@cheqd/did-provider-cheqd 3.7.0 → 4.0.0-develop.1

package/build/esm/agent/ICheqd.js

@@ -10,9 +10,10 @@ import { StatusList } from '@digitalbazaar/vc-status-list';
 import { v4 } from 'uuid';
 import fs from 'fs';
 import Debug from 'debug';
-import { LitCompatibleCosmosChains, LitProtocol, } from '../dkg-threshold/lit-protocol.js';
-import { blobToHexString, randomFromRange, toBlob } from '../utils/helpers.js';
+import { LitCompatibleCosmosChains, LitProtocol, } from '../dkg-threshold/lit-protocol/v3.js';
+import { blobToHexString, getEncodedList, isEncodedList, randomFromRange, safeDeserialise, toBlob, } from '../utils/helpers.js';
 import { DefaultResolverUrl } from '../did-manager/cheqd-did-resolver.js';
+import { LitNetworksV2, LitProtocolV2 } from '../dkg-threshold/lit-protocol/v2.js';
 const debug = Debug('veramo:did-provider-cheqd');
 export const AccessControlConditionTypes = {
     timelockPayment: 'timelockPayment',
@@ -653,6 +654,8 @@ export class Cheqd {
         // construct data and metadata tuple
         const data = args.encrypted
             ? await (async function (that) {
+                // encrypt bitstring - case: symmetric
+                const { encryptedString: symmetricEncryptionCiphertext, symmetricKey } = await LitProtocol.encryptDirect(fromString(bitstring, args?.statusListEncoding || DefaultStatusList2021Encodings.base64url));
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
                     chain: args?.dkgOptions?.chain || that.didProvider.dkgOptions.chain,
@@ -671,8 +674,10 @@ export class Cheqd {
                             throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
                     }
                 }));
-                // encrypt bitstring
-                const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditions, true);
+                // encrypt bitstring - case: threshold
+                const { encryptedString: thresholdEncryptionCiphertext, stringHash } = await lit.encrypt(fromString(bitstring, args?.statusListEncoding || DefaultStatusList2021Encodings.base64url), unifiedAccessControlConditions);
+                // construct encoded list
+                const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                 // return result tuple
                 switch (args.statusPurpose) {
                     case DefaultStatusList2021StatusPurposeTypes.revocation:
@@ -680,7 +685,7 @@ export class Cheqd {
                             {
                                 StatusList2021: {
                                     statusPurpose: args.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: new Date().toISOString(),
                                     validUntil: args?.validUntil,
                                 },
@@ -688,14 +693,15 @@ export class Cheqd {
                                     type: DefaultStatusList2021ResourceTypes.revocation,
                                     encrypted: true,
                                     encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
-                                    encryptedSymmetricKey,
+                                    statusListHash: stringHash,
                                     paymentConditions: args.paymentConditions,
                                 },
                             },
                             {
+                                symmetricEncryptionCiphertext: await blobToHexString(symmetricEncryptionCiphertext),
+                                thresholdEncryptionCiphertext: toString(thresholdEncryptionCiphertext, 'hex'),
+                                stringHash,
                                 symmetricKey: toString(symmetricKey, 'hex'),
-                                encryptedSymmetricKey,
-                                encryptedString: await blobToHexString(encryptedString),
                             },
                         ];
                     case DefaultStatusList2021StatusPurposeTypes.suspension:
@@ -703,7 +709,7 @@ export class Cheqd {
                             {
                                 StatusList2021: {
                                     statusPurpose: args.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: new Date().toISOString(),
                                     validUntil: args?.validUntil,
                                 },
@@ -711,14 +717,15 @@ export class Cheqd {
                                     type: DefaultStatusList2021ResourceTypes.suspension,
                                     encrypted: true,
                                     encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
-                                    encryptedSymmetricKey,
+                                    statusListHash: stringHash,
                                     paymentConditions: args.paymentConditions,
                                 },
                             },
                             {
+                                symmetricEncryptionCiphertext: await blobToHexString(symmetricEncryptionCiphertext),
+                                thresholdEncryptionCiphertext: toString(thresholdEncryptionCiphertext, 'hex'),
+                                stringHash,
                                 symmetricKey: toString(symmetricKey, 'hex'),
-                                encryptedSymmetricKey,
-                                encryptedString: await blobToHexString(encryptedString),
                             },
                         ];
                     default:
@@ -790,7 +797,7 @@ export class Cheqd {
                 },
             }),
             encrypted: args.encrypted,
-            symmetricKey: args?.returnSymmetricKey ? data[1]?.symmetricKey : undefined,
+            symmetricKey: args.encrypted && args.returnSymmetricKey ? data[1]?.symmetricKey : undefined,
         };
     }
     async BroadcastStatusList2021(args, context) {
@@ -916,8 +923,6 @@ export class Cheqd {
         switch (args?.bitstringEncoding) {
             case 'base64url':
                 return encoded;
-            case 'base64':
-                return toString(fromString(encoded, 'base64url'), 'base64');
             case 'hex':
                 return toString(fromString(encoded, 'base64url'), 'hex');
             default:
@@ -933,12 +938,12 @@ export class Cheqd {
             ? args.issuanceOptions.credential.issuer.id
