Re: Historical status

>
> > Another holder-side option is to have valid VCs periodically "notarized"
> by a trusted authority that hands back to the holder of the original valid
> VC an additional VC stating basically nothing more than "at timestamp X,
> you showed me a VC of `id`` Y that was valid and non-revoked at the time",
> which the holder can share as needed.
>
> There is a real risk here of over-optimising for the supply chain use
> case and making the entire ecosystem far more complicated than it
> needs to be. Sometimes all you need is an ephemeral transaction.
> Sometimes you don't want all of your actions recorded.
>
> Of the solutions provided, I tend to agree that Bumblefudge's approach
> is the cleanest... not everything needs an audit trail
>

I think this summary is an oversimplification in a way that's genuinely
dangerous, so I want to poke at it.

Let's take the most prototypical "ephemeral transaction" that I can think
of -- one that we've talked about *ad nauseum* in these circles: login.
Suppose I just want to log in to system X, now, and there's no future need
for an audit trail. This is fine as far as it goes, and I can readily
accept that there could be many actions like this that can also be imagined
as "ephemeral".

But suppose that I want the authentication in this login to be based on a
VC. Unless the VC was minted in the split second before the authentication
occurred, carries a <now> timestamp, and asserts no validity period at all,
the instrument we're positing presupposes some kind of long-lived
assertion: "Alice is an employee of company X from <issuance date> to
<expiration date>, unless this cred gets revoked before then", for example.
The latter form of assertions REQUIRES a log of key state evolution, OR it
becomes susceptible to trivial retrograde attacks, OR (the issuer must
rotate keys regularly AND must revoke all issued creds with every
issuance). See https://dhh1128.github.io/papers/was.html.

My claim is that logs are not a supply-chain requirement, and they are not
some kind of optional and advanced mode; they're a basic requirement for
any viable credential ecosystem. X509s learned this the hard way with CT.
Believing otherwise is only possible because we don't have enough market
adoption to see how ugly it is to ignore it.