Introduction

JWT (JSON Web Token) is a widely used open standard for securely transmitting information between parties as a JSON object, signed to verify the integrity of the data. It's commonly used for authentication and information exchange, enabling a stateless, scalable solution for web services.

SD-JWT (Selective Disclosure JWT) builds on this foundation by adding a layer of privacy and selective information sharing. It allows the holder of a JWT to reveal only specific pieces of information to a verifier without exposing the entire token content. This is particularly useful in scenarios where privacy concerns are paramount, and only certain data needs to be shared for verification purposes.

Both JWT and SD-JWT offer robust solutions for different aspects of secure information handling in web applications. While JWT provides a standardized method for secure communications, SD-JWT extends this with enhanced privacy controls, making it a powerful tool for situations requiring selective data disclosure.

How SD-JWT works?

SD-JWT operates by allowing claims within a JWT to be selectively disclosed while ensuring these claims are cryptographically protected against unauthorized modification.

When an issuer provides an SD-JWT to a holder, it includes both the signed JWT and the cleartext versions of any hidden claims outside the signed portion. The holder can then decide which claims to reveal to a verifier, ensuring that the verifier can confirm these claims were indeed issued by the original issuer without learning undisclosed information. The structure of SD-JWT incorporates the issuer-signed JWT, optional disclosures, and an optional key binding JWT, linked together by tilde characters.

For a detailed explanation and examples, please visit What is SD-JWT?.

JWT vs SD-JWT

Legend: ✅ supported, ❌ not supported

This table outlines the capabilities and limitations of JWT and SD-JWT in handling secure information exchange. While both offer cryptographic protection and support for stateless authentication, SD-JWT stands out for its selective data disclosure and privacy controls, addressing scenarios JWT isn't designed for.

Possible uses for SD-JWT

1. Verifiable Credentials: Enables the secure sharing of credentials with selective information disclosure, maintaining privacy while ensuring authenticity.

2. Access Control: Allows for fine-grained access control in applications by letting users share only the necessary permissions or roles required for a specific service.

3. Healthcare Data Sharing: Facilitates the sharing of sensitive healthcare information between patients, providers, and third parties, ensuring that only relevant health data is disclosed while maintaining patient privacy.

These use cases highlight the versatility of SD-JWT in enhancing privacy and security across different domains.

Conclusion

In conclusion, SD-JWT marks a significant advancement in the realm of digital security and privacy. By enabling selective disclosure of information, SD-JWT not only upholds the integrity and authenticity of digital transactions but also introduces a new level of privacy control previously unattainable. As we continue to navigate the complexities of digital interactions, the adoption of SD-JWT across various sectors—from verifiable credentials to healthcare data sharing—demonstrates its potential to safeguard sensitive information while maintaining transparency and trust. Embracing SD-JWT is a step forward in creating a more secure and privacy-respecting digital world.