Digital Credentials

Selective disclosure is a fundamental technique for data minimization that allows holders to share the minimum required information that is requested by a verifier. Protocols are expected to facilitate selective disclosure by allowing the verifier to specify the exact claims needed.

Unlinkability is a property that ensures that, if a user presents attributes from a credential multiple times, verifiers cannot link these separate presentations to conclude they concern the same user (verifier-verifier linkability), or that verifiers can not collude with issuers to report the exchange of a credential from a wallet to the issuer (verifier-issuer linkability). The former is a property that can be maintained by the wallet and issuer, e.g. through issuing fresh credentials for individual verifiers.

While the latter is achievable, e.g. through Zero-Knowledge Proofs, design choices of the API such as encrypted responses make it impossible for a user agent to prove that verifier-issuer unlinkability was achieved in practice. Nonetheless, protocols are requested to limit linkability wherever possible.

Note that unlinkability is exclusively a consideration for attributes that can not be linked to a specific user identity. Inherently linkable attributes such as names, driver's license numbers or phone numbers do not benefit from unlinkability.

Through the Digital Credentials API, the user agent can help verifiers and wallets exchange unlinkable attributes, but, because of response encryption, it can not guarantee that no linkable information is passed between verifiers and wallets. It is recommended that user agents account for this fact in their user permission experience.

"Phoning home" refers to scenarios where the presentation or verification of a digital credential causes a notification or communication back to the issuer or another central entity, which can lead to tracking and profiling of individuals.

Similar to unlinkability, it is impossible for user agents to ensure that an issuer isn't actively involved in the creation or validation of credential presentations after a user has given permission to proceed with a credential request. From that point on, the wallet application owns this decision. While some wallets can be considered user agents, it is generally recommended that the user agent implementing the Digital Credentials API designs its permission experience to prevent exposure of a request to the wallet application before user confirmation (keeping in mind considerations for integrating multiple cooperating user agents).

Protocols are required to support mechanisms that allow issuers, wallets and verifiers avoid or reduce the dependence on "phone home" mechanisms.

A common instance of issuer involvement in a credential exchange is for credential revocation checks. This is particularly challenging when presentations are intended to be verifier-issuer unlinkable. When credential presentations are made unlinkable through the use of e.g. Zero-Knowledge Proofs, the credential formats used in protocols are expected to support offline revocation methods such as Cryptographic Accumulators. It is further expected that protocol design and specification discourages the involvement of verifiers for the purpose of revocation where possible.

User understanding and participation are non-negotiable properties of a credential exchange. The protocol is expected to help all involved parties enable user participation by providing the information vital for informed permission and/or consent.

Verifier authorization refers to the process by which a verifier proves its identity and demonstrates that it is legitimately entitled to request specific attributes or credentials. This is particularly useful when exchanging sensitive data, such as from government-issued credentials. Verifier authorization can limit unnecessary or abusive credential requests, and ensure that a verifier's access is restricted to the specific credential attributes it registered for.

Checking verifier authorization is usually handled by the wallet, but user agents could find the presence of such a scheme helpful in preventing API abuse and designing a well-informed user permission experience.

To prevent exposure of user information to other parties in "transit", for example browser extensions loaded on verifier pages, and to encourage secure storage of user credentials by the verifier, protocols are required to support and mandate encrypted responses in a credential exchange.

The high value of these credentials to users and attackers means there is a significant risk of theft, and significant potential harm from leakage to unauthorized third parties. This includes the request of government identity for the purpose of tracking and personalization.

