BBS+ is a cryptographic signature scheme designed to support selective disclosure of signed attributes. It lets a holder prove some claims from a credential while keeping other signed fields hidden, using zero-knowledge proofs linked to the original signature.
Selective Disclosure in BBS+
BBS+ is built for situations where a verifier needs only part of a signed credential. It supports proving selected attributes without revealing the rest, which is especially useful when the same credential must serve different disclosure contexts with different privacy needs.
How BBS+ Uses Zero-Knowledge Proofs
The core idea is that the holder does not re-sign or edit the original credential. Instead, they generate a proof derived from the signature that demonstrates knowledge of valid signed claims while hiding undisclosed fields. That makes the verifier’s trust depend on the cryptographic proof, not on exposure of the full payload.
This matters because selective disclosure changes the privacy profile of a credential. A system can confirm one statement, such as eligibility or membership, without exposing unrelated attributes that may be sensitive, unnecessary, or risky to share.
Where BBS+ Fits in Credential Design
BBS+ is most valuable when credentials contain multiple claims and different relying parties need different subsets of those claims. It is a strong fit for privacy-preserving identity credentials, attestations, and portable verifiable claims where over-disclosure would create avoidable data exposure.
It also changes how credentials are architected: issuers must think about which attributes are signed together, holders must protect the original credential and any derived proofs, and verifiers must be able to validate presentations without assuming full visibility into the source credential.
Security Properties and Trade-offs
BBS+ improves confidentiality by reducing unnecessary attribute disclosure, but it does not make a credential intrinsically safe in every respect. If the original credential, holder wallet, or signing key is compromised, an attacker can still abuse legitimate trust relationships or generate presentations from stolen material.
Its security value depends on sound key management, correct proof verification, and careful binding between the credential, the holder, and the intended disclosure policy. Like other advanced cryptographic schemes, it helps most when privacy goals are defined early rather than bolted on after issuance.
Failure mechanism: Weak proof verification, poor key handling, or reuse of the same credential across contexts can undermine the privacy and trust benefits BBS+ is meant to provide.
Impact: Sensitive attributes may be exposed unnecessarily, and adversaries may be able to present seemingly valid claims in contexts where the disclosure pattern itself should have remained hidden.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-57 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-57 | Key Management Recommendations | BBS+ security depends on protecting signing keys and managing their lifecycle. |
| Recommendation — Protect issuer signing keys with strict lifecycle controls and rotation governance. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | BBS+ presentations rely on secure credential and key handling across issuance and verification. |
| IA-2 — Identification and Authentication (Organizational Users) | BBS+ is often used in identity credentials where proof of claims supports authentication decisions. | |
| SC-12 — Cryptographic Key Establishment and Management | BBS+ depends on sound cryptographic key establishment and management for trusted signatures. | |
| Recommendation — Manage cryptographic authenticators and related secrets with defined issuance, storage, and rotation controls. Use strong authentication controls when BBS+ proofs support access decisions for organizational users. Apply key establishment and lifecycle controls to the issuer keys that underpin BBS+ signatures. | ||
Practitioner Guidance
Why practitioners should care: BBS+ is not just a stronger signature, it is a disclosure control. Teams should treat it as a design choice for minimising data shared with verifiers, not as a universal replacement for ordinary signing.
What to watch for: The main governance question is whether the credential’s attribute model, proof flows, and verifier expectations actually support selective disclosure end to end. If they do not, the scheme’s privacy benefits can be lost in implementation.