Summary

  • RFC 9901 lets a Holder present any selected subset of an Issuer's disclosed JWT claims; a matching digest establishes that each presented value belongs to the signed structure.
  • A selected subset is not an exhaustive file, a present-world observation, a universal identity proof or an authorization result. Those are separate questions with separate owners.

The attractive promise of selective disclosure is simple: show the fact a verifier needs and keep the rest private. The dangerous shortcut is equally simple: see a valid disclosed claim, then treat the unshown remainder as though it were known to be empty, negative or irrelevant.

RFC 9901 makes the first promise possible without making the second inference valid. It defines Selectively Disclosable JSON Web Tokens, or SD-JWTs. An Issuer signs a JWT whose payload can contain ordinary cleartext claims and digests of claims intended for selective disclosure. Each disclosure carries a random salt, a claim name when appropriate and a claim value. When a Holder later presents the SD-JWT, it supplies only the disclosures it chooses. A Verifier recomputes each disclosure digest and checks that the digest is in the issuer-signed JWT.

That is a precise result. It tells the Verifier: this disclosed value is the value to which this signed structure commits. It does not say: these are all the values in the credential that matter to the next decision.

The distinction is not a defect. It is the point of the format. RFC 9901 permits the Holder to transmit none, some or all of the issued Disclosures. It permits an Issuer to mix permanently visible claims with selectively disclosable ones. It permits decoy digests so an observer cannot even reliably infer how many hidden claims exist. A protocol that deliberately supports controlled omission cannot also make omission evidence of a negative fact.

Consider the evidence chain as five separate statements. First, the Issuer made a signed claim structure. Second, the Issuer chose which elements could be selectively disclosed. Third, the Holder selected a particular subset for this presentation. Fourth, the Verifier checked issuer signature and digest membership. Fifth, an application may decide whether that validated subset meets its own rule. Collapsing these into one sentence—“the credential proved eligibility”—quietly adds claims the wire protocol did not make.

The issuer's role is especially easy to overread. A signature protects integrity of the signed structure after issuance. It identifies neither a universal meaning for every claim nor the quality, age or scope of the process by which an Issuer came to state it. RFC 7519 defines a JWT as a claims-set format; it does not transform each claim value into an independent observation of current reality. Claim semantics belong to the relevant application and profile. A registered claim name in the IANA registry is a useful common label, not a portable entitlement engine.

The Holder's role is different again. Selective disclosure is holder-controlled presentation. The Holder may reveal a favourable fact to one Verifier and another fact to a different Verifier. That protects privacy, but it means the presentation itself is not an inventory. A missing disclosure might have been unavailable, deliberately withheld, irrelevant to the request, represented by a decoy digest, or never made selectively disclosable. The correct outcome depends on the Verifier's stated requirement.

If a rule needs a complete set of facts, that rule has to request, define and validate the set; it cannot infer completeness from the elegant absence of an extra field.

Optional Key Binding narrows a further gap without erasing the rest. When a Verifier requires it, the Holder presents an SD-JWT+KB. The Key Binding JWT signs a hash of the SD-JWT together with a nonce and audience. This lets the Verifier test possession of the associated private key for that presentation. It is valuable evidence that a present party controls that key in the verifier's chosen challenge context. It is not a finding that the signed claims remain accurate, that every relevant claim was disclosed, or that the relying system should grant a requested outcome.

The absence of enforced Key Binding matters too. RFC 9901 notes that an entity in possession of an SD-JWT can forward it to a third party that does not enforce Key Binding, and can remove disclosures on the way. A received token therefore cannot silently acquire live-presenter or original-audience evidence that its actual validation profile did not require.

The standard is explicit about the parts a safe profile must keep visible. An Issuer must not make selectively disclosable content that is critical to evaluating authenticity or validity; the exact set is application-dependent. A Verifier must validate the issuer signature and must check that each disclosed value actually matches an included digest. RFC 8725 adds the related lesson that JWT validation rules and explicit types are application-specific. These requirements are boundaries, not optional decoration around a generic yes/no badge.

For leaders, this changes how a credential-based control should be described. Do not record merely “SD-JWT verified.” Record the issuer and verification-key policy; the explicit credential type and profile; which claims were required, presented and accepted; whether a missing claim was permitted or a denial condition; whether Key Binding was required and verified; the nonce and audience scope; the policy version that evaluated the presentation; and the action that followed. These are different events. Preserving them separately makes later review possible without converting a privacy feature into a presumption of concealment.

Lu Heng's running-code discipline is useful here only as an analytical constraint. A portable representation is not the same thing as the local decision or the effect that runs afterward. RFC 9901 creates a disciplined way to carry a bounded statement across systems while leaving disclosure choice and decision ownership visible. The standard's restraint is an asset: it permits trust to be attached to evidence with a known scope rather than to a larger story no participant can actually prove.

Sources