We are working on the cryptographic foundations of anonymous credentials to enable their integration in the upcoming European Digital Identity (EUDI) wallet. This work is funded by SPRIND.
Anonymous credentials are the privacy-preserving version of traditional certificates. After receiving a credential with attested attributes from a trusted issuer, users can derive presentations that a third party (the “relying party”) can verify. With every presentation, the user can choose which subset of the attested information to present, and each presentation is unlinkable. That is, if users do not share identifiable information in their presentations — for example, merely proving they are over 18 — the relying party cannot track or correlate their presentations. This can be done repeatedly from the same base credential (multi-show unlinkability), and even holds when the issuer and relying party collude. These features are enabled by a technique called zero-knowledge proofs. Zero-knowledge proofs allow one to prove that a statement is correct without revealing any information about why. In the context of anonymous credentials they are used to prove knowledge of a credential for the presented attributes – convincing the relying party that the information is indeed correct, without revealing anything about the underlying cryptographic evidence.
The built-in privacy features set anonymous credentials apart from traditional certificates, making them the ideal solution for satisfying all privacy requirements for the EUDI wallet, as specified in the eIDAS 2.0 regulation. For more information on this assessment, see the Cryptographers’ Feedback (06/24) or Anja Lehmann’s talk at the Real-World Crypto Symposium 2025.
The lack of established standards and deployed support for device binding has hindered their adoption so far, and our project aims at closing these gaps.
