Why can the Swiss E-ID not achieve unlinkability, and what is batch issuance meant to do about it?

It uses SD-JWT with classic ECDSA signatures, so every presentation of a credential carries the same signature and hashes, a stable join key; batch issuance gives the holder many copies of the credential so each copy can be used only once.

With SD-JWT, selective disclosure hides values but not the signature: if the same E-ID is shown to a shop and a hotel, both receive the identical issuer signature over the identical list of hashes. If verifiers combine their logs, those values link the two visits to one person, even when nothing else was disclosed. Modern multi-message signatures (BBS) would avoid this with a fresh zero-knowledge proof per presentation, but they were not yet standardised when the technology was chosen, and phone secure hardware supports ECDSA P-256 rather than BBS.

Batch issuance is the pragmatic workaround: the issuer issues a whole batch of copies of the same credential, each signed separately with different salts. The wallet uses a different copy for each verifier or presentation. Two verifiers then see different signatures and cannot join on them.

The cost: more credentials to issue, store and revoke, and it only helps if the copies really are used once and the metadata (validity dates, status list indexes) does not link them either.

Go deeper:

• OpenID4VCI: Batch credential issuance — the protocol feature, which recommends different keys per copy to achieve unlinkability.