Cryptography

This is the mathematics underneath selective disclosure: what BBS+, BLS, zero-knowledge proofs and Merkle trees each actually guarantee, and where the guarantee stops. Decades-old, peer-reviewed public-key work, most of it older than the identity industry that now depends on it.

Every entry in this section composes someone else's work. There is no Solidus cryptography. This is decades-old, peer-reviewed public-key mathematics, and the fact that the count is 20-and-zero is the point.

The pieces, and who built them

• Signatures. Ed25519/EdDSA (Daniel J. Bernstein and co-authors, standardised as RFC 8032) signs ordinary messages. BLS signatures (Boneh–Lynn–Shacham, 2001) can be aggregated, a thousand validator signatures compress into one, which is why the consensus layer uses them. Both sit on pairing-based cryptography and the BLS12-381 curve.
• Selective disclosure. A BBS+ signature (Boneh–Boyen–Shacham 2004, extended by Au–Susilo–Mu 2006, wire format specified through IETF and W3C/DIF work) signs a list of messages, so the holder can later prove some of them without revealing the rest. SD-JWT VC is the JOSE-family alternative, using salted-hash disclosure and a disclosure digest instead of zero-knowledge mathematics, simpler, widely tooled, and not unlinkable. Holder binding and KB-JWT are how a presentation proves it came from the credential's actual holder. Predicate proofs let you prove "over 18" without revealing a birthdate.
• Unlinkability. The property that two presentations of the same credential cannot be tied to each other. Correlation handles are the identifiers that destroy it: a reused signature value is one. This is a design property of BBS+ presentations, and in our code it is unverified.
• Structures. Merkle trees and sparse Merkle trees commit to large sets compactly; BLAKE3 is the hash function; k-of-n threshold schemes split a key so no single holder can use it, which is what guardian recovery in the wallet is built from. Seed phrases and HD wallets (BIP-32/39/44) are the standard key-derivation stack.
• Zero-knowledge proofs. The general technique of proving a statement without revealing why it is true. BBS+ presentations are one narrow, practical instance: this section does not claim a general-purpose ZK system, because Solidus does not have one.

What ships, and on what

Six entries are shipped (Ed25519, BLAKE3, SD-JWT VC, BBS+, seed phrase, HD wallet), thirteen are testnet, one is spec. @solidus-network/bbs implements BBS+ and @solidus-network/auth builds selective-disclosure presentation on top of it, both published on npm, both running on a public testnet only. No mainnet, no token, no audit, no paying customer, and this credential format has never been used in a production KYC flow for money.

Proof you can run without trusting us: npm i @solidus-network/auth, the unlinkability demo ships inside the package tarball and executes on your machine.

Where this category ends

What the credential formats mean on the wire is the standards section. Why unlinkability matters to a person rather than a verifier is the privacy section. How aggregated signatures are used to finalise a block is consensus.

The audit status of our own implementation

Solidus's BBS+ implementation is unaudited. An audit is targeted for the second half of 2026, contingent on an NLnet NGI Zero grant that has not been awarded, and the work has not started. Everything written here about unlinkability describes what the design intends, not a verified property of our code. Nobody outside Solidus has reviewed it.