What is key binding in SD-JWT, and why is it needed?

Key binding ties the SD-JWT to the holder's public key, so at presentation time the holder must prove possession of the matching private key, usually by signing a Key Binding JWT.

Without key binding, an SD-JWT is a bearer token: whoever has a copy of the token and its disclosures can present it. A stolen or intercepted presentation could simply be replayed.

With key binding:

• At issuance, the issuer puts the holder's public key inside the signed SD-JWT.
• At presentation, the holder adds a Key Binding JWT signed with the corresponding private key, typically covering a nonce and the verifier's identity, so it is valid only for this verifier and this moment.
• The verifier checks that signature with the public key from the SD-JWT.

The mechanism is optional in SD-JWT, but any credential used for identification (like an E-ID) needs it; otherwise "presenting" a credential would prove only that you have a copy of it.

Go deeper:

• RFC 9901: Key Binding JWT — the claims (nonce, audience, hash of the presentation) that make a presentation non-replayable.