BBS-2023: The Digital Signature That Knows When To Keep Its Mouth Shut

Most digital signatures have the subtlety of a foghorn.

You sign a document.

Someone verifies the signature.

They immediately gain access to everything that was signed.

Every field.

Every attribute.

Every detail.

Digital signatures are basically the cryptographic equivalent of handing someone your driver’s license when they ask what year you were born.

Sure, it works, but it feels a little excessive.

Enter BBS-2023, a specification designed to solve exactly this problem.

It enables digital signatures with the ability to prove information was signed without revealing everything that was signed.

Which sounds suspiciously like magic.

Fortunately, it’s just mathematics.

The Problem With Traditional Signatures

Suppose a government issues a digital credential containing:

• Name
• Date of birth
• Address
• Driver’s license number
• Height
• Eye color

A traditional signature protects the entire credential.

Great.

Now imagine a bartender wants to know whether you’re over 21.

With traditional signatures, your choices are often:

1. Reveal everything.
2. Reveal nothing.

Neither option is ideal.

The bartender doesn’t need your address.

The bartender definitely doesn’t need your driver’s license number.

The bartender certainly doesn’t need to know your eye color.

Unless they’re having a very strange evening.

Selective Disclosure

This is where BBS signatures become interesting.

Instead of revealing the entire credential, you can selectively disclose specific attributes.

For example, going back to our earlier discussion, reveal:

• Over 21 = True

But, hide:

• Name
• Address
• Birthdate
• License number

The verifier can still confirm the disclosed information came from a validly signed credential.

This is called Selective Disclosure.

And, it’s one of those ideas that feels obvious once you see it.

Like seat belts.

Or, putting wheels on luggage.

How Is That Possible?

Traditional signatures generally operate on a single blob of data.

Change anything and the signature breaks.

BBS signatures take a different approach.

They sign multiple messages simultaneously.

Conceptually, these:

Message 1Message 2Message 3Message 4...

all become part of a single cryptographic signature.

Later, the holder can reveal only selected messages while proving that the hidden ones were also part of the original signed credential.

This is where cryptographers begin smiling in a way that makes everyone else nervous.

Meet The BBS Signature

BBS stands for Boneh-Boyen-Shacham.

Named after the researchers who developed the underlying signature scheme.

Because, cryptographers either name things after themselves or generate acronyms that resemble license plate numbers.

There is very little middle ground.

The BBS signature scheme is built using pairings on elliptic curves. Elliptic Curve Cryptography has its own problems with Quantum Algorithms, but we discuss that elsewhere.

That last paragraph is guaranteed to make at least half of my audience immediately scroll to the conclusion.

For the rest of us, think of pairings as extremely clever mathematical operations that enable proofs with unusual properties.

One of those properties is selective disclosure.

BBS-2023

BBS signatures have existed for years.

The BBS-2023 specification published by W3C standardizes how they are used in modern digital credentials.

Particularly in ecosystems based on:

• Verifiable Credentials
• Decentralized Identifiers (DIDs)
• Privacy-preserving identity systems

The goal is interoperability.

Because cryptography is difficult enough before every vendor invents their own incompatible implementation.

Actors

The actors are conceptual in this spec, not concrete defined concepts.

The introduction says the cryptographic suite operates within an issuer–holder–verifier model, and it describes four high-level functions:

• Issuer → Sign
• Holder → Verify
• Holder → ProofGen
• Verifier → VerifyProof

That’s a conceptual model describing who invokes which cryptographic primitive — not a network protocol.

Interaction Between Actors

BBS2023 defines:

• BBS signatures
• derived proofs
• selective disclosure
• unlinkability

while another protocol defines:

• issuance
• presentation
• authentication
• transport
• wallet interactions

The same OID4VCI (Issuance Flow) + OID4VP (Presentation Flow) + OIDC (authentication).

Check out my original SD-JWT VC post for a more thorough discussion of these supporting protocols.

The Credential Revolution Nobody Talks About

Imagine proving:

• You’re over 21
• You’re a licensed doctor
• You’re a certified pilot
• You’re a resident of a country

without revealing everything else in the credential.

And, doing it in a standardized way.

That’s the vision behind BBS-2023.

Instead of sharing:

Name: Alice SmithDOB: 1990-01-01Address: 123 Main StreetLicense Number: X123456

you might simply prove:

Age >= 21

and nothing more.

Data minimization suddenly becomes a built-in feature.

Privacy advocates, generally, respond to this idea by hugging nearby whiteboards.

The Zero-Knowledge Connection

BBS signatures are often used alongside Zero-Knowledge Proof techniques.

The holder can generate a proof that says_,_ “This statement came from a valid credential.” without revealing unrelated information.

The verifier gains confidence.

The holder retains privacy.

Everyone wins.

Except perhaps data brokers. Tragic.

Why Organizations Care

BBS-2023 addresses several real-world problems:

Privacy

Organizations receive only the information they actually need.

A revolutionary concept.

Compliance

Many privacy regulations encourage minimizing data collection.

BBS-based credentials naturally support this.

