Selective Disclosure Approaches in Self-Sovereign Identity: An Experimental Comparison

Abstract

The Self-Sovereign Identity (SSI) paradigm empowers individuals to manage their own credentials by storing them in digital wallets under their full control. In SSI, a credential embeds a list of claims representing personal attributes of the holder, and it is digitally signed by the issuer. When requested, the holder submits some of their credentials to a verifier to prove some of their attributes (e.g., being of legal age). However, to protect their privacy, the holder might want to disclose to the verifier only a subset of the claims embedded in each of the credentials they share, thus requiring a mechanism for hiding the other claims without invalidating the digital signatures of the credentials. This paper surveys the approaches enabling a subject to disclose only selected claims from a signed credential, known as Selective Disclosure. These approaches define the protocol the issuer should follow to construct the credentials, and the holder should follow to disclose only the claims they wish. We examined five approaches, based on: atomic credentials, hashing, encryption, hash trees, and signature, and we compare them from both a qualitative and quantitative point of view. In order to perform an unbiased quantitative evaluation, we developed a reference implementation for each approach, and we assessed their performance in executing the same SSI operations on the same credentials. In particular, we measured the time required to create and verify credentials and presentations, as well as the size they take, varying both the number of claims in the credentials and the percentage of disclosed ones in the presentations. The proposed qualitative and experimental comparison is meant to support application designers in understanding which of the available selective disclosure approach is more convenient for their application scenarios.