Nested IdentitiesWhat happens when one agent egresses behind another: how the edge is seen, published and governed.
- Keys, Signing and EncryptionPer-agent cryptographic material, the DNS records that pin it, and what a recipient can check with stock tools.
- RDAP and WHOISWhat the public registry publishes for one allocation, and how to read the same record over either protocol.
- The Transparency LogHow an issuance becomes a leaf, what a checkpoint commits to, and why a shredded entry leaves the proofs intact.
- Bring Your Own DomainDelegate an apex you control and publish the matching DS, then mint agents under a name the world already knows.
- Device IdentitiesA phone or a laptop gets a resolve-only allocation with a credential that refuses every control call.
- Vehicle IdentitiesA deterministic allocation derived from a hardware key plus the VIN, checkable by a stranger and cut in one call.
Agent Identity Documentation
Every agent, host, device and vehicle on Whisper holds one routable IPv6 /128 from 2a04:2a01::/32, announced by AS219419. The address is the identity: the name, the reverse record, the certificate pin and the public registry entry are all derived from it and published together, so a stranger can read the whole answer with stock tools and no account.
Point dig and curl at an address and you get the name it claims and a verdict on whether the two agree:
dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
curl -s "https://rdap.whisper.online/verify-identity?ip=2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478"
Start with the address itself, which is where the name comes from and why the forward and reverse records have to agree. From there, create one and read the verdict on it. The proof chain lists every record behind that verdict, and you can re-derive the lot on your own machine from the DNSSEC root. When an identity has to go, revoking it withdraws the address, the DNS records, the pin and the egress credential in one step.
The rest of the chapter covers what an identity carries and where it is published: the cryptographic material and the records that pin it, the public registry that answers for each allocation, and the transparency log that records every issuance. An agent that egresses behind another gets a nested edge on both. Delegate an apex you already control and the names move under your own brand.
Two shapes sit beside the agent identity. A phone or a laptop takes a resolve-only identity that answers DNS and nothing else. A car or an ECU takes one derived from its hardware key, so the same VIN and the same key always land on the same address.
Once an identity exists, the network chapter governs what it may reach and the control plane is where you mint, read and cut it.