             : args.issuanceOptions.credential.issuer;
         // generate status list credential
-        const statusListCredential = `${DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=StatusList2021Revocation`;
+        const statusListCredential = `${DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.revocation}`;
         // construct credential status
         const credentialStatus = {
             id: `${statusListCredential}#${statusListIndex}`,
             type: 'StatusList2021Entry',
-            statusPurpose: 'revocation',
+            statusPurpose: DefaultStatusList2021StatusPurposeTypes.revocation,
             statusListIndex: `${statusListIndex}`,
         };
         // add credential status to credential
@@ -975,12 +980,12 @@ export class Cheqd {
             ? args.issuanceOptions.credential.issuer.id
             : args.issuanceOptions.credential.issuer;
         // generate status list credential
-        const statusListCredential = `${DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=StatusList2021Suspension`;
+        const statusListCredential = `${DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.suspension}`;
         // construct credential status
         const credentialStatus = {
             id: `${statusListCredential}#${statusListIndex}`,
             type: 'StatusList2021Entry',
-            statusPurpose: 'suspension',
+            statusPurpose: DefaultStatusList2021StatusPurposeTypes.suspension,
             statusListIndex: `${statusListIndex}`,
         };
         // add credential status to credential
@@ -1034,14 +1039,16 @@ export class Cheqd {
         args.dkgOptions ||= this.didProvider.dkgOptions;
         // verify credential status
         switch (credential.credentialStatus?.statusPurpose) {
-            case 'revocation':
-                if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
-                    return { ...verificationResult, revoked: true };
-                return { ...verificationResult, revoked: false };
-            case 'suspension':
-                if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
-                    return { ...verificationResult, suspended: true };
-                return { ...verificationResult, suspended: false };
+            case DefaultStatusList2021StatusPurposeTypes.revocation:
+                return {
+                    ...verificationResult,
+                    revoked: await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }),
+                };
+            case DefaultStatusList2021StatusPurposeTypes.suspension:
+                return {
+                    ...verificationResult,
+                    suspended: await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }),
+                };
             default:
                 throw new Error(`[did-provider-cheqd]: verify credential: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
@@ -1077,14 +1084,16 @@ export class Cheqd {
             // define dkg options, if provided
             args.dkgOptions ||= this.didProvider.dkgOptions;
             switch (credential.credentialStatus?.statusPurpose) {
-                case 'revocation':
-                    if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
-                        return { ...verificationResult, revoked: true };
-                    break;
-                case 'suspension':
-                    if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
-                        return { ...verificationResult, suspended: true };
-                    break;
+                case DefaultStatusList2021StatusPurposeTypes.revocation:
+                    return {
+                        ...verificationResult,
+                        revoked: await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }),
+                    };
+                case DefaultStatusList2021StatusPurposeTypes.suspension:
+                    return {
+                        ...verificationResult,
+                        suspended: await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }),
+                    };
                 default:
                     throw new Error(`[did-provider-cheqd]: verify presentation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
             }
@@ -1121,9 +1130,9 @@ export class Cheqd {
             if (!args.statusOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: check status: statusOptions.statusListIndex is required');
             // generate resource type
-            const resourceType = args.statusOptions.statusPurpose === 'revocation'
-                ? 'StatusList2021Revocation'
-                : 'StatusList2021Suspension';
+            const resourceType = args.statusOptions.statusPurpose === DefaultStatusList2021StatusPurposeTypes.revocation
+                ? DefaultStatusList2021ResourceTypes.revocation
+                : DefaultStatusList2021ResourceTypes.suspension;
             // construct status list credential
             const statusListCredential = `${DefaultResolverUrl}${args.statusOptions.issuerDid}?resourceName=${args.statusOptions.statusListName}&resourceType=${resourceType}`;
             // construct credential status
@@ -1155,14 +1164,10 @@ export class Cheqd {
         // define dkg options, if provided
         args.dkgOptions ||= this.didProvider.dkgOptions;
         switch (credential.credentialStatus?.statusPurpose) {
-            case 'revocation':
-                if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
-                    return { revoked: true };
-                return { revoked: false };
-            case 'suspension':
-                if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
-                    return { suspended: true };
-                return { suspended: false };
+            case DefaultStatusList2021StatusPurposeTypes.revocation:
+                return { revoked: await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }) };
+            case DefaultStatusList2021StatusPurposeTypes.suspension:
+                return { suspended: await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }) };
             default:
                 throw new Error(`[did-provider-cheqd]: check status: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
@@ -1194,7 +1199,7 @@ export class Cheqd {
