Selective Disclosure

The foundational principle of selective disclosure is revealing only the specific claims required for a transaction, and nothing more. This prevents unnecessary data leakage and reduces the attack surface for identity theft.

• A user proving they are over 21 can disclose just the boolean ageOver21: true claim without revealing their exact birthdate.
• A professional can prove they hold a valid medical license without exposing their license number, issuing state, or expiration date to every verifier.
• This contrasts sharply with physical documents, where showing a driver's license reveals name, address, and DOB even when only age verification is needed.

Selective disclosure relies on advanced cryptographic techniques to ensure that each disclosed subset is bound to a specific verifier and session, preventing collusion and correlation.

• BBS+ Signatures enable the holder to derive a new, unlinkable proof from the original signed credential for each presentation.
• Verifier-specific nonces are embedded in the proof request, ensuring a proof generated for Verifier A cannot be replayed to Verifier B.
• This prevents verifiers from colluding to correlate user activity across different services, a critical property for privacy-preserving identity systems.

Beyond simple claim revelation, selective disclosure supports zero-knowledge predicate proofs. A holder can prove a statement about a claim is true without revealing the claim's actual value.

• Range proofs allow proving age >= 18 without disclosing the exact age value.
• Set membership proofs allow proving a country code belongs to an approved list without naming the specific country.
• Comparison proofs allow proving account_balance > transaction_amount without revealing either figure.
• These are implemented using efficient ZKP systems like Bulletproofs or zk-SNARKs layered on top of the credential schema.

Selective disclosure fundamentally shifts the power dynamic by requiring active holder consent before any claim is shared. The holder's wallet agent evaluates the proof request and presents a granular consent screen.

• The holder sees exactly which claims are being requested and can approve or deny each one individually.
• The wallet generates a minimal, derived proof containing only the approved claims, signed for the specific verifier's challenge.
• This implements the data minimization principle from GDPR and similar privacy regulations at a technical protocol level, making compliance verifiable rather than merely asserted.