Enhancing Identity Credential Privacy with Zero-Knowledge Proofs

Enhancing Identity Credential Privacy with Zero-Knowledge Proofs

Speaker: Christian Paquin (Microsoft Research)

Conference: NorthSec 2025 — May 15–16, 2025, Marché Bonsecours, Montreal

Watch on YouTube: https://www.youtube.com/watch?v=kTSqUC6ay-0

Reading time: ~7 minutes

TL;DR

Mobile driver's licenses and digital identity credentials are rolling out across North America, but existing standards like SD-JWT and mDL still leave a critical gap: every credential presentation leaks a unique digital fingerprint that issuers and data brokers can use to track users across sites. Christian Paquin of Microsoft Research presents Crescent, an open-source zero-knowledge proof framework that layers on top of existing credential formats to let users prove specific claims — "I am over 18," "I reside in Virginia" — without revealing any additional data and without enabling issuer surveillance of where credentials are used.

Introduction

Digital wallets are transitioning from a futuristic concept to everyday infrastructure. Several U.S. states have already deployed mobile driver's licenses (mDLs), and Canadian provinces are preparing to follow. The appeal is obvious: a standardized, portable, cryptographically protected identity credential carried on a smartphone. But as Paquin opens his talk, he draws attention to a problem that the current crop of standards has not solved.

When a person shows a physical driver's license at a bar to prove they are old enough to drink, the government has no way to learn about that transaction. The barman sees the card, the patron walks in, and nothing is logged. The digital equivalent, however, is radically different. Every time a credential is presented electronically, it carries correlation handles — the public key, the issuer's signature, and any personally identifiable information that is disclosed — that can be logged, matched across sites, and used to reconstruct a detailed picture of where a person has been online. Paquin calls this the "Where's Waldo" problem for digital identity.

His talk presents Crescent, a practical zero-knowledge framework built at Microsoft Research that is specifically designed to solve this problem without requiring changes to existing issuance infrastructure or device hardware.

▶ Watch: The correlation problem in digital credentials (2:00)

The Selective Disclosure Gap

Modern identity standards have taken meaningful steps toward privacy. SD-JWT (Selective Disclosure JSON Web Token) and mDL both support selective disclosure: rather than encoding attributes in cleartext, they hash each attribute together with a random salt and embed only the digest in the signed credential. When presenting, the holder reveals only the preimages for the attributes they wish to disclose, leaving everything else as unreadable gibberish from the verifier's perspective.

This is a genuine improvement over presenting an unredacted credential. But selective disclosure as implemented in these standards still has a fundamental limitation. The credential itself — including its public key and the issuer's signature — must be transmitted intact to the verifier in order for the verification to succeed. That means every presentation of the same credential looks the same to every verifier who sees it. An issuer who colludes with, or simply observes, multiple verifiers can reconstruct a user's activity timeline.

Paquin illustrates the desired behavior with a physical analogy: a magic marker that lets a holder cross out their full birthdate and simply assert "I am over 18," with no underlying data visible and no way for anyone watching to know the marker came from the same pen twice.

▶ Watch: How SD-JWT selective disclosure works (8:00)

Zero-Knowledge Proofs and zk-SNARKs

The cryptographic machinery needed to implement that magic marker has existed in theory since the 1980s, but practical deployment has been constrained by performance requirements that typical hardware could not meet. The emergence of zk-SNARKs — Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge — changed that calculus significantly.

Paquin walks through the key properties that make zk-SNARKs useful for this application. "Zero knowledge" means that a proof reveals nothing beyond the single claim being proved: if the claim is "my date of birth is such that I am over 18," the verifier learns the Boolean outcome and nothing else — not the year, not the month, not the day. "Succinct" means the proof is small and fast to verify regardless of the complexity of the underlying computation. "Non-interactive" means no back-and-forth round trips are needed between the prover and verifier, which matters for internet-scale deployments.

