hlr-07-attestation-revocation-and-revocation-ch

EUDI attestation revocation involves providers invalidating attestations using short-lived attestations, Attestation Status Lists (ASL), or Attestation Revocation Lists (ARL). Providers and relying parties must follow ARF Annex 2 requirements to manage and verify these revocation statuses.

Revocation responsibility varies by attestation type: the PID Provider handles revoking PIDs, while the Wallet Provider manages the revocation of WUAs. These designated authorities must execute revocation when specific triggers occur.

EUDI attestations must be revoked under specific triggers including security compromises, direct user requests, or when there are changes to attribute values. These conditions ensure compromised attestations are invalidated promptly.

Relying parties verify EUDI attestation revocation status by checking Attestation Status Lists or Attestation Revocation Lists. They must conduct risk analysis to determine the appropriate verification process according to ARF Annex 2.

Attestation Status Lists (ASL) and Attestation Revocation Lists (ARL) are distinct revocation methods for EUDI attestations. Providers use these mechanisms alongside short-lived attestations to manage and communicate the invalidation of PIDs, QEAAs, PuB-EAA, and WUAs.

Short-lived attestations are an alternative EUDI revocation method where expiration naturally limits validity, whereas Attestation Status Lists (ASL) and Revocation Lists (ARL) actively track invalidation. Providers choose based on specific attestation lifecycle and security requirements.