https://openid.github.io/OpenID4VC-HAIP/openid4vc-high-assurance-interoperability-profile-1_1-wg-draft.html#name-ietf-sd-jwt-vc-profile has a bunch of requirements for status list, e.g.:
The public key used to validate the signature on the Status List Token defined in [I-D.ietf-oauth-status-list] MUST be included in the x5c JOSE header of the Token
Each Credential MUST have its own unique, unpredictable status list index
These requirements only apply to SD-JWT - for mdoc we just say:
The Credential Issuer MAY include the MSO revocation mechanism in the issued mdoc. When doing so, it MUST use one of the mechanisms defined in ISO/IEC 18013-5 ([ISO.18013-5.second.edition]).
which doesn't say anything on either of the two above topics. For 'Each Credential MUST have its own unique, unpredictable status list index' - whereas the base token list IETF draft has that as a 'SHOULD'.
This ends up with a weird asymmetry that is probably unexpected - when testing issuers, an SD-JWT VC issuer that reuses status list indexes will fail and can't be certified, but a mdoc issue that reuses status list indexes just gets a 'warning' and can be certified.
I'm not really sure what to do about that. We may just have to leave it as a weird oddity, unless ISO tighten up the text in -5 2nd edition (I've suggested they look into it).
https://openid.github.io/OpenID4VC-HAIP/openid4vc-high-assurance-interoperability-profile-1_1-wg-draft.html#name-ietf-sd-jwt-vc-profile has a bunch of requirements for status list, e.g.:
These requirements only apply to SD-JWT - for mdoc we just say:
which doesn't say anything on either of the two above topics. For 'Each Credential MUST have its own unique, unpredictable status list index' - whereas the base token list IETF draft has that as a 'SHOULD'.
This ends up with a weird asymmetry that is probably unexpected - when testing issuers, an SD-JWT VC issuer that reuses status list indexes will fail and can't be certified, but a mdoc issue that reuses status list indexes just gets a 'warning' and can be certified.
I'm not really sure what to do about that. We may just have to leave it as a weird oddity, unless ISO tighten up the text in -5 2nd edition (I've suggested they look into it).