Zero-knowledge proof (ZKP)
A zero-knowledge proof (ZKP) is a cryptographic method that lets one party (the prover) convince another (the verifier) that a statement is true without revealing the information that makes it true. In identity verification, that means proving a claim such as being over 18 without disclosing the birth date behind it.
How a zero-knowledge proof works
Every zero-knowledge proof has the same shape. The prover holds a secret, often called the witness, and wants to establish a statement about it. The verifier checks the proof. Both agree in advance on the public inputs: the statement, the proof system parameters, and any issuer keys the check depends on. Three properties define the guarantee. Completeness means an honest prover can always convince the verifier. Soundness means a false statement will not pass. Zero knowledge means the verifier learns nothing about the witness beyond the truth of the statement. NIST and the W3C Verifiable Credentials Data Model 2.0 both define it this way.
A zero-knowledge age verification example
The canonical identity example is an age threshold. A holder carries a credential containing a date of birth, such as an mDL in a phone wallet. Instead of releasing the date, the wallet produces a proof that the statement age is at least 18 holds for a credential signed by a recognized issuer. The verifier learns one bit: this person meets the threshold. It never learns the birth date. That is a real reduction in the personal data a verifier ends up holding. Production wallet designs use non-interactive proofs: the wallet sends a single proof message, with no back-and-forth.
Zero-knowledge proofs vs selective disclosure
These two are frequently conflated. Selective disclosure lets a holder reveal some fields of a credential and withhold the rest. That is how SD-JWT (RFC 9901) and the W3C Data Integrity selective-disclosure suites work, and it is what most shipping wallet flows use today. The difference is granularity. Selective disclosure operates on whole fields, so an age check still hands over a birth date when that is what the credential carries. A zero-knowledge proof can answer a derived question, called a predicate, such as an age threshold, without revealing the underlying field at all.
What a zero-knowledge proof does not guarantee
Zero knowledge is a precise cryptographic property, not a general privacy guarantee. Four limits are worth stating plainly.
- It does not make a presentation anonymous. The protocol carrying it, such as OpenID4VP, the session, the network address, and the attached account all remain visible.
- It does not by itself deliver unlinkability. RFC 9901 section 10.1 is explicit that a reused credential or proof can correlate a holder across verifiers.
- It does not remove metadata such as timestamps and audit records.
- It says nothing about whether the underlying data is true. A proof inherits whatever the issuer asserted.
Where ZKPs stand today: Longfellow and the EU age verification framework
The engineering is moving quickly. Google has open-sourced Longfellow, a zero-knowledge library built on a zk-SNARK, aimed at age assurance over existing mDL credentials, and the EU age-verification technical specification, which sits alongside the eIDAS 2.0 wallet rollout, carries a dedicated ZKP annex. Neither is yet the default path in production wallet ecosystems, where selective disclosure remains the deployed mechanism.
How Stile minimizes identity data
Stile returns a signed eligibility result to the merchant instead of the underlying identity artifacts. Its current wallet flows use selective disclosure; a zero-knowledge proof is a separate cryptographic technique.
See age verification