             if (!args.revocationOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListIndex is required');
             // construct status list credential
-            const statusListCredential = `${DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=StatusList2021Revocation`;
+            const statusListCredential = `${DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.revocation}`;
             // construct credential status
             args.credential = {
                 '@context': [],
@@ -1203,7 +1208,7 @@ export class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${args.revocationOptions.statusListIndex}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'revocation',
+                    statusPurpose: DefaultStatusList2021StatusPurposeTypes.revocation,
                     statusListIndex: `${args.revocationOptions.statusListIndex}`,
                 },
                 issuanceDate: '',
@@ -1216,7 +1221,7 @@ export class Cheqd {
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'revocation') {
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.revocation) {
             throw new Error(`[did-provider-cheqd]: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // validate args in pairs - case: statusListFile and statusList
@@ -1297,7 +1302,7 @@ export class Cheqd {
                 !args.revocationOptions.statusListIndices.every((index) => !isNaN(+index)))
                 throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListIndex is required and must be an array of indices');
             // construct status list credential
-            const statusListCredential = `${DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=StatusList2021Revocation`;
+            const statusListCredential = `${DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.revocation}`;
             // construct credential status
             args.credentials = args.revocationOptions.statusListIndices.map((index) => ({
                 '@context': [],
@@ -1306,7 +1311,7 @@ export class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${index}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'revocation',
+                    statusPurpose: DefaultStatusList2021StatusPurposeTypes.revocation,
                     statusListIndex: `${index}`,
                 },
                 issuanceDate: '',
@@ -1385,7 +1390,7 @@ export class Cheqd {
             if (!args.suspensionOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListIndex is required');
             // construct status list credential
-            const statusListCredential = `${DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credential = {
                 '@context': [],
@@ -1394,7 +1399,7 @@ export class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${args.suspensionOptions.statusListIndex}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${args.suspensionOptions.statusListIndex}`,
                 },
                 issuanceDate: '',
@@ -1407,7 +1412,7 @@ export class Cheqd {
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension) {
             throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // validate args in pairs - case: statusListFile and statusList
@@ -1488,7 +1493,7 @@ export class Cheqd {
                 !args.suspensionOptions.statusListIndices.every((index) => !isNaN(+index)))
                 throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListIndex is required and must be an array of indices');
             // construct status list credential
-            const statusListCredential = `${DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credentials = args.suspensionOptions.statusListIndices.map((index) => ({
                 '@context': [],
@@ -1497,7 +1502,7 @@ export class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${index}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${index}`,
                 },
                 issuanceDate: '',
@@ -1576,7 +1581,7 @@ export class Cheqd {
             if (!args.unsuspensionOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListIndex is required');
             // construct status list credential
-            const statusListCredential = `${DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credential = {
                 '@context': [],
@@ -1585,7 +1590,7 @@ export class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${args.unsuspensionOptions.statusListIndex}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${args.unsuspensionOptions.statusListIndex}`,
                 },
                 issuanceDate: '',
@@ -1598,7 +1603,7 @@ export class Cheqd {
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension) {
             throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // validate args in pairs - case: statusListFile and statusList
@@ -1679,7 +1684,7 @@ export class Cheqd {
                 !args.unsuspensionOptions.statusListIndices.every((index) => !isNaN(+index)))
                 throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListIndex is required and must be an array of indices');
             // construct status list credential
-            const statusListCredential = `${DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credentials = args.unsuspensionOptions.statusListIndices.map((index) => ({
                 '@context': [],
@@ -1688,7 +1693,7 @@ export class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${index}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${index}`,
                 },
                 issuanceDate: '',
@@ -1956,7 +1961,7 @@ export class Cheqd {
     static async revokeCredential(credential, options) {
         try {
             // validate status purpose
-            if (credential?.credentialStatus?.statusPurpose !== 'revocation')
+            if (credential?.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.revocation)
                 throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
             // fetch status list 2021
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
@@ -1971,10 +1976,17 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await LitProtocolV2.decryptDirect(await toBlob(fromString(publishedList.StatusList2021
