What is the linkability problem with verifiable credentials, and what can solve it?

Unique values in VCs and VPs, above all the signature, appear identically in every presentation, so issuers and verifiers can correlate them and build linked user profiles; only modern multi-message signatures such as BBS achieve unlinkability, and even then the metadata must not be unique either.

* A repeated signature value lets verifiers link users; fresh zero-knowledge proofs do not, as long as the metadata isn't unique either. *

Take an SD-JWT driving licence shown to a car rental on Monday and to a bar on Friday. Both receive the same issuer signature and the same hashes. If the two verifiers (or a verifier and the issuer) compare records, that value is a perfect join key: "the person who rented a car is the person who bought drinks". Selective disclosure hid the address, but the presentations still link.

That conflicts with the minimal-disclosure goal: revealing little is worth less if every reveal can be stitched into a profile.

The fix needs two layers:

• Cryptography: schemes like BBS give each presentation a fresh zero-knowledge proof, so there is no shared value to join on.
• Metadata hygiene: a unique credential ID, an exact issuance timestamp or a revocation index can link presentations just as well as a signature, so these must also be avoided or randomised.

Go deeper:

• W3C BBS Cryptosuites: Privacy considerations — what the BBS cryptosuite can and cannot hide when credentials are presented.