Skip to main content

Status List

A status list is a compact, signed list an issuer publishes so that anyone holding one of its credentials can be checked for revocation without the issuer being asked about that credential specifically.

The list is a bitstring: every credential the issuer hands out is assigned an index in it, and the bit at that index says whether the credential is still valid, revoked or suspended. The credential carries the URL of the list and its own index, so a verifier fetches the list once, caches it, and reads a single bit for every check afterwards. Because the whole list is downloaded at once, the issuer never learns which credential was looked at, because the herd hides the individual. Compressed, a list covering hundreds of thousands of credentials is a few kilobytes. The two specifications in use are Token Status List for JWT and CWT credentials, and Bitstring Status List for the W3C data model.

Back to the glossary