Status list
A status list is an issuer-signed, compressed bit list that indicates for every issued credential whether it is valid, revoked or suspended.
The format follows the IETF Token Status List. A mandate references its list by index and address. The list must come from the mandate's issuer; a list from a foreign key proves nothing. Without a status list, it can only be answered whether a mandate was valid when issued.
Example
A customer revokes her agent's mandate on Tuesday. The issuer sets the corresponding bit in the status list. When a merchant checks an order on Wednesday, it sees the revocation and declines.
How it differs
An expiry date ends a mandate automatically; a revocation does so at any time. Certificate revocation lists do the same job for X.509; the status list is the compact form for digital credentials.
In practice
- Publish the status list at a stable address and update it promptly after every revocation. An outdated list can show a revocation too late.
- Define how old a status list may be at most when verifying, and decline evidence if only an older list is available.
- Provide the current status list in KYA under “Trust of the verifying party”; verification itself does not load lists from the network.
Role in KYA
KYA verifies the status list provided by the verifying party, including its signature. Without it, revocation remains unchecked and the verdict “indeterminate”, as the example “Mandate without status list” shows.
Related check: Revocation (revocation). Is the mandate neither revoked nor suspended according to the status list?
Status lists for revocable mandates are published, for example, by the reference implementation Mandact (from the operator of KYA).
Frequently asked questions
What is a status list?
A signed, compressed list in which each bit shows the status of a credential, such as valid or revoked.
Why does a mandate need a status list?
So that it can be revoked before it expires, for example if an agent is compromised or the engagement ends.
What happens if the status list is missing?
Then revocation cannot be checked. In this case KYA returns “indeterminate” rather than “valid”.
Does a status list reveal whose mandate was revoked?
No. A status list only contains bits at positions. Only someone who knows the credential with its index can read the status of a specific mandate.
How large is a status list?
Very small. Each credential takes only a few bits, and the list is compressed. A list for hundreds of thousands of mandates typically takes only a few kilobytes.