+                            .encodedList, 'hex')), fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: revocation: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await toBlob(fromString(getEncodedList(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    return toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -1998,7 +2010,7 @@ export class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
@@ -2017,7 +2029,7 @@ export class Cheqd {
             const statusList = await StatusList.decode({ encodedList: statusList2021 });
             // early exit, if credential is already revoked
             if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
-                return { revoked: false };
+                return { revoked: true };
             // update revocation status
             statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
             // set in-memory status list ref
@@ -2079,6 +2091,8 @@ export class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await LitProtocol.encryptDirect(fromString(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
@@ -2129,13 +2143,15 @@ export class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt(fromString(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -2144,7 +2160,11 @@ export class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: revocation: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -2152,9 +2172,10 @@ export class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: toString(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -2218,7 +2239,7 @@ export class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credential))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? toString(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credential)
@@ -2250,7 +2271,7 @@ export class Cheqd {
             .filter((value, index, self) => self.indexOf(value) !== index).length > 0)
             throw new Error('[did-provider-cheqd]: revocation: Credentials must have unique status list index');
         // validate credentials - case: status purpose
-        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'revocation'))
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === DefaultStatusList2021StatusPurposeTypes.revocation))
             throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
         // validate credentials - case: status list id
         const remote = credentials[0].credentialStatus?.id
@@ -2282,10 +2303,17 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await LitProtocolV2.decryptDirect(await toBlob(fromString(publishedList.StatusList2021
+                            .encodedList, 'hex')), fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: revocation: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await toBlob(fromString(getEncodedList(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    return toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2309,7 +2337,7 @@ export class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
@@ -2405,6 +2433,8 @@ export class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await LitProtocol.encryptDirect(fromString(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
@@ -2455,13 +2485,15 @@ export class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt(fromString(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -2470,7 +2502,11 @@ export class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: revocation: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -2478,9 +2514,10 @@ export class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: toString(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -2544,7 +2581,7 @@ export class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credentials[0]))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? toString(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credentials[0])
@@ -2560,7 +2597,7 @@ export class Cheqd {
     static async suspendCredential(credential, options) {
         try {
             // validate status purpose
-            if (credential?.credentialStatus?.statusPurpose !== 'suspension')
+            if (credential?.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension)
                 throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
             // fetch status list 2021
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
@@ -2575,10 +2612,17 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await LitProtocolV2.decryptDirect(await toBlob(fromString(publishedList.StatusList2021
+                            .encodedList, 'hex')), fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: suspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await toBlob(fromString(getEncodedList(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    return toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2602,7 +2646,7 @@ export class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
@@ -2683,6 +2727,8 @@ export class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await LitProtocol.encryptDirect(fromString(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
@@ -2733,13 +2779,15 @@ export class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt(fromString(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -2748,7 +2796,11 @@ export class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: suspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -2756,9 +2808,10 @@ export class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: toString(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -2822,7 +2875,7 @@ export class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credential))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? toString(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credential)
@@ -2854,7 +2907,7 @@ export class Cheqd {
             .filter((value, index, self) => self.indexOf(value) !== index).length > 0)
             throw new Error('[did-provider-cheqd]: suspension: Credentials must have unique status list index');
         // validate credentials - case: status purpose
-        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'suspension'))
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === DefaultStatusList2021StatusPurposeTypes.suspension))
             throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
         // validate credentials - case: status list id
         const remote = credentials[0].credentialStatus?.id
@@ -2886,10 +2939,17 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await LitProtocolV2.decryptDirect(await toBlob(fromString(publishedList.StatusList2021
