Privacy-Preserving Identity: Proving What Matters Without Revealing Everything

For decades, digital identity has followed a remarkably simple philosophy_,_ “Tell me everything about yourself, and I’ll decide whether you may proceed.”

Need to prove you’re over 21?

Here’s my full driver’s license.

Need to verify your employment?

Here’s my entire employee badge.

Need to confirm your university degree?

Have a diploma, student ID, alumni number, favorite professor, and the name of the cafeteria where I survived on stale pizza for four years.

It’s a bit like proving you’re tall enough to ride a roller coaster by handing the attendant your medical records, tax return, and blood type.

Fortunately, we’re finally starting to do better.

The Problem with Traditional Identity

Most identity systems were designed around one simple concept: Present the entire credential.

Whether it’s a driver’s license, passport, employee badge, or digital certificate, the verifier typically receives far more information than they actually need.

Suppose a retailer only needs to know you’re over 21.

Your driver’s license also reveals:

• Your full name
• Date of birth
• Home address
• Driver’s license number
• Height
• Weight
• Eye color
• Signature
• Photograph

That’s a lot of personal information just to buy a bottle of wine.

In the physical world, we’ve accepted this inconvenience because plastic cards don’t selectively hide information very well.

Digital credentials, however, have no such limitation.

The Principle of Data Minimization

One of the fundamental principles of modern privacy regulations is data minimization.

Organizations should collect only the information necessary to complete the transaction.

Not everything they migh_t_ find useful someday.

Privacy-preserving identity systems embrace this philosophy.

Instead of revealing an entire identity document, they allow users to disclose only the specific claims required.

Examples include:

• “Over 18”
• “Licensed physician”
• “Current employee”
• “Resident of Canada”
• “Graduate of XYZ University”

Without revealing dozens of unrelated attributes.

Verifiable Credentials

Modern privacy-preserving identity systems often revolve around Verifiable Credentials (VCs).

A credential is digitally signed by a trusted issuer.

Examples include:

• Governments
• Universities
• Employers
• Banks
• Professional organizations

The issuer signs the credential once.

The holder stores it in a digital wallet.

Later, the holder can present proof of selected information to a verifier.

Unlike traditional identity systems, the issuer does not need to participate in every transaction.

Selective Disclosure

This is where things become interesting.

Rather than presenting an entire credential, selective disclosure allows the holder to reveal only certain claims.

Suppose your digital driver’s license contains:

• Name
• Address
• Date of birth
• License class
• Expiration date

A liquor store might receive only:

Over 21 = True

Nothing else.

Not your address.

Not your birthday.

Not your license number.

Not even your name.

The verifier learns exactly what they need — and nothing more.

This is Selective Disclosure.

Zero-Knowledge Proofs

Some systems go even further.

Using Zero-Knowledge Proofs, it becomes possible to prove statements such as:

• I am over 18.
• I possess a valid government-issued credential.
• My credential has not expired.
• I belong to this organization.

…without revealing the underlying values that make those statements true.

Mathematically, the verifier gains confidence in the truth of the claim without learning the secret itself.

It’s one of those ideas that initially sounds impossible until you realize the cryptography is doing an extraordinary amount of heavy lifting behind the scenes.

Pairwise Identifiers

Another privacy improvement is the use of pairwise identifiers**.**

Traditional identity systems often reuse the same identifier everywhere.

Customer #12345.

Employee #98765.

National ID #ABC123.

This makes correlation trivial.

Privacy-preserving systems instead generate different identifiers for different organizations.

Your bank, employer, university, and healthcare provider each see a unique identifier.

None can easily determine that you’re the same individual without your cooperation.

Cryptography Replaces Trust

Historically, many identity systems relied on trust relationships between organizations.

Privacy-preserving identity replaces much of that trust with cryptographic verification.

Instead of asking, “Do I trust the issuer?”

The verifier asks_,_ “Can I verify the issuer’s digital signature?”

Instead of calling the issuing organization every time a credential is presented, the verifier performs local cryptographic verification.

The result is:

• Better privacy
• Faster verification
• Reduced infrastructure
• Improved scalability

The Standards Ecosystem

Several modern standards contribute to this vision.

SD-JWT VC

Selective Disclosure JSON Web Token Verifiable Credentials allow individual claims to be disclosed while keeping the remainder hidden.

BBS-2023

BBS Signatures support selective disclosure and advanced zero-knowledge proofs with a single signature over many claims.

Unlike traditional digital signatures, BBS signatures are specifically designed to allow portions of a credential to remain hidden while preserving cryptographic integrity.

OpenID for Verifiable Credential Issuance (OID4VCI)

Defines how wallets obtain credentials from issuers.

OpenID for Verifiable Presentations (OID4VP)

Defines how wallets present credentials to verifiers.

Status Lists

Credentials occasionally need to be revoked.

Modern status list specifications allow verifiers to determine whether a credential remains valid without requiring the issuer to observe every presentation.

This is a subtle but important privacy improvement.

Digital Wallets

The user’s wallet becomes the center of the ecosystem.

Rather than organizations maintaining dozens of copies of your identity information, the wallet stores credentials locally.

The holder decides:

• Which credential to present
• Which claims to disclose
• Which verifier receives them
• Whether to proceed at all

Control shifts from centralized identity providers back to the individual.

Privacy Isn’t Secrecy

One misconception is that privacy-preserving identity somehow prevents organizations from learning anything.

It doesn’t.

Organizations still receive the information they legitimately require.

The difference is that they don’t receive everything else.

A pharmacy still learns that you’re authorized to receive a prescription.

An employer still verifies your professional certification.

A border crossing still validates your travel documents.

The transaction still succeeds.

It simply exposes far less unnecessary personal information.

Summary

Privacy-preserving identity isn’t about hiding who you are.

It’s about giving you control over how much of yourself you reveal.

For decades, digital identity systems have operated on an all-or-nothing model. If you wanted to prove one fact, you often had to surrender many others. Modern cryptography offers a better alternative — one where trust comes from mathematical proofs instead of excessive data collection, and where users disclose only what’s necessary for the task at hand.

As governments, financial institutions, employers, and online services increasingly adopt verifiable credentials, selective disclosure, and privacy-enhancing cryptography, we’re beginning to move toward an internet where identity is no longer synonymous with surveillance.

That’s a future worth building — not because we have something to hide, but because we should have the freedom to share only what matters.

Notes

• AI / GenAI / ChatGPT / etc were not used to generate the text of this article.
• ChatGPT was used to generate the images.
• I used em dashes in my writing before the current GenAI wave was a thing. Not planning on changing now.
• Names have been changed to protect the guilty.
• None of the hostnames or users used in examples actually exist.
• Feel free to post any comments or suggestions below.