Reason of StatusList2021 Deprecation

[hkny]

I'm working with a tech stack that currently supports VC Data Model 1.1 and StatusList2021. I would like to understand if there are any specific security reasons for marking StatusList2021 as deprecated.

If we were to stick with VC Data Model 1.1 but switch to BitstringStatusList, we would need to define a custom context for BitstringStatusList, which we would prefer to avoid at this stage. On the other hand, using BitstringStatusList without a new context would require adopting VC Data Model 2.0, which is still in Candidate Recommendation status and subject to changes.

Are there any significant drawbacks to continuing with StatusList2021 until both BitstringStatusList and VC Data Model 2.0 reach recommendation status?

Thanks!

[msporny]

I would like to understand if there are any specific security reasons for marking StatusList2021 as deprecated.

No known security issues with StatusList2021 -- it was just the version that was incubated in the community group. The functionality is largely the same with BitstringStatusList with a few new features added and language clarified.

If we were to stick with VC Data Model 1.1 but switch to BitstringStatusList, we would need to define a custom context for BitstringStatusList, which we would prefer to avoid at this stage.

We do have such a context here:

https://github.com/w3c/vc-bitstring-status-list/blob/main/contexts/v1.jsonld

On the other hand, using BitstringStatusList without a new context would require adopting VC Data Model 2.0, which is still in Candidate Recommendation status and subject to changes.

That is another possibility. I'll note that VC Data Model v2.0 is feature complete and has been stable for a number of months now. We expect to finalize it as a global standard in Q1 2025.

Are there any significant drawbacks to continuing with StatusList2021 until both BitstringStatusList and VC Data Model 2.0 reach recommendation status?

No, no significant drawbacks that we know of. VCDM v2.0 should be ready to go fairly soon, and we've started asking implementers to prepare for its release as a global standard in early 2025.

I hope that answers all of your questions, @hkny. I'm going to mark this issue as pending close, please let us know if you have further questions or disagree with closing this issue.

[dlongley]

Jfyi, the proper context URL for the BitstringStatusList context to use with VCDM 1.1 is:

https://www.w3.org/ns/credentials/status/v1

And this does now serve the context referenced above.

[hkny]

Thank you for the clarification @msporny. Much appreciated.