Imagine you're a postal worker who has to sort letters. Two of your sorting methods just read the address label directly — fast, predictable, no surprises. The third method requires you to first translate every letter into a universal format by calling a remote dictionary, then recursively untangle every cross-reference before you can even start sorting. An attacker who understands this can hand you a letter with five carefully cross-referenced footnotes and watch you burn 278 times the normal effort trying to sort it — or slip a footnote that redirects you to their server. That's the core finding here: the W3C Verifiable Credentials Data Model 2.0 pipeline, specifically its RDFC-1.0 canonicalization step and remote JSON-LD context resolution, introduces three structural attack surfaces that the simpler SD-JWT VC and mdoc formats avoid entirely because they never enter that translation step. The committed claim: RDFC-1.0 canonicalization and remote @context resolution in the W3C VCDM verification pipeline create denial-of-service, context injection, and SSRF attack vectors at default library settings, and these are pipeline properties — not implementation bugs — that persist across four tested environments. The authors exercise all three attacks with concrete payloads. A poison graph with just five symmetric blank nodes in 527 bytes forces canonicalization to 278x baseline cost. Eight blank nodes push wall-clock time to 13.5 seconds. An acyclic graph with 1,500 blank nodes hits 462–714x across environments. The multipliers track the symmetry structure of the input, not the raw node count — a critical distinction that tells you the attack is algorithmically fundamental, not just a resource-scaling issue. The ladder comparison is straightforward and honest. SD-JWT VC and mdoc verifiers resisted every attack vector evaluated. These formats achieve this not through clever mitigation but through architectural absence: they require neither canonicalization nor external resource fetching. The paper doesn't claim W3C VCDM is broken in all configurations — it shows that the default configuration is exploitable, which is the configuration most deployments will ship. The distinction matters because the mitigations exist (static document loader, context allowlist, call limit ≤16), but they require deliberate configuration that breaks the format's stated extensibility model. The architectural insight is that this is a pipeline-topology paper, not a cryptographic-vulnerability paper. The attack surfaces arise from the data-normalization layer that sits before signature verification — a layer SD-JWT VC and mdoc don't have. The authors frame this correctly: the defect is the pipeline's complexity surface, not a flaw in any single component. RDFC-1.0's recursion depth is driven by blank-node symmetry, which means the attack scales with structural properties an attacker controls, not with payload size a firewall might catch. The 527-byte poison graph is smaller than most legitimate credentials. Integrity is solid for this class of work. All experiments ran in four environments sharing runtime and library versions, with raw result files and measurement kit published on GitHub. The multiplier consistency across environments (251–424x for one input) is the kind of cross-validation that makes the DoS claim hard to dismiss as environment-specific. The production-schema control test (education credentials costing 16–49x a simple credential at default settings) is particularly useful — it shows that canonicalization overhead isn't just an adversarial concern but a baseline cost of real-world payloads. The weakness is that this is same-team testing only; no independent replication exists yet. The milestone is precise: a call limit of 16 separates every attack payload from every legitimate credential in the test suite, with legitimate credentials completing at depth 1. But the paper honestly notes that shallow, wide recursion (like the 1,500-node acyclic control) passes any call-limit bound — so the full mitigation requires both a call limit and a size bound. The practical milestone for the ecosystem is whether W3C VCDM libraries adopt these defaults, and whether the EU Digital Identity Wallet (which currently allows W3C VCDM) mandates them. The obvious experiment not run: testing against real-world W3C VCDM deployments rather than controlled library environments. The authors almost certainly didn't do this for responsible-disclosure and legal reasons — you can't DoS production identity infrastructure for a paper. The companion paper (arXiv:2611.03493) likely extends the analysis, but within the same controlled-lab paradigm. The second missing piece is a formal complexity proof for RDFC-1.0's worst-case behavior as a function of blank-node symmetry — the empirical evidence is compelling, but the theoretical bound would close the argument.
