Selective disclosure

Selective disclosure lets a holder reveal some claims from a credential and withhold the rest, without breaking the issuer's signature.

How it works

The issuer does not sign the claim values directly. It signs digests of them, one per claim, each salted. The wallet keeps the values and releases only the ones it chooses; the verifier recomputes the digests it was given and checks them against the signed set. Withheld claims leave a digest that matches nothing the verifier can read.

Predicates

Stronger still: rather than disclosing a date of birth, a credential can carry an over-18 claim that answers the question without revealing the underlying fact. The verifier learns exactly one bit.

Verifier asks	Holder can release
Are you over 18?	An over-18 attestation, nothing else
Are you licensed to drive a lorry?	The licence category, not the licence number
Do you live in this municipality?	The locality, not the street address

Why it is not optional

A verifier that receives a full identity document has taken on data it did not need and must now protect. Asking narrowly is both a legal obligation under the regulation and the cheaper engineering choice.