Correlation

Correlation is what happens when separate, individually harmless pieces of information get combined to reveal something none of them revealed alone, including, often, exactly who someone is. The canonical demonstration: Latanya Sweeney showed in 2000 that ZIP code, birth date, and sex (three fields nobody would call "personal data" on their own) together uniquely identify 87% of Americans. No single field crosses a privacy line. Put together, they do.

In identity and credential systems specifically, correlation usually means something narrower but related: can two separate interactions, two purchases, two logins, two credential presentations to two different services, be tied back to the same underlying person, even if neither interaction disclosed anything obviously identifying on its own? If two verifiers who never talk to each other can still tell (or infer with confidence) that they served the same person, that's a correlation, and it's a privacy failure even though no name or document number ever appeared anywhere.

Who actually formalized this

Sweeney's re-identification work is the empirical demonstration that made correlation risk concrete and hard to dismiss. The EU's Article 29 Data Protection Working Party, the body of national data-protection regulators that predates today's European Data Protection Board, turned this into regulatory language in its 2014 Opinion on Anonymisation Techniques, defining three distinct re-identification risks a truly anonymous dataset has to resist: singling out (isolating one record), linkability (connecting two records or events to the same subject, see the Linkability entry), and inference (deducing an attribute with high confidence even without singling anyone out). Correlation, as used in this Lexicon and in cryptographic identity literature, sits closest to linkability, generalized beyond datasets to live interactions. David Chaum's 1981 mix-network paper is the earlier cryptographic root: designing communication systems specifically so that an observer, even one who sees everything, cannot correlate a message's sender with its recipient.

How this shows up in Solidus

Solidus's stated defense against correlation in credential presentations is composed from three pieces documented elsewhere in this Lexicon, not invented fresh here: BBS+ signatures generate a fresh, unlinkable proof per presentation rather than reusing signature bytes; pairwise DIDs derive a different identifier per relationship instead of one global one; and the correlation handle discipline, checking that no ordinary-looking metadata field quietly reintroduces a shared identifier, is what caught and fixed Solidus's own v1 format bug (see that entry for the specific, honest case study).

Say plainly what's true and what isn't: this is unaudited, testnet-only work. And it's scoped to the credential layer specifically: it says nothing about whether two relying parties can correlate a user via IP address, request timing, browser fingerprint, or data they already had from some other source entirely. A credential system can get every cryptographic detail right and a user can still be correlated ten different non-cryptographic ways; naming that boundary honestly is the point of this entry.

Check it yourself

npm i @solidus-network/auth and run the bundled demo/unlinkability-demo.mjs. It issues one credential, presents it twice to two separate relying parties, verifies both, and prints exactly what those two parties would have in common afterward, the actual, checkable correlation surface, not a claim about it.