Benchmarking Selective Disclosure Mechanisms for Verifiable Credentials: A Systematic Comparison for Security and Privacy

In a world where digitalization is reshaping every aspect of our society, digital identity has become more crucial than ever to establish trust and accountability across all entities, whether human, organizational, or machine-based. Numerous initiatives are emerging worldwide, such as the United States’ Mobile Driver’s Licenses (mDLs) and Singapore’s National Digital Identity (NDI). In May 2024, the European Union introduced Regulation 2024/1183, establishing the European Digital Identity Framework. By 2026, this initiative will provide all European citizens with a European Digital Identity Wallet (EUDIW), allowing them to access both online and offline public and private services. The EUDIW empowers individuals to retain full control over their data, allowing them to selectively disclose only the specific information necessary for each interaction. However, the current wallet design relies on Selective Disclosure for JSON Web Token (SD-JWT), which does not fully meet the privacy requirements outlined in the regulation. This paper presents a comprehensive comparison of the main selective disclosure schemes. Specifically, we identify relevant threat models, formalize associated security and privacy properties, and assess the extent to which existing techniques satisfy these properties in mitigating the identified threats. Furthermore, we introduce an open-source benchmark that evaluates selective disclosure mechanisms across key performance indicators, including computational latency, bandwidth consumption, and storage requirements.