Skip to content

Claim Certificate or Verifiable Credential

Portable attestation artifact — instantiates Role-Scoped Disclosure Minimization

Packages a single attested fact — 'over 21', 'currently licensed', 'in good standing' — as a portable, cryptographically-verifiable credential the holder presents in place of the underlying record, and that can expire or be revoked.

Claim Certificate or Verifiable Credential reduces a disclosure to a single attested predicate that the subject carries and presents on their own behalf. An issuer vouches for a claim drawn from a defined catalog — "over 21," "licensed to drive," "employed here," "account in good standing" — signs it, and hands the holder a credential. The holder then shows that credential to any verifier, who confirms it cryptographically without ever contacting or seeing the source record. The one idea that makes it this mechanism and not its siblings: the minimized fact becomes a portable, independently-verifiable artifact, issued once and reusable, that decouples the verifier from the source entirely — no live query, no record access, just a signature to check and a revocation status to consult.

Example

A patron wants to buy a drink. The physical driver's licence they would otherwise hand over reveals full name, home address, exact birthdate, and licence number — a pile of surplus for a question that is really just yes or no, over 21? Instead they present a mobile driving licence, a verifiable credential on their phone, that discloses only the attested attribute age_over_21 = true together with the issuing authority's signature. The door scanner checks that signature against the issuer's public key, confirms the credential has not expired or been revoked, and lets them in — having learned neither the birthdate nor the address, and without pinging the motor-vehicle agency at all.

If the phone is lost, the holder reports it and the credential's status flips to revoked on the issuer's status list, so the stale credential stops verifying the next time it is presented. The venue keeps no record it did not need; the agency was never in the loop at scan time; and the only fact that crossed the counter was the one the transaction actually required.

How it works

An issuer attests a claim from a published catalog of things it is willing to vouch for, signs it, and issues the credential to the holder. From then on the holder presents it and any verifier checks it offline against the issuer's public key and a revocation or status list — the source system need not be online or even aware of the transaction. Selective disclosure lets the holder reveal one claim from a credential that could attest several, and predicate proofs can answer "over 21?" from an underlying birthdate without exposing the date itself. What distinguishes it from a live answer is portability and reuse: the credential is minted once and travels with the subject, rather than being computed fresh by the source on each request.

Tuning parameters

  • Claim granularity — a coarse predicate ("over 21") vs. a precise value ("age 34"). Coarser discloses less but answers fewer downstream questions from the same credential.
  • Issuance-time vs. presentation-time derivation — pre-mint fixed claims, or derive a predicate at presentation with a range/zero-knowledge proof. Presentation-time proofs disclose the least but cost real cryptographic complexity.
  • Validity window — how long a credential is trusted before re-issue. Shorter windows limit stale claims but burden the holder with renewals.
  • Revocation mechanism — a status list, short-lived credentials, or none. This sets how quickly a compromised or outdated claim can actually be pulled out of circulation.
  • Correlation resistance — reuse one credential everywhere (linkable across verifiers) vs. single-use or unlinkable presentations. More unlinkability, more machinery.

When it helps, and when it misleads

Its strength is decoupling: the verifier needs neither the source record nor a live connection to it, and the disclosure shrinks to the single predicate the interaction requires — reusable, offline-checkable, and held by the subject rather than pooled at the verifier.

It misleads when the credential outlives its truth or reveals more than its face. A claim is only as trustworthy as its issuer and only as fresh as its revocation path, so a fact that was true at issuance can go stale before the revocation catches up. The same credential presented across many contexts becomes a correlation handle — a privacy leak of a different shape than surplus fields. And an over-broad claim schema quietly re-imports the surplus the credential was meant to shed. The classic misuse is bundling more into the credential "for convenience" than any verifier needs, or minting a claim the issuer cannot actually stand behind. The discipline is to attest the narrowest claim that answers the question, keep a working revocation path, and prefer selective-disclosure or predicate presentations[1] over handing over a richer credential than the moment calls for.

How it implements the components

  • derived_claim_catalog — the set of attestable claims an issuer will vouch for is a catalog of derived claims; this mechanism defines that schema and issues credentials from it.
  • retention_and_revocation_rule — the credential carries an expiry and a revocation/status mechanism, governing how long a disclosed claim stays valid and how a compromised or outdated one is withdrawn from circulation.

It does not classify what in the source is sensitive (Data Loss Prevention Policy) or shape a record's fields over an API (API Response Projection); and unlike Derived Eligibility or Status Answer — which computes an answer live against the source on each query — it mints a portable artifact the holder reuses, so the two are complementary ways to disclose only a derived fact.

Notes

The trust boundary moves rather than disappears: the verifier stops trusting (and storing) the underlying record and starts trusting the issuer. That is usually a good trade — one attested predicate instead of a pile of surplus — but it means the issuer's rigor and its revocation discipline become the load-bearing parts, and a credential from a careless issuer is worse than useless because it looks verified.

References

[1] A verifiable credential is a tamper-evident, cryptographically-signed attestation a holder can present and a verifier can check against the issuer's key — as in the W3C Verifiable Credentials data model. Selective-disclosure formats such as the ISO/IEC 18013-5 mobile driving licence let the holder reveal a single attribute like "over 21" without exposing the rest of the record. ↩