+                            .encodedList, 'hex')), fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: suspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await toBlob(fromString(getEncodedList(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    return toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2913,7 +2973,7 @@ export class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
@@ -3009,6 +3069,8 @@ export class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await LitProtocol.encryptDirect(fromString(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
@@ -3059,13 +3121,15 @@ export class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt(fromString(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -3074,7 +3138,11 @@ export class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: suspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -3082,9 +3150,10 @@ export class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: toString(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -3148,7 +3217,7 @@ export class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credentials[0]))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? toString(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credentials[0])
@@ -3164,7 +3233,7 @@ export class Cheqd {
     static async unsuspendCredential(credential, options) {
         try {
             // validate status purpose
-            if (credential?.credentialStatus?.statusPurpose !== 'suspension')
+            if (credential?.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension)
                 throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
             // fetch status list 2021
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
@@ -3179,10 +3248,17 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await LitProtocolV2.decryptDirect(await toBlob(fromString(publishedList.StatusList2021
+                            .encodedList, 'hex')), fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: unsuspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await toBlob(fromString(getEncodedList(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    return toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -3206,7 +3282,7 @@ export class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
@@ -3287,6 +3363,8 @@ export class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await LitProtocol.encryptDirect(fromString(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
@@ -3337,13 +3415,15 @@ export class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt(fromString(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -3352,7 +3432,11 @@ export class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: unsuspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -3360,9 +3444,10 @@ export class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: toString(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -3426,7 +3511,7 @@ export class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credential))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? toString(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credential)
@@ -3458,7 +3543,7 @@ export class Cheqd {
             .filter((value, index, self) => self.indexOf(value) !== index).length > 0)
             throw new Error('[did-provider-cheqd]: unsuspension: Credentials must have unique status list index');
         // validate credentials - case: status purpose
-        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'suspension'))
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === DefaultStatusList2021StatusPurposeTypes.suspension))
             throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
         // validate credentials - case: status list id
         const remote = credentials[0].credentialStatus?.id
@@ -3490,10 +3575,17 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await LitProtocolV2.decryptDirect(await toBlob(fromString(publishedList.StatusList2021
+                            .encodedList, 'hex')), fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: unsuspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await toBlob(fromString(getEncodedList(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    return toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -3517,7 +3609,7 @@ export class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
@@ -3613,6 +3705,8 @@ export class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await LitProtocol.encryptDirect(fromString(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
@@ -3663,13 +3757,15 @@ export class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt(fromString(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await blobToHexString(symmetricEncryptionCiphertext)}-${toString(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await blobToHexString(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -3678,7 +3774,11 @@ export class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: unsuspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -3686,9 +3786,10 @@ export class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: toString(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -3752,7 +3853,7 @@ export class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credentials[0]))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? toString(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credentials[0])
@@ -3767,11 +3868,14 @@ export class Cheqd {
     }
     static async checkRevoked(credential, options = { fetchList: true }) {
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'revocation') {
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.revocation) {
             throw new Error(`[did-provider-cheqd]: check: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // fetch status list 2021
         const publishedList = (await Cheqd.fetchStatusList2021(credential));
+        // route to non-migrated action, if applicable
+        if (publishedList.metadata.encryptedSymmetricKey)
+            return await this.checkRevokedNonMigrated(credential, publishedList, options);
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? await (async function () {
@@ -3780,8 +3884,11 @@ export class Cheqd {
