What are the three approaches to selective disclosure, and how do they compare?

Question

Accepted Answer

Atomic attributes (each attribute signed separately), SD-JWT (hashes of the claims signed with a classic signature) and multi-message signatures (which support selective disclosure inherently).

Approach
How it works
Weakness

Atomic attributes
The issuer signs each attribute individually; a VC is a bundle of these separately signed pieces. The holder presents only the pieces needed.
Nothing guarantees that the presented attributes belong together: pieces from two different people's credentials could be mixed.

SD-JWT
A classic signature covers a list of hashes of the claims; the holder reveals only the cleartext of the claims they choose.
The signature and hashes are identical in every presentation, so presentations are linkable.

Multi-message signatures (e.g. BBS)
One signature over many separate messages; the holder derives a zero-knowledge proof revealing any subset.
Newer, more complex cryptography with less mature support.

The progression shows the trade-off: atomic attributes are simple but lose the binding between attributes; SD-JWT keeps the binding and uses established crypto but is linkable; multi-message signatures solve both, at the cost of newer cryptography.
Go deeper:

W3C: Data Integrity BBS Cryptosuites — the multi-message approach and what it adds over hash-based schemes.

Approach	How it works	Weakness
Atomic attributes	The issuer signs each attribute individually; a VC is a bundle of these separately signed pieces. The holder presents only the pieces needed.	Nothing guarantees that the presented attributes belong together: pieces from two different people's credentials could be mixed.
SD-JWT	A classic signature covers a list of hashes of the claims; the holder reveals only the cleartext of the claims they choose.	The signature and hashes are identical in every presentation, so presentations are linkable.
Multi-message signatures (e.g. BBS)	One signature over many separate messages; the holder derives a zero-knowledge proof revealing any subset.	Newer, more complex cryptography with less mature support.