Why Decentralized Identifiers (DIDs) Are Pointless Without ZK Proofs

DIDs are public correlation vectors. A DID anchored on Ethereum or Solana is a persistent identifier. Every transaction, attestation, or credential presentation links back to it, creating a comprehensive activity graph.

W3C standards are privacy-blind. The W3C Verifiable Credentials data model defines data formats, not privacy guarantees. Publishing a credential hash or selective disclosure on-chain without ZKPs leaks metadata.

Private credentials require private verification. Systems like Iden3's zk-proof circuits or Polygon ID allow credential validity proofs without revealing the credential or holder's DID. This is the only viable model.

Evidence: The Ethereum Attestation Service (EAS) stores all schema and attestation data on-chain. Without ZK rollups like Aztec, this creates a permanent public registry of personal linkages.

DIDs leak by default. A DID on a public ledger like Ethereum or Solana is a permanent, transparent record of all your attestations and interactions. This creates a global correlation database for anyone to analyze, defeating privacy.

ZKPs enable selective disclosure. Protocols like Sismo and Polygon ID use ZK to prove credential validity (e.g., citizenship, KYC) without revealing the underlying data. This separates identity verification from data exposure.

Without ZK, DIDs are worse than Web2. A centralized database at least has a perimeter. A public DID graph has none, enabling unprecedented surveillance by advertisers, governments, or malicious actors.

Evidence: The Worldcoin model highlights the flaw—storing biometric hashes on-chain creates immutable, linkable identifiers, a permanent privacy liability that ZK-native designs avoid.

DIDs are just pointers. A Decentralized Identifier (DID) on a blockchain like Ethereum or Solana is a public key. It links to a DID Document, a static JSON file listing your credentials. This creates a publicly linkable identity graph, defeating the purpose of privacy-centric identity systems.

ZKPs enable selective disclosure. Zero-knowledge proofs, as implemented by protocols like Sismo and Polygon ID, transform static DIDs. They allow a user to prove credential attributes (e.g., 'over 18', 'KYC'd by Civic') without revealing the credential itself or the DID. The proof is the credential.

Without ZK, DIDs regress to Web2. A DID that must broadcast its entire attestation history for verification is a publicly auditable dossier. This is worse than a traditional database, as it's immutable and globally accessible. Projects like Worldcoin demonstrate the necessity of ZK for proving humanness without biometric exposure.

Evidence: The W3C Verifiable Credentials data model, the standard for DIDs, explicitly defines a 'Zero-Knowledge Proof' proof format. The technical specification mandates ZK for privacy, making it a core dependency, not an optional add-on.

Public revocation lists leak data. A global, on-chain list of invalidated credentials reveals user activity patterns and affiliation changes, creating a permanent privacy leak that contradicts the core promise of self-sovereign identity.

ZK proofs enable private revocation. Systems like Iden3's credential revocation or Sismo's zero-knowledge attestations allow a user to prove a credential is valid without revealing its identifier, eliminating the need for a public deny-list entirely.

The scalability argument is a red herring. Maintaining and checking a global revocation registry, as proposed by W3C's StatusList2021, creates a centralized bottleneck and on-chain overhead that ZK-based selective disclosure avoids.

Evidence: The Ethereum Attestation Service (EAS) schema registry shows most attestations are for non-revokable, static data; complex, stateful credentials requiring revocation are a niche that ZK proofs like those from RISC Zero or Succinct are built to handle privately.