Source-Known Identifiers: A Three-Tier Identity System for Distributed Applications
Distributed applications use identifiers across database storage, trusted communication, and external access. These roles require different combinations of storage efficiency, chronological sortability, origin metadata embedding, zero-lookup verification, metadata confidentiality, and multi-century addressability. The identifier schemes compared in this paper, including Universally Unique Identifier (UUID) versions 4 and 7, do not individually provide all six properties. We present Source-Known Identifiers, a three-tier identity system that distributes these properties across representations of one entity identity, connected through deterministic transformations. A 64-bit Source-Known ID (SKID) provides a timestamp-ordered database key. A 128-bit Source-Known Entity ID (SKEID) adds entity type, epoch, and a keyed message authentication code (MAC) to the SKID, enabling integrity and origin metadata checks within a shared-key trust domain without record lookups. Secure SKEID encrypts this representation to conceal metadata while retaining linkability of repeated identifiers. Collision checks prevent generated ciphertext from being accepted as plaintext. Evaluation combines specification and threat analysis, implementation tests, and microbenchmarks of the C\#/.NET 10 reference implementation. Within sequence capacity on Apple M2 hardware, SKEID and Secure SKEID generation averaged 207.28 $\pm$ 3.10 ns and 224.62 $\pm$ 3.90 ns, respectively, compared with 361.94 $\pm$ 1.94 ns for UUID Version 4 and 384.11 $\pm$ 1.95 ns for UUID Version 7. $\pm$ values indicate 99.9% confidence interval margins. Under saturation, generation was slower than the UUID baselines. These results support the feasibility of deriving SKEIDs from 64-bit Source-Known IDs on demand.