"Bitstring Status List v1.1" (W3C Draft, May 2025)

Summary of "Bitstring Status List v1.1" (W3C Draft, May 2025)

Introduction

The Bitstring Status List v1.1 specification introduces a privacy-focused, compact method for tracking the status of Verifiable Credentials (VCs) using bitstrings (where 1=revoked, 0=valid). This approach addresses key challenges in revocation and status management, offering improved privacy, efficiency, and scalability. The draft is tied to the VC Data Model v2.1 and is open for feedback.

Main Sections

Section 1: Purpose and Key Benefits

• Privacy: Eliminates URL-based tracking, reducing correlation risks.
• Efficiency: Highly compressible (e.g., 100K VCs ≈ 12.5 KB max).
• Scalability: Default 131K entries (16 KB) for group privacy.

Section 2: Structure and Data Model

• Problem Addressed: Privacy and performance gaps in existing status tracking methods.
• Data Model: Defines BitstringStatusListEntry and BitstringStatusListCredential.
• Algorithms: Covers generation, validation, and error handling.
• Security: Mitigates correlation, issuer attacks, and tampering.
• Compliance: Requires support for bitstring size specifications.

Section 3: Status List Entry Properties

• id: Optional URL identifier (not for verification).
• type: Must be BitstringStatusListEntry.
• statusPurpose: Defines entry purpose (e.g., revocation, suspension, or message).
• statusListIndex: String-formatted integer (≥0) for credential position.
• statusListCredential: URL to a BitstringStatusListCredential.
• statusSize: Optional bit size (default: 1).
• statusMessage: Maps bit values to messages (default: "set"/"unset" for 1 bit).

Section 4: Status List Credential Properties

• id: Optional; matches statusListCredential in an entry.
• type: Must include BitstringStatusListCredential.
• Validity Period: Set by validFrom and validUntil.
• credentialSubject: Contains encodedList (GZIP-compressed bitstring) and statusPurpose.
• ttl (optional): Refresh interval (ms) for caching.

Section 5: Implementation and Processing

• Conforming Processor: Validates compliant documents and flags non-conforming ones.
• Status Tech Comparison: Bitstrings outperform CRL, OCSP, Bloom Filters, and Accumulators in privacy, efficiency, and VC compatibility.
• Embedding Process: Issuers integrate status data into VCs via credentialStatus.

Section 6: Privacy and Security Considerations

• Group Privacy: Minimum 16KB bitstring length prevents correlation.
• Tracking Risks: Mitigated via selective disclosure and caching.
• Security Measures: Supports anonymous retrieval and standard cryptography.

Section 7: Examples and Use Cases

• Revocable Credential Example: Demonstrates revocation using BitstringStatusListEntry.
• Multiple Status Lists: A credential can reference multiple lists (e.g., revocation and suspension).
• Multiple Purposes in One List: A single list can track multiple purposes.

Conclusion

The Bitstring Status List v1.1 specification provides a robust, privacy-preserving solution for managing Verifiable Credential statuses. By leveraging compressed bitstrings, it addresses scalability and efficiency while mitigating tracking and correlation risks. The draft includes detailed data models, algorithms, and security considerations, making it a comprehensive framework for VC status management. Future revisions may further refine clarity and features based on community feedback.