SD-JWT ZKSD-JWT ZK

Appearance

Zero Knowledge privacy for selective disclosure.

SD-JWT ZK is a privacy-preserving cryptographic component for digital identity. It hides bounded witness data and supports rerandomized selective-disclosure proofs, while disclosed values and public policy can still link presentations.

Get started Understand the proof

V1.0.0 Bounded relation · Typed API · Fail-closed verification

  1. Challenge

    Public policy. The relying party fixes the issuer key, audience, purpose, nonce, time window, mode, claim policy, and optional revocation-list snapshot.

  2. Prove

    Private witness. The wallet opens exactly two scalar disclosures and proves the requested bearer or holder-bound relation without putting private witness material on the command line.

  3. Verify

    Closed result. The relying party checks the canonical envelope, applies local policy, and consumes the nonce only after every check succeeds.

The proof is narrow on purpose.

SD-JWT ZK gives applications one inspectable relation instead of an open-ended credential system. The relying party remains responsible for authorization.

Established inside the proof

  • An exact configured P-256 issuer key signed the credential.
  • Exactly two bounded scalar disclosures open signed _sd values.
  • The configured claim relation is true.
  • Holder mode proves the bounded KB-JWT relation and key possession.
  • An optional revocation check proves private VALID membership under the selected root.

Remains outside the proof

  • Issuer-key governance and application authorization.
  • Wallet key custody and durable replay storage.
  • Snapshot authenticity, rotation, rollback, and availability.
  • Privacy policy for public disclosed values and linkable cohorts.

Follow the relation from request to decision.

Each stage has one owner, one bounded job, and a failure boundary that stays visible.

  1. Challenge

    Public policy. The relying party fixes the issuer key, audience, purpose, nonce, time window, mode, claim policy, and optional revocation-list snapshot.

    Read the protocol

  2. Prove

    Private witness. The wallet opens exactly two scalar disclosures and proves the requested bearer or holder-bound relation without putting private witness material on the command line.

    Open the relation

  3. Verify

    Closed result. The relying party checks the canonical envelope, applies local policy, and consumes the nonce only after every check succeeds.

    Review the API

Measured proof costs, attached to the release.

These are medians from the raw v1.0.0 release samples, not targets or guarantees. Compare every shipped operation and inspect what makes up each proof envelope.

Runner
AMD EPYC 9V74 80-Core Processor
Samples
2 per operation
Recorded
Aug 31, 2026
Source
Raw JSON

Bearer + revocation

Exact-key bearer presentation with a private revocation check.

881.4 KiB proof envelope
OperationWall timeEnvelope
Prove
Wall time6.43 s6,378–6,478 ms
Envelope881.4 KiB880.9 KiB–881.8 KiB
Rerandomize
Wall time4.19 s4,190–4,195 ms
Envelope881.4 KiB880.9 KiB–881.8 KiB
Verify
Wall time2.64 s2,634–2,646 ms
Envelope881.4 KiB880.9 KiB–881.8 KiB
Presentation
641.8 KiB
Revocation
239.5 KiB

Holder-bound

Exact-key credential, key-binding, and revocation proofs.

632.9 KiB proof envelope
OperationWall timeEnvelope
Prove
Wall time8.95 s8,870–9,021 ms
Envelope632.9 KiB632.4 KiB–633.3 KiB
Verify
Wall time4.01 s4,008–4,014 ms
Envelope632.9 KiB632.4 KiB–633.3 KiB
Credential
251.4 KiB
Key binding
142.2 KiB
Revocation
239.3 KiB

Descriptive wall-clock observations; not performance thresholds or release promises.

How to reproduce them

Choose the path that matches your work.

Evidence ships with the source.

The normative protocol, bounded vectors, binding matrices, parser mutations, sanitizer lane, and reproducible benchmark reports are live, generated directly in continuous integration builds. Semantic versioning is used to signal changes through future releases.

Review release assurance
Protocol
spec/sd-jwt-zk-v1.md
Vectors
fixtures/compact-vectors.json
Binding audit
spec/reduced-binding-matrix.json
Benchmarks
Raw CSV, JSON, and Markdown per release

Start with the boundary. Then build.

Read what SD-JWT ZK proves and what it deliberately leaves out before integrating the library.

What it proves Unsupported features
Powered by the Longfellow-ZK community forkExplore Longfellow-ZK
Longfellow-ZK — Zero Knowledge for EUDI
Made with ♥ in Europe
with support by PACESETTERS (EU grant 101132610)
and the Plan-₿ Foundation in Lugano