What is holder binding in SSI?

Holder binding proves that a VC was issued to a specific holder: the holder proves to both issuer and verifier that they know a secret (such as a private key), which the issuer anchored directly or indirectly in the VC.

The problem it solves: a credential is just data. If someone copies it, why shouldn't they be able to present it as their own?

How holder binding works:

1. At issuance, the holder proves to the issuer that they possess a secret, for example a private key or a secret value like the link secret.
2. The issuer anchors that secret in the VC: directly (the public key is written into the credential) or indirectly (a blinded commitment to the secret value).
3. At presentation, the holder proves to the verifier that they still possess the same secret. The verifier checks this against what is anchored in the VC.

So a copied VC is useless without the secret. In practice holder binding is often combined with device binding: the secret is a key kept in the phone's secure hardware.

Go deeper:

• OpenID4VCI: Binding the issued credential — section 8.1 shows how a wallet proves key possession so the issuer can bind the credential.