                     return publishedList.metadata.encoding === 'base64url'
                         ? publishedList.StatusList2021.encodedList
                         : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // validate encoded list
+                if (!isEncodedList(publishedList.StatusList2021.encodedList))
+                    throw new Error('[did-provider-cheqd]: check: revocation: Invalid encoded list');
                 // otherwise, decrypt and return raw bitstring
-                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                const thresholdEncryptionCiphertext = getEncodedList(publishedList.StatusList2021.encodedList, false)[1];
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
                     chain: options?.topArgs?.dkgOptions?.chain,
@@ -3801,7 +3908,7 @@ export class Cheqd {
                     }
                 }));
                 // decrypt
-                return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
+                return await lit.decrypt(thresholdEncryptionCiphertext, publishedList.metadata.statusListHash, unifiedAccessControlConditions);
             })()
             : await (async function () {
                 // transcode to base64url, if needed
@@ -3825,7 +3932,7 @@ export class Cheqd {
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                     // decrypt
-                    const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                     // validate against published list
                     if (decrypted !== publishedListTranscoded)
                         throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
@@ -3851,11 +3958,14 @@ export class Cheqd {
     }
     static async checkSuspended(credential, options = { fetchList: true }) {
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension) {
             throw new Error(`[did-provider-cheqd]: check: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // fetch status list 2021
         const publishedList = (await Cheqd.fetchStatusList2021(credential));
+        // route to non-migrated action, if applicable
+        if (publishedList.metadata.encryptedSymmetricKey)
+            return await this.checkSuspendedNonMigrated(credential, publishedList, options);
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? await (async function () {
@@ -3865,7 +3975,7 @@ export class Cheqd {
                         ? publishedList.StatusList2021.encodedList
                         : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // otherwise, decrypt and return bitstring
-                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                const thresholdEncryptionCiphertext = getEncodedList(publishedList.StatusList2021.encodedList, false)[1];
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
                     chain: options?.topArgs?.dkgOptions?.chain,
@@ -3885,6 +3995,178 @@ export class Cheqd {
                     }
                 }));
                 // decrypt
+                return await lit.decrypt(thresholdEncryptionCiphertext, publishedList.metadata.statusListHash, unifiedAccessControlConditions);
+            })()
+            : await (async function () {
+                // transcode to base64url, if needed
+                const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                    ? publishedList.StatusList2021.encodedList
+                    : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // if status list 2021 is not fetched, read from file
+                if (options?.statusListFile) {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted) {
+                        // construct encoded status list
+                        const encoded = new StatusList({
+                            buffer: await Cheqd.getFile(options.statusListFile),
+                        }).encode();
+                        // validate against published list
+                        if (encoded !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
+                        // return encoded
+                        return encoded;
+                    }
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                    // decrypt
+                    const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
+                    // validate against published list
+                    if (decrypted !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
+                    // return decrypted
+                    return decrypted;
+                }
+                if (!options?.statusListInlineBitstring)
+                    throw new Error('[did-provider-cheqd]: check: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                // validate against published list
+                if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                    throw new Error('[did-provider-cheqd]: check: suspension: statusListInlineBitstring does not match published status list 2021');
+                // otherwise, read from inline bitstring
+                return options?.statusListInlineBitstring;
+            })();
+        // parse status list 2021
+        const statusList = await StatusList.decode({ encodedList: statusList2021 });
+        // get status by index
+        return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
+    }
+    static async checkRevokedNonMigrated(credential, associatedStatusList, options = { fetchList: true }) {
+        // validate status purpose
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.revocation) {
+            throw new Error(`[did-provider-cheqd]: check: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+        }
+        // fetch status list 2021
+        const publishedList = associatedStatusList ||
+            (await Cheqd.fetchStatusList2021(credential));
+        // validate migrated
+        if (!publishedList.metadata.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: check: revocation: Invalid migrated status list');
+        // fetch status list 2021 inscribed in credential
+        const statusList2021 = options?.topArgs?.fetchList
+            ? await (async function () {
+                // if not encrypted, return bitstring
+                if (!publishedList.metadata.encrypted)
+                    return publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // otherwise, decrypt and return raw bitstring
