Revocation
Checking and managing revocation status for delegation credentials
Revocation Checking
KYA-OS requires implementation of credential revocation to enable withdrawal of delegation.
StatusList2021 Verification
The preferred revocation method uses the W3C StatusList2021 specification:
async function checkRevocationStatus(credential) {
if (!credential.credentialStatus) {
throw new Error("Credential lacks status information");
}
if (credential.credentialStatus.type !== "StatusList2021Entry") {
throw new Error("Unsupported status type");
}
// Extract status list URL and index
const statusListUrl =
credential.credentialStatus.statusListCredential ||
credential.credentialStatus.id.split("#")[0];
const statusListIndex = parseInt(
credential.credentialStatus.statusListIndex,
10
);
// Fetch the status list
const response = await fetch(statusListUrl);
const statusListCredential = await response.json();
// Decode and check the status
const statusList = decodeStatusList(
statusListCredential.credentialSubject.encodedList
);
const isRevoked = statusList.getStatus(statusListIndex);
return { isRevoked };
}
Revocation Freshness
Revocation status is evaluated on every verification - verification verdicts are never cached (the v1.13.0 security fix: the verifier's cache holds only the signature-validity result, so a revoked credential can no longer keep verifying from a warm cache). If your deployment can tolerate bounded status-list staleness, declare it explicitly by wrapping your status resolver with withStatusCache(resolver, { maxStalenessMs }) - never with ad-hoc TTL caching of verification results.
For performance optimization:
- Implement efficient status list processing
- Consider webhook notifications for critical credential revocations
Revocation Checking Requirements
For Level 2+ implementations, revocation checking is mandatory for all credentials. Level 1 implementations may implement simplified revocation checking with appropriate security trade-offs documented.