SD-JWT VC
SD-JWT VC is an IETF format for verifiable credentials in which the issuer signs hashes and the holder selectively discloses individual claims.
Every disclosed claim is a disclosure whose hash must appear in the signed part. A disclosure that is not referenced there makes the credential invalid. For mandates, the format allows disclosing the scope while withholding personal details.
Example
A mandate as an SD-JWT VC consists of a signed core, several disclosures and optionally a key binding JWT. The agent presents only the necessary disclosures and uses the key binding JWT to prove it is the rightful holder.
How it differs
A plain JWT reveals all details. SD-JWT VC allows selective disclosure and binds the credential to a holder key. The W3C data model for verifiable credentials is an alternative with a different encoding.
In practice
- Use a clear type (vct) for each kind of credential, separately for mandates and agent passports. This lets a verifying party distinguish formats unambiguously.
- Require a key binding JWT with recipient and time on presentation, so an intercepted credential cannot be reused by third parties.
- Disclose only the disclosures the verification needs; all other details stay hidden and are still protected by the signature.
Role in KYA
KYA verifies SD-JWT VC in full: signature, disclosures, key binding, validity, scope, revocation and delegation. The format is the basis for mandates and agent passports in the verification profile.
Related check: Cryptographic integrity (cryptographic_integrity). Are signatures, disclosures, hash chains and manifest unchanged?
Frequently asked questions
What is SD-JWT VC?
An IETF format for digital credentials based on JSON Web Tokens, with selective disclosure and optional binding to a holder key.
Where is SD-JWT VC used?
Among others in the Swiss e-ID, the European EUDI wallet and in approaches to agent payments such as Verifiable Intent.
How does SD-JWT VC differ from a regular JWT?
A regular JWT always shows all details. SD-JWT VC contains only hash values of the details, which can be disclosed one by one.
Is SD-JWT VC a finished standard?
SD-JWT VC is being developed in the IETF and is already used in government wallets and payment approaches. Its underlying building blocks, such as JWS, have been standardized for years.
Can KYA verify SD-JWT VC without internet access?
Yes. Verification runs entirely in the browser or in the engine. The verifying party provides the issuer's keys and status lists in advance; no data is transmitted.