+                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await LitProtocolV2.create({
+                    chain: options?.topArgs?.dkgOptions?.chain,
+                    litNetwork: LitNetworksV2.serrano,
+                });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case AccessControlConditionTypes.timelockPayment:
+                            return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, options?.topArgs?.dkgOptions?.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
+                // decrypt
+                return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
+            })()
+            : await (async function () {
+                // transcode to base64url, if needed
+                const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                    ? publishedList.StatusList2021.encodedList
+                    : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // if status list 2021 is not fetched, read from file
+                if (options?.statusListFile) {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted) {
+                        // construct encoded status list
+                        const encoded = new StatusList({
+                            buffer: await Cheqd.getFile(options.statusListFile),
+                        }).encode();
+                        // validate against published list
+                        if (encoded !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
+                        // return encoded
+                        return encoded;
+                    }
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                    // decrypt
+                    const decrypted = await LitProtocolV2.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate against published list
+                    if (decrypted !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
+                    // return decrypted
+                    return decrypted;
+                }
+                if (!options?.statusListInlineBitstring)
+                    throw new Error('[did-provider-cheqd]: check: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                // validate against published list
+                if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                    throw new Error('[did-provider-cheqd]: check: revocation: statusListInlineBitstring does not match published status list 2021');
+                // otherwise, read from inline bitstring
+                return options?.statusListInlineBitstring;
+            })();
+        // transcode, if needed
+        const transcodedStatusList2021 = publishedList.metadata.encoding === 'base64url'
+            ? statusList2021
+            : toString(fromString(statusList2021, publishedList.metadata.encoding), 'base64url');
+        // parse status list 2021
+        const statusList = await StatusList.decode({ encodedList: transcodedStatusList2021 });
+        // get status by index
+        return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
+    }
+    static async checkSuspendedNonMigrated(credential, associatedStatusList, options = { fetchList: true }) {
+        // validate status purpose
+        if (credential.credentialStatus?.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension) {
+            throw new Error(`[did-provider-cheqd]: check: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+        }
+        // fetch status list 2021
+        const publishedList = associatedStatusList ||
+            (await Cheqd.fetchStatusList2021(credential));
+        // validate migrated
+        if (!publishedList.metadata.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: check: suspension: Invalid migrated status list');
+        // fetch status list 2021 inscribed in credential
+        const statusList2021 = options?.topArgs?.fetchList
+            ? await (async function () {
+                // if not encrypted, return bitstring
+                if (!publishedList.metadata.encrypted)
+                    return publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // otherwise, decrypt and return raw bitstring
+                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await LitProtocolV2.create({
+                    chain: options?.topArgs?.dkgOptions?.chain,
+                    litNetwork: LitNetworksV2.serrano,
+                });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case AccessControlConditionTypes.timelockPayment:
+                            return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, options?.topArgs?.dkgOptions?.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
+                // decrypt
                 return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
             })()
             : await (async function () {
@@ -3909,7 +4191,7 @@ export class Cheqd {
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                     // decrypt
-                    const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    const decrypted = toString(await LitProtocol.decryptDirect(scopedRawBlob, await safeDeserialise(options?.topArgs?.symmetricKey, fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                     // validate against published list
                     if (decrypted !== publishedListTranscoded)
                         throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
@@ -3956,8 +4238,8 @@ export class Cheqd {
         if (credential.credentialStatus.type !== 'StatusList2021Entry')
             throw new Error('[did-provider-cheqd]: fetch status list: Credential status type is not valid');
         // validate credential status list status purpose
-        if (credential.credentialStatus.statusPurpose !== 'revocation' &&
-            credential.credentialStatus.statusPurpose !== 'suspension')
+        if (credential.credentialStatus.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.revocation &&
+            credential.credentialStatus.statusPurpose !== DefaultStatusList2021StatusPurposeTypes.suspension)
             throw new Error('[did-provider-cheqd]: fetch status list: Credential status purpose is not valid');
         // fetch status list 2021
         const content = (await (await fetch(credential.credentialStatus.id.split('#')[0])).json());