BBS Signature
A signature scheme that lets a holder reveal only a subset of the fields in a credential while keeping the issuer's single signature valid, without the issuer's involvement. It enables privacy-preserving selective disclosure and unlinkable presentations for verifiable credentials.
BBS matters because it moves selective disclosure from a workaround to a property of the signature itself. Alternatives either re-issue a credential per disclosure, which requires the issuer to be online and to learn where the credential is used, or hash-and-salt each field as SD-JWT does, which reveals which fields were withheld. BBS reveals only what is shown and produces unlinkable presentations, at the cost of newer cryptography and thinner library support.
See also: selective disclosure, zero-knowledge proof, verifiable credentials, SD-JWT
Related on Start with Identity
- GlossaryAnonCreds
A verifiable credential format, originating in Hyperledger Indy and now a standalone specification, built around zero-knowledge proofs for strong selective disc
- GlossaryDecentralized Identifier (DID)
A W3C standard identifier that a subject controls without a central registry, resolvable to a document with keys and endpoints. A building block of decentralize
- GlossaryMobile Driver's License (mDL)
A driver's license issued to a phone wallet under the ISO/IEC 18013-5 standard, presentable in person and increasingly online. It supports selective disclosure,
- CVEGitHub Enterprise Server SAML XML signature wrapping
A third 2024 GHES SAML path. An attacker with network access could wrap a signature and provision a privileged user. Same product, same year, same lesson: do no
- CVEHaloITSM SAML signature wrapping, log in as any user
HaloITSM accepted a wrapped SAML assertion. An attacker with one valid signature could impersonate any user, including admins. Critical. Another 2024 reminder t
- CVEKeycloak SAML signature validation bypass
Keycloak's XMLSignatureUtil decided a SAML response was signed when it was not bound to the assertion later consumed. Impersonation and privilege escalation on