A major concern with increased availability of government credentials online is Jevon's Paradox, i.e., the chance of increasing demand for credentials through lower friction of access. This effect is not inherently caused by the Digital Credentials API, and rather the overall increasing adoption of digital credentials across the ecosystem, which, however, would likely see additional momentum from user agent implementation of the Digital Credentials API. As such, the effect needs to be considered by user agents implementing the API, as it might result in harmful outcomes for users:

• Increased risk of information leakage, and ultimately a less trusted user experience on the Web. When a large number of services access and store government-issued credentials in an insecure manner (i.e. not maintaining encryption or failing to safeguard private keys), the chance of data leaks and unauthorized access increases as well. Even seemingly non-identifying information like birthdates and postal codes, when combined, can statistically identify an individual.
• Prompt fatigue and a loss in trust by users when they are prompted by a large number of websites to share personal information.
• Increased potential for surveillance and restrictions on pseudonymous use of online services. Collusion between verifiers and issuers, or other parties, might result in the ability to closely monitor a user's activity on the Web and take adverse action against this individual. Even when no action is taken, the possibility of surveillance alone can cause anxiety, discomfort, and behavioral changes such as inhibition and self-censorship, impacting individual autonomy and freedom of expression.
• Exclusion and discrimination of individuals who cannot, or do not want to, provide these credentials, prohibiting them from participation in services that would previously not require government-issued credentials, such as forums and social media platforms on the Web.

The outlined risks of government-issued digital credentials present a challenge that cannot be solved by a single participant in the ecosystem, and will require a broader policy discussion within individual soverign nations about the risks and benefits of accessing online services through real-world credentials.

It is desirable that a government that issues digital credentials also enact laws and regulations that clearly define how and for what purposes those credentials are able to be used. All parties involved in the exchange, whether they are legally obliged to do so or not, are advised to support any government verifier authentication schemes, if they exist. The support for (and integration of) verifier authentication schemes such as EUDI access and registration certificates can mitigate risks of proliferation of unnecessary credential requests. However, the presence of such schemes is not guaranteed, which significantly increases the risk in a credential exchange.

There are other practical steps that user agents implementing the Digital Credentials API can take to reduce risk, increase user understanding, and prevent certain types of harm:

• Only support protocols that support selective disclosure and other techniques of data minimization can reduce the impact and likelihood of information leakage, and provide better context to users in permission and consent flows.
• Support for protocols that allow unlinkability mechanisms such as Zero-Knowledge Proofs can prevent verifier-based surveillance and potential discrimination, by hiding the issuer.
• Offering useful context and a clearly understandable permission flow will help users make better decisions on whether or not to accept a credential exchange, which can reduce the viability of exchange requests that are made without a concrete user need.

It is further critical that user agents design a permission experience that accounts for the lack of these mitigations, e.g., the exchange of personal information from government credentials without any verifier authentication scheme. It is recommended that a higher level of friction and clear user messaging that highlights the involved risk be applied to these types of exchanges.

The impact and viability of credential theft and leakage of non-government credentials is largely based on the content of each individual credential type. In general, it could lead to loss of control and exposure of sensitive private information, as well as impersonation and data theft, which can increase the likelihood of further attacks on the affected individual.

The flexibility and lack of regulation of non-government credentials carries potential for abuse for the purpose of cross-site tracking and linking identities through long-lived identifiers, such as email address or phone number. Verifiers participating in a tracking scheme based on digital credentials could create user incentives to accept sharing identifier credentials across many sites ("loyalty cards" for the Web), without fully understanding the implications on their privacy.

Even users unwilling to share their information in such a scheme could be affected by prompt fatigue and potentially risk exclusion from using these services.

For non-government-issued credentials, it is recommended that the user agent understand the requested credential format and its privacy attributes, and build a risk framework that informs the context that is shown to the user, as well as the amount of friction that is appropriate for each credential type. Protocols and formats involved in the exchange of these credentials are generally expected to support features such as selective disclosure and unlinkability, but these features might not always be appropriate or necessary in the exchange of information, especially when it concerns low-risk credentials such as cinema tickets.

A user agent that recognizes the type of credential being requested is encouraged to customize its permission experience to best suit the requested credential and help users understand the consequences of sharing it.

User agents can not be expected to understand all credential requests. A user agent that does not recognize the type of credential being requested is advised to significantly increase user friction in their permission experience, and very clearly communicate the risks of sharing unknown credentials with websites to the user. Note that this could require integration between different user agents to apply appropriate levels of friction and transparency. For example, a browser might delegate knowledge about credential requests to the operating system, which might require wallets to register known credential types and reject an exchange request for an unknown credential type.