💻 computer science

Compact and Selective Disclosure for Verifiable Credentials

This paper introduces CSD-JWT, an open-source mechanism that leverages cryptographic accumulators to enable compact and selective disclosure of Verifiable Credentials, significantly reducing memory usage and network overhead for resource-constrained devices within Self-Sovereign Identity systems.

Original authors: Alessandro Buldini, Carlo Mazzocca, Rebecca Montanari, Selcuk Uluagac

Published 2026-03-25

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Alessandro Buldini, Carlo Mazzocca, Rebecca Montanari, Selcuk Uluagac

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a digital backpack (your Self-Sovereign Identity) filled with important documents: your driver's license, your health records, your university degree, and your bank statements.

In the old days, if you wanted to prove you were old enough to buy alcohol, you had to hand over your entire wallet. The cashier would see your address, your birth date, your eye color, and your home address, even though they only needed to know you were over 21. This is a privacy nightmare.

To fix this, we invented Verifiable Credentials (VCs). These are like digital ID cards that let you show only the specific fact you need (e.g., "Over 21") without showing the rest of the card.

However, the current best method for doing this (called SD-JWT) has a hidden flaw: It's bulky and leaks secrets.

The Problem: The "Bulky Envelope"

Think of the current method (SD-JWT) like sending a letter where you want to reveal only one sentence. To prove the letter is real, you have to include a sealed, locked envelope for every single sentence in the original document, even the ones you aren't showing.

If your document has 100 sentences, you have to carry 100 locked envelopes.
If you only want to show 1 sentence, you still have to carry all 100 envelopes in your pocket.
The Leak: By counting the envelopes, a sneaky observer can guess how many sentences were in the original document. If you only show 1 envelope, they know you hid 99 others. They might guess, "Oh, they must have a secret health condition!" just because they know you hid a lot.

This is a disaster for tiny devices like hardware wallets (the size of a USB stick) or smart sensors (IoT devices) that have very little memory. Carrying 100 envelopes is too heavy for them.

The Solution: The "Magic Summary Box" (CSD-JWT)

The authors of this paper propose a new method called CSD-JWT. Instead of carrying a separate locked envelope for every sentence, they use a Cryptographic Accumulator.

Here is the analogy:
Imagine you have a Magic Summary Box.

The Issuer (The Government/University): They take all 100 sentences of your document and crush them into a single, tiny, unbreakable Magic Stone. This stone represents the entire document.
The Proof: For every single sentence you might want to show later, the Issuer gives you a tiny Golden Key (called a "witness").
The Result: You don't carry 100 envelopes. You carry one Magic Stone and a small pile of Golden Keys.

How It Works in Real Life

Let's say you want to prove you are over 21, but you don't want to show your address.

The Old Way (SD-JWT): You hand over the "Over 21" sentence, plus 99 other sealed envelopes for the hidden info. The total weight is huge. The verifier sees you hid 99 things.
The New Way (CSD-JWT):
- You hand over the Magic Stone (which proves the whole document is real).
- You hand over one Golden Key for the "Over 21" sentence.
- The verifier uses the Key to "unlock" that specific sentence and checks it against the Stone.
- The Magic: The Stone is the same size whether you have 1 sentence or 1,000. The verifier cannot tell how many sentences are hidden inside the Stone. They only see the one you chose to show.

Why This is a Big Deal

The paper tested this on a tiny computer chip (like the ones in hardware wallets) and found amazing results:

Massive Space Savings: It saves up to 46% of memory. For a device with a tiny brain, this is like clearing out half your closet.
Super Fast & Small Data: When you send your ID to a website, the message is 27% to 93% smaller.
- Example: If you have 100 facts and only show 1, the new method sends a message that is 93% smaller than the old method.
Better Privacy: Because the "Magic Stone" doesn't change size based on how many secrets you hide, no one can guess how much private info you have. It stops "inference attacks" (guessing your secrets by counting your hidden items).

The Bottom Line

CSD-JWT is like upgrading from a heavy, clunky suitcase full of locked boxes to a sleek, magic briefcase.

It fits in your pocket (perfect for tiny devices).
It keeps your secrets safe (you only show what you want).
It hides the number of your secrets (so no one can guess what you're hiding).

This makes the future of digital identity much more practical for everyone, especially for the tiny, secure devices we use to protect our most valuable data.

1. Problem Definition

The paper addresses critical limitations in current Self-Sovereign Identity (SSI) systems, specifically regarding Verifiable Credentials (VCs) and the Selective Disclosure for JWTs (SD-JWT) standard. While SD-JWT allows users to reveal only specific claims (e.g., proving age without revealing an address), it suffers from two major drawbacks:

Linear Storage and Network Growth: In SD-JWT, the credential size grows linearly with the number of claims. The credential must contain a salted hash for every claim, even those not being disclosed. This creates significant storage overhead for the holder and network overhead during transmission.
Privacy Leakage via Metadata: SD-JWT reveals the exact number of claims contained in a credential. This metadata can be exploited by adversaries to perform inference attacks, deducing sensitive information about the holder's hidden data based on the total count of claims.
Resource Constraints: These inefficiencies are particularly problematic for resource-constrained devices (e.g., IoT devices, hardware wallets) where memory and bandwidth are limited (often in the KB range).

