Status List 2021

Status List 2021 is a technical specification for managing the revocation or suspension status of Verifiable Credentials (VCs). It provides a standardized mechanism for an issuer to signal whether a previously issued credential is still valid, without revealing which specific credential a holder is checking. This is achieved by using a bitstring status list, where each credential is assigned a unique index position represented by a single bit (0 for valid, 1 for revoked/suspended). The entire encoded bitstring is published at a URI, allowing any verifier to fetch and check the status.

The protocol's design emphasizes privacy and efficiency. Unlike traditional certificate revocation lists (CRLs) that expose specific identifiers, a verifier only needs to request the bit at a specific index, often via a cryptographically-salted URL. This prevents the verifier from learning about the status of other credentials on the same list. Furthermore, the list is compressed using base64-encoded GZIP compression, making it extremely compact—a list with one million status entries is under 125KB. This makes it suitable for decentralized and mobile-first environments.

Implementation involves the issuer including a credentialStatus property in the VC, pointing to the status list index and its URI. The verifier's process involves: 1) parsing this property, 2) fetching the compressed list from the URI, 3) decoding and decompressing it, and 4) checking the bit at the specified index. The list can be hosted on a traditional web server, a decentralized storage network like IPFS, or within a blockchain transaction. This flexibility allows issuers to choose a hosting method that aligns with their trust and availability requirements.

Key advantages of Status List 2021 include its scalability, as a single list can manage millions of credentials; unlinkability, which enhances holder privacy during status checks; and simplicity, leveraging well-understood web technologies. It is a core component in ecosystems using W3C Verifiable Credentials, such as digital identity, educational attestations, and professional licenses, providing a critical mechanism for trust without relying on centralized, queryable databases.

Status List 2021 is a W3C Verifiable Credentials specification that provides a bitstring-based revocation mechanism for credentials. It works by encoding the revocation status of many credentials into a single, compressed bitstring, where each bit represents the status (e.g., 0 for valid, 1 for revoked) of a specific credential. This bitstring is then published at a stable URL, allowing any verifier to check a credential's status by fetching the list and inspecting the bit at the credential's assigned index. This approach is highly efficient, enabling the status management of thousands of credentials with minimal data overhead.

The system relies on two linked components: the status list credential and the status list index. The status list credential is a special Verifiable Credential whose credentialSubject contains the encoded bitstring and its compression type (e.g., gzip). The credential to be checked, such as a driver's license, includes a credentialStatus property pointing to this list's URI and specifying the exact statusListIndex (the bit position) to inspect. This decouples the status information from the credential itself, allowing for real-time updates without altering the original signed credential.

A core innovation is the use of cryptographic bit commitment. The status list bitstring is hashed, and this hash is included in the credential's proof (e.g., in a Merkle tree or as a disclosed attribute). This prevents an issuer from fraudulently changing a credential's status after issuance, as any alteration to the published list would invalidate the cryptographic proof. Verifiers must therefore obtain both the current status list and verify that its hash matches the commitment in the credential they are checking, ensuring the integrity of the status information.

The specification supports different status purposes through distinct list types, primarily revocation and suspension. A revocation list indicates a permanent invalidation, while a suspension list indicates a temporary hold. A single credential can reference multiple status lists for different purposes. The bitstring itself is typically Base64-encoded and compressed to minimize bandwidth usage, a critical consideration for mobile and IoT environments where credentials are frequently verified.

In practice, an issuer generates a status list credential, assigns a unique index to each issued credential, and hosts the list at a persistent URI. When a verifier receives a credential, they parse the credentialStatus field, HTTP GET the status list credential, decompress the bitstring, and check the bit at the specified index. This mechanism provides a standardized, scalable, and privacy-preserving alternative to traditional certificate revocation lists (CRLs) and online certificate status protocol (OCSP) used in public key infrastructure (PKI).

At its core, Status List 2021 is a W3C Verifiable Credentials extension that addresses a critical privacy flaw in traditional revocation methods. Instead of publishing a single, comprehensive list of all revoked credential identifiers, it uses a bitstring—a long string of 1s and 0s—where each bit represents the status of a single credential. A 1 typically indicates a credential is revoked or suspended, while a 0 indicates it is valid. This allows a verifier to check the status of a specific credential by querying only its corresponding bit position, without learning the status of any other credentials on the list.

The mechanism relies on a cryptographically signed status list credential issued by the same entity that issued the original Verifiable Credential. When presenting a credential, the holder provides a cryptographic proof that points to their specific bit in this list. The verifier can then fetch the list, verify its signature for authenticity, and check the single relevant bit. This design ensures minimal disclosure: the verifier learns nothing about the total number of issued credentials, the identities of other holders, or the status of any credential other than the one being presented.

This approach offers significant advantages over older methods like Certificate Revocation Lists (CRLs). Traditional CRLs expose the identifiers of all revoked credentials, allowing verifiers to correlate data and build profiles of user activity. Status List 2021 eliminates this correlation risk. Its implementation is also highly efficient for large-scale systems, as a single, compact bitstring can manage the status for millions of credentials, with updates requiring only the issuer to change specific bits and re-sign the list.