Link Secret

A Link Secret is a private, cryptographically generated piece of data, such as a large random number, that acts as a holder's personal key to a set of verifiable credentials. It is the critical binding element that proves a credential belongs to a specific holder without revealing their identity. The holder never discloses the link secret itself; instead, they use it to generate zero-knowledge proofs that demonstrate possession of linked credentials. This mechanism is central to privacy-preserving identity systems like those built on the W3C Verifiable Credentials data model and implemented in protocols such as AnonCreds.

The core function of a link secret is to enable selective disclosure. When a verifier requests specific claims (e.g., "prove you are over 21"), the holder can use their link secret to generate a proof that satisfies the request without revealing the underlying credential in full or exposing other, unrelated attributes. This process relies on blinding signatures and cryptographic commitments. The link secret is mathematically linked to each issued credential during the creation of a credential offer, creating an unforgeable bond that only the legitimate holder can prove.

From a security perspective, the link secret must be generated and stored securely by the credential holder, typically within a digital wallet. Its compromise would allow an attacker to falsely prove possession of all linked credentials. In implementation, systems like Hyperledger Indy's AnonCreds use link secrets as the master secret (ms) within a CL-Signature scheme. This design ensures unlinkability across different presentations, meaning multiple proofs generated with the same link secret cannot be correlated by verifiers, providing strong user privacy.

The concept is analogous to a private key that signs transactions, but it is used exclusively for proving credential ownership. It is distinct from a Decentralized Identifier (DID); a DID is a public identifier, while a link secret is the private counterpart that authorizes the use of credentials associated with that DID. Proper management of the link secret is therefore the cornerstone of self-sovereign identity (SSI), granting individuals true control over their digital attestations without reliance on centralized databases.

A link secret is a private, cryptographically generated value, such as a random number, held exclusively by the holder of a verifiable credential (VC). Its primary function is to enable selective disclosure within zero-knowledge proofs (ZKPs), allowing a user to prove they possess certain credential attributes without revealing the credential's unique identifier or other sensitive data. This mechanism is a cornerstone of privacy-preserving identity systems, preventing the unwanted correlation of a user's activities across different verifiers and services.

The link secret is used to create a cryptographic commitment, often called a link secret commitment, which is embedded within the credential during its issuance. When a user later needs to present proof, they can generate a verifiable presentation that includes a ZK proof. This proof demonstrates knowledge of the link secret corresponding to the public commitment, without disclosing the secret itself. This process binds the presentation to the original credential issuer's signature, proving the credential's authenticity, while the actual data revealed is controlled by the holder.

A practical example is proving you are over 18 to access a service. Your digital driver's license VC contains your birth date and a unique identifier cryptographically linked to your link secret. You can generate a proof stating "I am over 18" and that you hold a valid credential from the DMV. The verifier confirms the proof's validity and the issuer's signature but learns nothing about your exact birth date, name, or credential ID, preventing them from tracking you. This is a key feature of W3C Verifiable Credentials implementations using BBS+ signatures or similar ZKP-capable schemes.

The security of the entire system depends on the link secret's confidentiality. If compromised, an attacker could impersonate the credential holder or create linkable presentations, breaking privacy guarantees. Therefore, it must be generated securely, stored in a secure element or wallet, and never shared. The link secret is distinct from, but can be derived alongside, other cryptographic keys used for signing or authentication, forming a layered approach to decentralized identity and data minimization.

A link secret is a cryptographically secure, random value known only to the credential holder, which serves as a shared secret between the issuer and the holder to enable selective disclosure and prevent unauthorized linking of credential presentations. It is a critical component in zero-knowledge proof (ZKP) systems like those defined in the W3C Verifiable Credentials Data Model, acting as a private anchor point. During issuance, the issuer cryptographically binds this secret into the credential. Later, during verification, the holder can prove knowledge of the same secret without revealing it, demonstrating legitimate ownership of multiple credentials from different issuers without allowing those issuers or verifiers to correlate the holder's activities.

The primary function of the link secret is to enforce unlinkability across different credential presentations. When a holder presents proofs derived from multiple credentials—such as a university diploma and a government ID—they can use the same link secret in each proof. The verifier can cryptographically confirm that the same secret is present in all proofs, establishing that the credentials belong to the same entity, but the secret itself remains hidden. Crucially, neither the original issuers nor other verifiers can use this secret to link the holder's transactions or presentations across different sessions or contexts, preserving privacy. This mechanism prevents the creation of a global identifier while still allowing for necessary correlation under the holder's control.

From a technical perspective, the link secret is typically implemented as a large random integer or a point on an elliptic curve. In BBS+ signatures and other ZKP-friendly schemes, the secret is embedded as a committed value within the credential's signature. The holder's wallet securely stores this secret, often deriving it from a seed phrase. During a presentation, the prover (holder) generates a proof that demonstrates knowledge of the secret and its correct binding to the presented attributes, without the secret itself being transmitted. This process, integral to blinded signatures and anonymous credentials, ensures that credential presentations are minimal, selective, and privacy-preserving by default.