- From: publication-notifier <sysbot+notifier@w3.org>
- Date: Tue, 30 Jun 2026 07:51:55 +0000
- To: public-review-announce@w3.org
Verifiable Credential Forgery Defense v1.0 https://www.w3.org/TR/2026/WD-vc-forgery-defense-1.0-20260630/ Published by Verifiable Credentials Working Group Abstract This specification describes a mechanism for issuers of verifiable credentials to publish indexed lists of compact cryptographic witnesses. Verifiers can use these lists to confirm that a verifiable credential was genuinely issued by the claimed issuer — as distinct from a credential forged by an attacker who has compromised the issuer's signing key. Because the witness list is itself a verifiable credential, it can be signed with a different algorithm from the protected credentials, including post-quantum signature schemes. This makes the mechanism particularly valuable in scenarios where a conventional signing key has been compromised by a quantum-capable adversary. This work is complementary to the Quantum-Resistant Cryptosuites 1.0 work and is motivated by the same threat: compromise of a conventional signing key by a cryptographically relevant quantum computer. Those cryptosuites let issuers secure new proofs with post-quantum signatures; this specification lets an issuer establish post-quantum-backed authenticity for credentials that were, or will be, signed with conventional quantum-vulnerable algorithms, by publishing a witness list that is itself signed with a post-quantum scheme. The specification defines a data model and algorithms for three usage modes: an implicit mode that piggybacks on an existing Verifiable Credential Bitstring Status List without modifying the protected credential; an explicit mode that adds a credentialStatus entry to the protected credential; and a standalone mode for use cases that define their own index allocation. Status of the Document This section describes the status of this document at the time of its publication. A list of current W3C publications and the latest revision of this technical report can be found in the W3C standards and drafts index. This document was published by the Verifiable Credentials Working Group as a First Public Working Draft using the Recommendation track. Publication as a First Public Working Draft does not imply endorsement by W3C and its Members. This is a draft document and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to cite this document as other than a work in progress. This document was produced by a group operating under the W3C Patent Policy. W3C maintains a public list of any patent disclosures made in connection with the deliverables of the group; that page also includes instructions for disclosing a patent. An individual who has actual knowledge of a patent that the individual believes contains Essential Claim(s) must disclose the information in accordance with section 6 of the W3C Patent Policy. This document is governed by the 18 August 2025 W3C Process Document. -- This report was automatically generated using https://github.com/w3c/transition-notifier
Received on Tuesday, 30 June 2026 07:52:05 UTC