2. Methodology: CSD-JWT

The authors propose CSD-JWT, a novel mechanism that replaces the list of salted hashes with a cryptographic accumulator.

Core Concept: Instead of storing individual hashes for every claim, the Issuer aggregates all claims ( $C$ ) into a single, fixed-length accumulator value ( $a$ ) using a trapdoor-based cryptographic accumulator.
Issuance Phase:
- The Issuer computes the accumulator value $a$ from the set of claims.
- For each claim $c_j$ , the Issuer generates a witness ( $w_j$ ) (a proof of inclusion) using the issuer's private key.
- The Issuer provides the Holder with the credential containing $a$ and a Witness-Value Container (WVC) containing pairs of $(c_j, w_j)$ .
Presentation Phase (Selective Disclosure):
- When a Holder wants to disclose a subset of claims ( $\mathcal{C} \subseteq C$ ), they retrieve the corresponding witnesses from the WVC.
- The Holder constructs a Verifiable Presentation (VP) containing the accumulator value $a$ , the subset of claims $\mathcal{C}$ , and their corresponding witnesses $\mathcal{W}$ .
- The Holder signs the VP with their private key.
Verification Phase:
- The Verifier checks the Holder's signature.
- The Verifier uses the Issuer's public key to verify that each disclosed claim $c_j$ is indeed included in the accumulator $a$ using the provided witness $w_j$ .
- Crucially, the Verifier learns nothing about the claims not disclosed, nor the total number of claims in the original credential.

Key Design Features:

Fixed-Size Accumulator: The accumulator value $a$ is constant size (e.g., 256 bits) regardless of whether the credential has 1 claim or 1,000 claims.
Claim Count Hiding: Because the accumulator is a single value, the number of claims in the credential is hidden, preventing inference attacks.
Agnostic Implementation: The design is independent of the specific accumulator algorithm, provided it is trapdoor-based. The authors instantiated it using an ECC-based accumulator (BN254 curve).

3. Key Contributions

Novel Protocol: Proposal of CSD-JWT, a mechanism that achieves compact and selective disclosure by mapping all claims to a fixed-length value.
Enhanced Privacy: By hiding the cardinality of the claim set, CSD-JWT mitigates inference attacks that are possible with SD-JWT (which requires "decoy" digests to hide claim counts, further increasing size).
Resource Efficiency: Significant reduction in storage and network overhead, making it viable for constrained environments like hardware wallets and IoT devices.
Open-Source Implementation: The authors implemented a prototype and made the code publicly available for evaluation.

4. Experimental Results

The authors evaluated CSD-JWT against the state-of-the-art SD-JWT using a 14th Gen Intel i9 for issuer operations and a Nordic nRF52840 (RFC7228 Class-2 constrained device) for holder operations.

Storage Savings:
- CSD-JWT achieves up to 46% memory savings per stored credential compared to SD-JWT.
- The savings increase as the number of claims grows, as SD-JWT stores a hash and salt for every claim, while CSD-JWT stores only one accumulator value.
Network Overhead (VP Size):
- Maximum Privacy (1 claim disclosed out of 100): CSD-JWT produces a Verifiable Presentation 93% smaller than SD-JWT.
- No Privacy (All claims disclosed): Even when all claims are revealed, CSD-JWT is 27% smaller than SD-JWT due to the elimination of the full list of hashes.
Performance:
- Issuance: Issuer overhead is slightly higher than SD-JWT (due to witness generation) but remains in the millisecond range, which is acceptable for powerful issuer servers.
- Holder Operations: Generation of VPs on constrained devices is fast and efficient, with minimal RAM usage (~18%).
- Verification: Verification latency is in the order of milliseconds, meeting the RAIL (Resource Animation Idle Load) model requirements for web responsiveness.

5. Significance

This work is significant for the future of Self-Sovereign Identity (SSI) and the European Digital Identity (EUDI) Wallet regulation, which mandates widespread VC adoption by 2026.

Enabling Constrained Devices: By drastically reducing storage and bandwidth requirements, CSD-JWT makes it feasible to store and manage complex credentials on hardware wallets and IoT devices, which were previously limited by the overhead of existing standards.
Stronger Privacy: It solves the "claim count leakage" problem inherent in SD-JWT without the need for bloated decoy data, offering a more efficient privacy-preserving solution.
Scalability: As users are expected to hold multiple credentials, the cumulative savings in storage and network traffic offered by CSD-JWT will be substantial, improving the overall efficiency of the digital identity ecosystem.

In conclusion, CSD-JWT represents a practical, high-performance evolution of selective disclosure, balancing strong privacy guarantees with the strict resource constraints of modern decentralized identity infrastructure.