Selective disclosure

Selective disclosure is the ability to share only the specific attributes a verifier needs from a credential, for example proving you are over 18 without revealing your exact birth date.

It works because a credential format such as SD-JWT hashes and salts each claim separately at issuance time, so a holder can leave any claim out of what they send while the remaining ones still check against the issuer's original signature. The wallet, not the issuer or the verifier, decides at presentation time which claims to reveal, which means the same credential can be reused across many different requests without ever exposing more than each one asks for. This differs from simply redacting a paper document or a PDF, where removing a field either breaks the signature or requires trusting whoever did the redacting: with selective disclosure, the verifier can mathematically confirm that the disclosed claims are genuine and untampered even though other claims from the same credential stay completely hidden. A common example is age verification, where a holder proves they are over 18 by disclosing only a predicate about their birth date rather than the date itself, or a company proving it is registered without revealing its full ownership structure. Selective disclosure is a core privacy requirement for the EUDI Wallet under eIDAS 2.0, which is built on the data minimisation principle from the EU's data protection rules and is designed to let citizens and businesses prove exactly what a relying party asks for and nothing more, reducing the amount of personal data that flows to relying parties and the risk if any single one is ever breached.

• datatracker.ietf.org

Back to the glossary