Open problems

A licence number is public text. Levels 0 to 2 raise the cost of impersonation but none of them binds the number to the key signing the claim. A checker reading a register page sees that a licence belongs to a firm. They cannot see whether this key belongs to that firm.

What would move it. Only the issuing authority can close it, by recording a key against a licence: tier C of RVW-5. What would move it is one authority adding an optional key field at renewal. Everything else in this lab is work on surviving until that happens.

Some registers exist only as a search form over a database, with no page per licence and no export. Some exist on paper. For those jurisdictions levels 2 and 3 are both unreachable, and the professionals there are exactly the ones with no way to distinguish themselves from an impersonator.

What would move it. A third party mirror is the obvious answer and it is dangerous: a mirror that looks like a source is worse than nothing. What would move it is a documented minimal export that an authority can produce from any system, plus mirror rules that make a mirror legible as a mirror.

A professional who loses their identity key loses the binding. The recovery paths that work for consumers, a support desk that can reset, are precisely the paths that make impersonation cheap again, and a social recovery scheme assumes a social graph that professionals do not have in this context.

What would move it. The current answer is partial: short claim windows mean a lost key expires itself rather than lingering, and a reachable authority can reissue. For levels 0 to 2 there is no answer at all.

A fresh address per job is normal practice. Published delegations defeat it: one fetch and an observer has every address an identity has used, which is worse for the professional than using one address openly.

What would move it. A Merkle commitment with selective reveal, drafted in RVW-3 section 5, stops enumeration. It does not stop timing correlation: a root published shortly before a payout narrows the set. Nobody has shown a design that survives a well resourced observer.

Licence number 4102938 exists in dozens of jurisdictions. Claims carry a jurisdiction code, but there is no stable global naming for issuing bodies, and bodies merge, split and get renamed.

What would move it. A lab-maintained list would solve it immediately and would make Revow a namespace operator, which rule four forbids. Existing identifier schemes have been looked at and none covers trade licensing. This is the open problem with the least progress.

Attestations are worth what their signer is worth. A small number of large attesters recreates the platform this lab is routing around. A large number of small ones leaves a consumer with a pile of signatures and no way to reason about them.

What would move it. Consumer-chosen attester lists push the decision to the party taking the risk, which is correct and also unhelpful to a small implementer. A workable default that is not a trust list has not been found.

A suspended licence should stop counting within hours. Document-based withdrawal propagates when somebody next fetches, which may be never. Onchain withdrawal is immediate, public and costs gas, which makes it unattractive for the routine rotation it would serve best.

What would move it. Short windows are the blunt answer and they push work onto the professional, which is how credential systems rot. A cheap, private, immediate withdrawal channel is wanted and does not exist.