The Crescent framework uses these primitives to construct a proof layer that sits above the credential. Given a standard JWT or mDL credential, Crescent allows the holder to generate a ZK proof of any claim derivable from the credential's attributes. The proof is unlinkable across presentations: two presentations of the same credential to the same or different verifiers are computationally indistinguishable from one another.

▶ Watch: Introduction to zk-SNARKs (16:00)

The Crescent Framework: Practical Zero-Knowledge for Existing Credentials

The central design constraint Paquin sets for Crescent is backward compatibility. DMVs, banks, and employers are not going to rebuild their issuance pipelines to support new cryptographic primitives. Crescent therefore operates entirely on the presentation side: it takes a credential issued by any standard-compliant issuer and wraps it in a ZK proof layer that the verifier can check without ever seeing the raw credential.

This is technically challenging because standard JWTs use RSA or ECDSA signatures — neither of which was designed with ZK-friendliness in mind. The construction requires expressing the signature verification algorithm inside a ZK circuit, which is computationally intensive. Paquin describes the work his team has done to make this practical on consumer hardware, including optimizations to the RSA circuit that bring proof generation time into a range suitable for interactive web use.

The Crescent codebase is open source, and Paquin encourages the audience to examine and contribute to it. The framework handles the full credential lifecycle: credential ingestion, claim extraction, proof generation on the holder's device, and a verifier SDK that accepts and validates Crescent proofs without touching the underlying credential.

▶ Watch: Crescent architecture and backward compatibility (14:00)

Deployment Context: mDLs in North America

Paquin grounds the technical material in the rapidly evolving deployment landscape. The American Association of Motor Vehicle Administrators (AAMVA) has defined the mDL schema used across U.S. states, and several states — including Virginia, where Paquin lives — are already in active rollout. He recounts attempting to use his Virginia mDL at a TSA checkpoint only to find the reader was not yet operational, a reminder that deployment is real but still uneven.

Canada is preparing its own rollout. The stakes are high: once governments, employers, and online platforms begin accepting digital credentials for age verification, employment checks, and regulated service access, the correlation problem becomes a mass-surveillance problem. A regime in which every visit to an age-gated website is logged by the issuing DMV — or by a data broker aggregating across verifiers — is a realistic outcome of current standards deployed at scale.

Crescent represents one technically rigorous answer to that problem, building on decades of cryptographic research and bringing it into a form that can be deployed without waiting for the entire identity ecosystem to upgrade.

▶ Watch: mDL deployment landscape in North America (10:00)

Notable Quotes

"When I show my driver's license to get into a bar, the government doesn't magically get notified of that fact. So in a way, we want a system that would take the best of both worlds."

"Your credential has a lot of what I call correlation handles, little unique fingerprints — the public key, the signature — that you cannot present the token without showing, and that's a unique number."

"The real minimal information is a Boolean. It's yes or no. Are you over eighteen? And that's what zero-knowledge technologies can help us do."

"We just assume we can't change any of these systems today. And what we're going to do is use these new types of zero-knowledge proofs to work on top of these existing credentials."

Key Takeaways

• Selective disclosure is not the same as unlinkability. SD-JWT and mDL prevent data oversharing but do not prevent issuers or colluding verifiers from tracking which credentials were used where and when.
• zk-SNARKs make minimal disclosure practical. A holder can prove a Boolean claim ("I am over 18") derived from a signed credential without revealing the underlying data or the credential itself.
• Crescent is backward compatible. The framework works with standard RSA/ECDSA-signed JWTs and mDLs, requiring no changes to issuer infrastructure or device secure elements.
• The deployment window is narrow. With mDL rollouts already underway in the United States and Canada preparing to follow, the window to bake in unlinkability before mass adoption is limited.
• Open-source availability lowers the barrier. Crescent is publicly available, making it possible for identity platform developers to evaluate and integrate ZK-based credential presentation today.