Revocation status is the signal a verifier uses to determine whether a credential is still valid or has been withdrawn by the issuer. In decentralized identity systems, a credential may be valid when issued, then later become revoked because it was lost, compromised, expired early, or no longer meets policy. Checking revocation status is essential because a signed credential can still look authentic even after the issuer has invalidated it.
In attacks, an adversary may steal a wallet, copy a credential, or replay an old credential that should no longer be accepted. If the verifier does not check status correctly, the attacker can keep using a credential after it has been withdrawn. Defenders mitigate this with status lists, online revocation checks, short-lived credentials, and careful cache handling. The challenge is balancing security with privacy and availability, since revocation checks must be reliable without exposing unnecessary user data.