Reduced Data Exposure

If sensitive fields are never shared, they cannot be leaked.

Cybersecurity professionals tend to appreciate this feature.

User Control

Users gain more control over what information they reveal.

Which is generally considered preferable to the traditional internet model of “Please upload your entire life story.”

The Mathematics Under The Hood

The underlying mathematics involves:

• Elliptic Curve Cryptography
• Bilinear pairings
• Zero-knowledge proofs
• Selective Disclosure proofs

This is the part where most readers wisely decide they have enough information.

And honestly, that’s okay.

You do not need to understand Bilinear Pairings to appreciate the benefits.

In the same way that you do not need to understand jet engine thermodynamics to enjoy air travel.

The Catch

Because there is always a catch.

BBS signatures are more computationally complex than ordinary signatures.

They require:

• Additional cryptographic operations
• More sophisticated verification
• Specialized implementations

Nothing comes for free.

Cryptography operates under the same universal law as engineering_,_ cool features cost something.

Usually, CPU cycles; sometimes, sanity.

BBS-2023, SD-JWT VC, and the European Digital Identity Wallet

One of the more interesting developments in digital identity over the past few years has been the growing conversation around SD-JWT VC and BBS-2023. Both technologies enable selective disclosure, allowing a credential holder to reveal only the information necessary for a transaction rather than exposing an entire credential. They solve many of the same problems — but they arrive there using very different design philosophies.

The European Union’s European Digital Identity Wallet (EUDI Wallet) doesn’t require a single credential format. Instead, the Architecture and Reference Framework defines an interoperable ecosystem capable of supporting multiple credential technologies, including both SD-JWT VC and W3C Verifiable Credentials protected with Data Integrity proofs such as BBS-2023.

So why is BBS-2023 receiving so much attention in Europe?

The answer begins with privacy.

European privacy law has long emphasized data minimization — the principle that organizations should collect and process only the information necessary to complete a transaction. The EUDI Wallet itself is explicitly designed so that users disclose only the attributes required for a particular interaction, such as proving age or nationality without revealing unrelated personal information.

Both SD-JWT VC and BBS-2023 support selective disclosure, but BBS signatures provide an additional capability that many privacy researchers find particularly compelling: unlinkability.

With BBS signatures, every presentation of the same credential can be freshly randomized. Two different verifiers cannot determine whether they were shown the same underlying credential, even if identical claims are disclosed. This greatly reduces the possibility of correlating a person’s activity across multiple services.

By comparison, SD-JWT VC was designed with a different objective. Rather than introducing new cryptographic primitives, it builds on technologies already familiar to the OAuth and OpenID Connect communities — JWTs, JOSE, digital signatures, and cryptographic hashes. This makes SD-JWT VC significantly easier for existing Identity & Access Management platforms to adopt.

In other words:

• SD-JWT VC optimizes for compatibility with today’s identity infrastructure.
• BBS-2023 optimizes for the strongest achievable privacy guarantees.

Neither approach is inherently superior.

Enterprise IAM vendors with extensive JWT infrastructure often find SD-JWT VC to be the more practical choice because it integrates naturally with existing OAuth, OpenID Connect, and API security ecosystems.

Conversely, government identity systems, digital wallets, and privacy-preserving credentials frequently view the additional complexity of BBS signatures as worthwhile in exchange for stronger anonymity and resistance to cross-service tracking.

The most likely outcome is not that one technology replaces the other, but that both coexist. The EUDI Wallet architecture already reflects this philosophy by remaining credential-format agnostic and focusing instead on interoperability, user control, and data minimization.

There is two different engineering philosophies at play here. One says, “Let’s leverage the infrastructure the identity industry already understands.” The other says, “Let’s push cryptographic privacy as far as current mathematics allows.” As digital identity continues to mature, both approaches are likely to play important — and complementary — roles.

Summary

The internet spent decades optimizing for data collection.

BBS-2023 represents a shift toward optimizing for data minimization.

Instead of proving everything, users can prove only what matters.

Instead of revealing identities, users can reveal properties.

Instead of handing over an entire credential, users can reveal a carefully selected subset.

It’s a fundamentally different approach to digital trust.

Most digital signatures behave like photocopiers.

They verify the entire document or nothing at all.

BBS-2023 behaves more like a highly trained lawyer.

It reveals exactly what is necessary and absolutely nothing more.

That’s an incredibly powerful capability in a world increasingly concerned with privacy, surveillance, identity theft, and data breaches.

The underlying mathematics is complicated.

The implementation is challenging.

The cryptographers involved probably had far too much coffee.

But the result is surprisingly elegant:

A digital signature that finally learned the value of discretion.

And on today’s internet, that’s a rare and valuable skill.

Notes

• AI / GenAI / ChatGPT / etc were not used to generate the text of this article.
• ChatGPT was used to generate the images.
• I used em dashes in my writing before the current GenAI wave was a thing. Not planning on changing now.
• Names have been changed to protect the guilty.
• None of the hostnames or users used in examples actually exist.
• Feel free to post any comments or suggestions below.