What is selective disclosure, and what makes it technically difficult?

Selective disclosure lets the holder of issuer-signed data reveal only part of it; the difficulty is that the verifier must still be able to check the integrity and authenticity of the part that was revealed.

Selective disclosure is how the principle of minimal disclosure becomes reality: to prove you are allowed to buy wine, you show your age-related claim, not your name, address and ID number.

Why it is hard: an ordinary digital signature covers the whole signed document. If the holder deletes the address from a signed credential, the signature no longer matches and the verifier cannot tell an honest omission from a forgery. So the signature has to be built in a way that still verifies when some parts are missing. The three ways to do that are covered in the next card.

There is one hard limit: the holder can only hide data that the verifier marked as optional or did not request. If the verifier requires a field, leaving it out means the presentation does not satisfy the request.

Go deeper:

• RFC 9901: Selective Disclosure for JSON Web Tokens — the introduction motivates exactly this problem before solving it.