The Format We Actually Ship Leaves a Trace, and We Would Rather You Knew Which One

Why the format choice reaches the buyer

Credential formats sound like an engineering preference. They are not, because the format decides three things a business cares about: what a verifier receives, whether presentations can be correlated, and which ecosystems will read your credential at all.

A buyer who lets a vendor pick the format silently has delegated a privacy decision.

What the token-based format does well

It is a signed token with fields that can be individually withheld. The holder decides which to reveal; the verifier checks one signature over the whole set and receives only the chosen fields.

It is deployed, widely implemented, and named by the European framework's implementing acts, which matters more than elegance. A format that regulators and wallet vendors already point at is a format your credential can travel through.

It is also simple enough to implement correctly, which is not nothing in cryptography.

The property it does not have, stated plainly

Undisclosed fields still leave a trace in the presentation.

The mechanism works by including a commitment for every field and revealing the values for the disclosed ones. The commitments for the fields you withheld still travel. They do not reveal the values, and they are stable, so unless a credential is used once and discarded, two verifiers comparing presentations have something in common to compare.

That is a correlation handle, and it is a property of the mechanism rather than a flaw in anyone's implementation.

So the honest comparison is not "which is better"

Field hiding and unlinkability are different properties, and this format gives you the first.

If your requirement is that a verifier receives less, this delivers it and is deployed today. If your requirement is that a user cannot be tracked across the businesses they present to, this format does not deliver that, and the mechanism that does is the one whose cryptography we have not had audited.

A vendor that answers "we support selective disclosure" has answered a narrower question than most buyers think they asked.

The mitigation, and its cost

Single-use credentials remove the correlation handle, because a commitment that appears once cannot link two presentations.

The cost is reissuance: the holder needs a fresh credential per presentation, which means contacting the issuer more often, which reintroduces the issuer as a participant in each interaction. You can have the deployed format or issuer blindness, and buying both means paying in reissuance traffic.

That trade is real, it is not ours to solve for you, and a vendor who does not mention it has not thought about your threat model.

What to ask any vendor about format

"Which format do you issue, and what travels for the fields I withhold?" The second half of that question is the one that separates the two mechanisms.

"Can two verifiers who compare notes tell they saw the same credential?" Ask for a yes or no rather than a description of the cryptography.

"Is the format named by the framework I have to satisfy?" Elegance loses to being on the list.

"What is your reissuance story if I need single-use credentials?" This is where the deployed format's privacy gap actually gets closed, and it has an operational cost.

Where this leaves a decision

If your requirement is that a verifier receives only what it needs, in a format the ecosystem and the regulators already read, that is what we issue, it runs today, and the correlation trace above is the thing to weigh rather than a detail we left out.

The audit status of this implementation

The unlinkability implementation described here is unaudited.