Selective disclosure is the ability of a credential holder to reveal only specific attributes from a digitally signed credential, while the verifier can still confirm that those attributes were issued and signed by a trusted issuer. A person can prove a single fact, such as nationality or being over a certain age, without exposing the rest of the credential.
In digital identity, selective disclosure turns the privacy principle of data minimization into a cryptographic property. It is a core feature of modern credential formats used in identity wallets, mobile driving licences and verifiable credential ecosystems, where a single credential may contain dozens of attributes that no single verifier needs all at once.
How selective disclosure works cryptographically
A conventional digital signature covers a document as a whole, so removing any field breaks the signature. Selective disclosure schemes solve this by signing a structure that allows parts to be hidden while keeping the remaining parts verifiable. Two main families of techniques are in use.
Salted hash schemes replace each attribute with a hash of the attribute value combined with a random salt, and the issuer signs the list of hashes. The holder later reveals the chosen values and their salts, and the verifier recomputes the hashes and checks them against the signed list. Undisclosed attributes stay hidden because the random salt prevents guessing the value from its hash.
Signature schemes with zero-knowledge proofs, such as BBS signatures and CL signatures, let the holder derive a fresh proof from the original signature that covers only the disclosed attributes. These schemes can also support predicate proofs, such as proving that a birth date lies more than 18 years in the past without revealing the date itself.
Main formats and techniques
Several standardized formats implement selective disclosure, and they differ mainly in unlinkability and in the maturity of their cryptography. The table compares the formats most often encountered.
| Format | Technique | Unlinkable presentations | Typical deployment |
|---|---|---|---|
| SD-JWT | Salted hashes in a JSON Web Token | No, unless single-use copies are issued | Identity wallets, verifiable credentials |
| ISO/IEC 18013-5 mdoc | Salted digests per data element | No, unless single-use copies are issued | Mobile driving licences |
| BBS signatures | Zero-knowledge proof of signature | Yes, each proof looks different | Privacy-focused credential ecosystems |
| CL signatures | Zero-knowledge proofs with predicates | Yes | Anonymous credential systems |
Hash-based formats are popular because they rely on widely approved algorithms such as SHA-256 and ECDSA, which simplifies certification. Zero-knowledge schemes offer stronger privacy against correlation, but their algorithms are newer and not yet as widely supported in certified hardware.
Selective disclosure compared with related concepts
Selective disclosure is a capability of a credential, not a separate identity model. It is often discussed together with neighboring concepts in the Topic, and the distinctions matter for system design.
| Concept | What it describes | Relationship to selective disclosure |
|---|---|---|
| Verifiable credential | A signed, machine-verifiable set of claims | Selective disclosure is a feature some credential formats offer |
| Decentralized identity | Identity without a central account provider | Uses selective disclosure to limit data shared with verifiers |
| Zero-knowledge proof | Proving a statement without revealing the witness | One technique for implementing selective disclosure |
| Data minimization | Legal principle of collecting only necessary data | Selective disclosure provides the technical means |
| Attribute-based access | Access decisions based on attributes | Consumes the attributes that were disclosed |
Selective disclosure also differs from simply sending fewer fields. Without cryptographic support, a verifier receiving a subset of data has no way to confirm its authenticity, so it would usually demand the full document or contact the issuer directly.
Practical design choices
Designing a credential for selective disclosure means deciding which attributes are individually disclosable and how presentations are protected against reuse. The decisions below are typical in wallet and verifier projects.
| Decision | Recommended approach | Reason |
|---|---|---|
| Attribute granularity | Make each sensitive claim separately disclosable | Allows minimal presentations |
| Age verification | Issue derived claims such as age over 18 | Avoids revealing the birth date |
| Correlation risk | Batch-issue single-use credentials or use BBS | Prevents tracking by repeated signatures |
| Holder binding | Require a key-binding proof in each presentation | Stops replay of copied credentials |
| Verifier requests | Register and limit what each verifier may request | Prevents over-asking |
The European Digital Identity Wallet framework supports both SD-JWT based credentials and the mdoc format, and it adds registration of relying parties so that a wallet can warn users when a verifier asks for more attributes than it is entitled to.
Limitations and privacy pitfalls
Selective disclosure reduces what a verifier sees, but it does not guarantee anonymity. Several weaknesses appear in real deployments.
- Linkability: in hash-based formats the same signature and hashes appear in every presentation, so colluding verifiers can recognize the same credential.
- Over-asking: technical minimization fails if verifiers simply request every attribute and users consent out of habit.
- Revocation leaks: status checks that contact the issuer can reveal when and where a credential is used.
- Metadata exposure: the issuer identity, credential type and expiry date may themselves be revealing.
- Hidden attribute inference: the number of undisclosed claims or their structure can sometimes hint at their content.
The idea in brief
Selective disclosure lets a person show only the part of an ID that is actually needed. The rest stays private. The checker can still trust the part that is shown.
Imagine covering every line of a passport except one, and the guard can still be sure that line is genuine. A bar only needs to know that a customer is over 18. It does not need the name, address or exact birth date. Digital wallets use this idea to share less data by default.
A practical scenario
An online wine retailer must verify that buyers are adults before shipping. Previously it asked customers to upload a photo of an identity card, which exposed the full name, address, document number and birth date and created a sensitive data store at the retailer.
The retailer switches to requesting a credential from a digital identity wallet. The wallet receives a request for a single claim confirming age over 18, shows the user which issuer and attribute will be shared, and sends a signed presentation with a key-binding proof. The retailer verifies the issuer signature in under a second and stores only the yes-or-no result with a timestamp. Customer friction drops, and the retailer no longer holds copies of identity documents.