Answer enough questions and you have given away the answer

Selective disclosure is the best idea in digital identity. As it is usually deployed, it leaks the very thing it was built to protect.

The idea is simple enough to explain to anyone. A shop needs to know you are old enough to buy something. It does not need your date of birth, your name or your address. So instead of handing over a document, you hand over an answer: yes, this person is over eighteen, signed by somebody the shop trusts. The underlying value is never disclosed. In the literature that answer is called a predicate response, and the machinery for producing them is mature and genuinely excellent. Anonymous credentials, zero knowledge range proofs, selective disclosure signature schemes. This is real cryptography and it works.

Now ask the same person a second question.

Sixteen questions

Suppose a verifier asks whether you are over eighteen. You answer yes. Nothing meaningful has been disclosed: you are one of a very large group.

Later it asks whether you are over twenty-five. You answer no.

Your date of birth now sits in a seven year window. Neither answer disclosed it. Together they bounded it.

Keep going. Over twenty-one, yes. Over twenty-three, no. Over twenty-two, yes. The window is down to a year, and every single response was a compliant, privacy-preserving, cryptographically sound predicate proof that revealed no attribute value.

The arithmetic is not kind here. Each well-chosen yes or no question halves the remaining space. A hundred year range contains about thirty-six thousand days. Two raised to the sixteenth power is more than sixty-five thousand. Sixteen questions pin a date of birth to the exact day.

Nobody ever disclosed it. Nobody broke any cryptography. The system worked exactly as specified on every individual request, and the attribute is gone.

Why this is not a hypothetical

The obvious objection is that no real verifier asks sixteen age questions. That is true, and it is also not the threat.

The threat is a relationship that persists. Consider a platform that asks for over eighteen at signup, over twenty-one when you enter a different part of the service, over eighteen again after a policy change, and over twenty-five when it introduces a new category. Four questions across three years, each of them individually justified, none of them coordinated, all of them answered honestly by a well behaved wallet.

The verifier now holds a bounded range without ever having requested a date of birth, and without any component in the chain having misbehaved.

Then widen it. Attributes are not only ages. Predicates get asked about income bands, credit thresholds, geographic proximity, employment duration, transaction limits, health measures. Anywhere a verifier can pose a condition on an undisclosed value, and pose it more than once, the same accumulation applies. Salary is a particularly uncomfortable example, because the thresholds a lender or a landlord would naturally choose are already close together.

Why the existing tools do not catch it

This is the part I find genuinely interesting, and the reason I think it has been overlooked for so long.

Every mechanism in the selective disclosure toolkit is designed to be sound with respect to a single proof. A zero knowledge proof guarantees that the verifier learns nothing beyond the truth of the statement being proved. That guarantee is real, and it holds. The problem is that it is a per-proof guarantee, and the leak is not in any proof. It is in the set.

Each response is individually minimal and collectively conclusive. There is no faulty component to find. A security review of any single transaction returns a clean result, which is exactly why this survives review.

The holder's software has the same blind spot. A wallet presented with a valid request for a valid predicate, from a verifier with a legitimate purpose, has no basis on which to refuse. It is answering the question it was asked. It has no notion that answering is expenditure.

Treating disclosure as a budget

The reframing that makes this tractable is to stop thinking about requests and start thinking about the attribute.

Every predicate response about an undisclosed value spends some of that value's privacy. How much depends on what has already been answered. The first over-eighteen response costs almost nothing. The response that narrows a seven year window to one year costs a great deal. Same mechanism, same cryptography, radically different cost, and the difference is entirely a function of history.

Once you see it that way the design follows. The holder's side of the relationship needs to track what has already been disclosed about each attribute to each verifier, measure what a new response would cost given that history, and be capable of declining or degrading when the cumulative total crosses a threshold. The unit of accounting is the attribute over the lifetime of a relationship, not the request.

That is the subject of a patent application I filed this year, GB2619018.1, on limiting cumulative disclosure of a credential attribute across a plurality of predicate responses. I am not going to specify the metering here, but the framing is the part worth arguing about publicly, because it changes what a wallet is for.

What this means if you are building

A wallet that answers every well-formed question is not a privacy tool. It is a very polite disclosure channel with good cryptography in front of it.

If you are implementing selective disclosure, the questions I would ask are these. Does anything in your system know what it has already answered about a given attribute to a given verifier? Can it say no to a request that is individually reasonable? Does the second question about an attribute cost more than the first, and is anything measuring that?

For most implementations the answers are no, no and no, and that is not negligence. It is the natural result of a toolkit that reasons about proofs rather than about relationships.

There is a broader lesson here that goes beyond credentials. Privacy properties do not compose. Two operations that are each safe can be unsafe when performed in sequence by the same parties, and no amount of rigour applied to the individual operations will surface it. You have to look at the sequence.

The regulation arriving over the next two years assumes selective disclosure will do a great deal of heavy lifting. It is in the European wallet architecture and it is the honest answer to age assurance. It is the right technology. It just needs to start counting.