Selective disclosure
Selective disclosure is a credential privacy technique that lets a holder reveal chosen fields while withholding the rest. A verifier can still confirm that each disclosed field came from the issuer and was not altered.
What is selective disclosure?
A digital credential can contain many attributes, such as a name, address, birth date, portrait, and age-over indicator. Selective disclosure lets the holder or wallet send a requested subset instead of the entire credential. Cryptography keeps those returned attributes verifiable against the issuer's signature. The W3C Verifiable Credential Data Integrity specification describes the same outcome for previously signed messages. This minimizes what is shared, but it does not transform a revealed value or prove a new fact about it.
How SD-JWT selective disclosure works
In SD-JWT (RFC 9901), the issuer replaces each selectively disclosable claim with a digest inside the signed JWT. A separate Disclosure contains a random salt and the cleartext claim value; for object properties, it also contains the claim name. At presentation time, the holder sends the signed JWT plus only the selected Disclosures. The verifier hashes each Disclosure and matches it to a digest in the signed payload. Omitted Disclosures remain hidden. The profile can also require some claims to remain visible, so the issuer and credential design determine what the holder can withhold. These mechanics ship in SD-JWT-based verifiable credentials today.
How mdoc and mobile driver's licenses disclose fields
An mDL built to ISO/IEC 18013-5:2021 organizes issuer-signed data into namespaces and individual elements. The Mobile Security Object carries digests for those elements, and the issuer signs it. A reader request names the elements it wants; the wallet returns the selected values, and the verifier recomputes their digests, checks the issuer signature, and validates device authentication. See ISO/IEC 18013-5 and OpenID4VP for the credential and online presentation layers. A credential can contain an age-over element, but if a verifier requests the birth date, the wallet reveals the actual date. Selective disclosure does not derive an age threshold from that date.
What selective disclosure does and does not hide
A disclosed field is fully visible to the verifier. Withholding other fields does not hide the issuer, credential type, session metadata, network information, or identifiers embedded in the revealed values. It also does not automatically make presentations anonymous or unlinkable. RFC 9901 section 10.1 explains that disclosed identifiers can correlate a holder and that salted-hash SD-JWT cannot protect against a verifier sharing the presented credential with its issuer. Credential reuse, validation callbacks, and retained presentation data all affect linkability. Selective disclosure is therefore one privacy control, alongside minimal requests, limited retention, and careful protocol design.
Selective disclosure vs zero-knowledge proofs
Selective disclosure answers which signed fields the verifier may see. A zero-knowledge proof can instead prove a predicate without revealing the source value. Showing a signed age-over-21 field is selective disclosure of an issuer-provided field. Proving that age is at least 21 from a birth date without revealing that date is a predicate proof. Some selective-disclosure cryptosuites use zero-knowledge techniques internally, so the categories can overlap, but the practical question is what the verifier learns: an exact field or only the truth of a statement.
How Stile uses selective disclosure
Stile's current wallet flow requests explicit mdoc elements, verifies device authentication for the presentation, and returns a signed verification result. Selective disclosure limits each wallet response to the requested elements; any element disclosed for the check remains visible to Stile.
See digital ID verification