SD-JWT-VC

SD-JWT-VC (Selective Disclosure for JWT-based Verifiable Credentials) is a technical specification that defines how to issue and present Verifiable Credentials (VCs) using the JSON Web Token (JWT) format while enabling selective disclosure. This allows a holder to prove specific claims from a credential—such as their age being over 21—without revealing the entire document, their name, or other irrelevant attributes. It combines the established JWT structure with advanced cryptographic techniques like hash-based digests and key binding to create a compact, interoperable, and privacy-enhancing credential format standardized by the W3C and IETF.

The architecture relies on a JSON Web Signature (JWS) that contains disclosed claims and a set of cryptographic digests representing the undisclosed claims. During presentation, the holder discloses only the necessary claims and provides the corresponding digests, allowing the verifier to cryptographically confirm the integrity of the entire original credential without seeing its full contents. A critical security feature is Key Binding, which cryptographically ties the presentation to a specific holder's public key, preventing unauthorized replay of the credential by a different party.

Compared to other VC formats like JSON-LD with BBS+ signatures, SD-JWT-VC offers distinct advantages: it leverages widely adopted JWT libraries, results in smaller payload sizes, and provides simpler cryptographic agility. Its primary use cases include age verification, employer attestations, and KYC proofs where minimizing data exposure is legally or practically required. The format is a core component of emerging digital identity wallets and ecosystems like the European Digital Identity (EUDI) Wallet framework.

SD-JWT-VC stands for Selective Disclosure JSON Web Token Verifiable Credential. This name is a precise technical descriptor formed by concatenating three established concepts. The SD-JWT (Selective Disclosure JWT) component originates from the IETF draft specification for a token format enabling cryptographic hiding of claims. The VC (Verifiable Credential) component is drawn from the W3C's foundational data model for expressing cryptographically verifiable digital credentials. The hyphen signifies their combination into a single, interoperable artifact.

The development of SD-JWT-VC was driven by the need to solve a key limitation of standard JWT-based VCs: all data is transparently visible to every verifier. The selective disclosure mechanism, inspired by earlier cryptographic constructs like CL-signatures and BBS+ signatures, allows a holder to reveal only specific claims from a credential while still providing a valid cryptographic proof for the entire package. This merges the presentation flexibility of advanced signature schemes with the deployment simplicity and widespread library support of the JWT format.

The specification's evolution is a collaborative effort, primarily documented in two IETF drafts: draft-ietf-oauth-selective-disclosure-jwt (defining the core SD-JWT) and draft-terbu-oauth-sd-jwt-vc (profiling it for use with W3C VCs). This origin within the IETF OAuth Working Group underscores its design for internet-scale interoperability and integration with existing OAuth 2.0 and OpenID Connect ecosystems, distinguishing it from credential formats native to specific distributed ledger platforms.

The core mechanism of an SD-JWT-VC is a digitally signed JSON Web Token (JWT) issued by a trusted entity, which contains a set of disclosure digests instead of plaintext claim values. For each claim (e.g., birthdate, address), the issuer creates a cryptographic hash of the claim value combined with a random salt. These digests are included in the JWT, while the actual claim values and their salts are packaged separately as disclosures and given to the holder. This separation ensures the signed JWT remains constant, while the holder controls which disclosures to reveal.

When a holder needs to present the credential, they perform selective disclosure by sending the base JWT along with only the specific disclosure objects for the claims they wish to share. The verifier can then independently re-compute the digest for each provided disclosure and check it against the corresponding digest in the signed JWT. This process cryptographically proves that the revealed data is authentic and unaltered, as it was part of the original issuer-signed payload, without exposing any undisclosed information.

The architecture relies on two key JWT components: the Issuer-signed JWT, which is the constant, signed core containing digests, and the optional Holder Binding JWT, which cryptographically links the credential presentation to a specific holder's key, preventing unauthorized replay. This combination provides a robust system for privacy-preserving verification, enabling use cases like age verification without revealing the exact birthdate or credential sharing with minimal data exposure across decentralized ecosystems.

An SD-JWT-VC (Selective Disclosure JSON Web Token Verifiable Credential) is a structured data object that packages a digitally signed credential with a set of cryptographic digests, enabling the holder to selectively reveal specific claims. It is composed of two primary, linked components: the SD-JWT itself, which contains the issuer's signature and the disclosed claims, and a separate Key Binding JWT (KB-JWT), which is used to cryptographically bind the credential presentation to a specific holder. This structure separates the issuer's attestation from the holder's proof of possession, a core principle of holder-centric identity.

The SD-JWT payload is a JSON object where certain claim values are replaced with cryptographic disclosure digests. For example, a credential containing "name": "Alice", "age": 30, "id_hash": "abc123" might be transformed so that only "name" is in plain text, while "age" and "id_hash" are replaced with their SHA-256 digests. The corresponding disclosures—arrays containing the salt, claim name, and claim value—are sent alongside the SD-JWT but are not signed. The verifier uses these disclosures to recompute the digests and validate which claims were legitimately part of the original, signed credential.

The Key Binding JWT is a critical anti-theft mechanism. When presenting the credential, the holder creates this second JWT, signed with their own private key. It includes a cryptographic hash of the SD-JWT (sd_hash) and a nonce or audience value provided by the verifier to prevent replay attacks. The verifier checks this signature against the holder's public key (often embedded in the SD-JWT) to confirm the presenter is the legitimate holder who controls the required cryptographic keys, fulfilling the key binding requirement.

This layered architecture enables precise data minimization. A holder can present only the digests for non-disclosed claims, proving they could reveal them without actually doing so. The verifier's validation process is methodical: 1) Verify the SD-JWT issuer signature, 2) Recompute digests from provided disclosures to confirm claim integrity, 3) Verify the Key Binding JWT signature and its binding to the SD-JWT. This process ensures the credential is tamper-evident, was issued to the presenter, and that the disclosed data is exactly what the issuer attested.