Many institutions ask for more information than the decision before them requires. A transit system needs to know that a valid fare was paid, not necessarily the passenger's entire movement history. A benefits office may need to establish that an applicant meets an income threshold, not read every transaction in the applicant's life. A venue may need to know that a person is old enough to enter, not receive the person's date of birth, address, and identity number. The difference between these questions is the beginning of privacy-preserving verification.
Verification without surveillance means designing a system to answer the smallest legitimate question with the smallest useful disclosure. It can involve ordinary institutional procedures, selective disclosure from a credential, an anonymous token, or a zero-knowledge proof. The technology matters because architecture determines what can be learned, linked, retained, and later misused. But cryptography is not a moral oracle. A proof can show that a computation was performed correctly under stated inputs; it cannot decide whether the institution had the right to ask, whether the underlying rule is just, or whether the credential issuer told the truth.
Ask Only the Question You Are Entitled to Ask
Data minimization is often presented as a compliance obligation. It is better understood as a discipline of authority. Before collecting a field, an institution should name the decision it must make, the rule that governs it, and why that field is necessary. “We may find it useful later” is not a sufficient public purpose when the information concerns a person's health, finances, associations, location, or family.
Minimization does not mean pretending that context never matters. A hospital may need a detailed medical history to treat a patient. A court may need identifying evidence to adjudicate a case. A tax agency may need records that a point-of-service system should never receive. The same fact can be legitimate in one relationship and excessive in another. Selective disclosure preserves this distinction by allowing an issuer or holder to answer the relevant question without making all other facts available to the verifier.
Credentials That Reveal Less
Suppose a credential contains a name, date of birth, address, and entitlement. A verifier asking only whether the holder is over a specified age should not automatically receive all four fields. A selective-disclosure scheme can reveal an age assertion or a proof of an age predicate while withholding the rest. The exact privacy properties depend on the protocol, implementation, and issuer practice. “Digital credential” is not itself a guarantee of minimization; a system can simply put a conventional identity card on a phone and encourage every verifier to copy it.
Anonymous and pseudonymous credentials go further. An anonymous credential can prove possession of an authorized attribute without revealing a stable identifier to every verifier. A pseudonymous design may use different identifiers in different relationships, so a transit operator, library, and clinic cannot automatically join their records. These approaches can preserve accountability in bounded ways, such as proving a credential was issued by an accepted authority or limiting one use per period, without making every ordinary use traceable to a civil identity.
What a Zero-Knowledge Proof Can Do
A zero-knowledge proof lets one party demonstrate that a statement is true, according to a specified relation and public inputs, without revealing the witness or secret information used to establish it. In accessible terms, a prover can demonstrate knowledge of a valid secret or satisfaction of a condition while disclosing less than the underlying data. The verifier checks a proof rather than receiving the entire witness.
The capability is powerful but precise. A proof system may establish that a committed value lies in a range, that a signature is valid, that a credential has not passed an expiry condition, or that a computation over committed inputs produced an accepted result. It does not spontaneously discover what is true. The circuit, relation, public parameters, credential issuer, revocation assumptions, and software all determine what the verifier has actually learned.
There are also engineering costs. General-purpose zero-knowledge systems can require substantial computation, specialized circuits, careful setup or transparent parameters depending on the construction, and difficult audits. Proof size and verification time vary widely. Metadata surrounding a proof can destroy privacy even when the mathematics is sound: an IP address, account, timestamp, payment pattern, or repeated interaction may identify or link the user. Cryptographic privacy is a property of the whole protocol and deployment, not a decorative feature attached to a proof.
Unlinkability Is a Social Property Too
Unlinkability means that separate presentations should not be automatically recognized as belonging to the same holder, within the threat model and limits of the system. This can prevent a verifier from building a comprehensive profile from otherwise legitimate interactions. Different pseudonyms, randomized presentations, and holder-controlled disclosure can help. So can refusing to collect unnecessary logs in the first place.
Unlinkability is not absolute anonymity. A service may need a way to recover an account, respond to a court order, prevent repeated abuse, or restore a credential after theft. Those goals can conflict with unlinkability. A design might use a trusted recovery authority, threshold de-anonymization, rate limits, or a separate complaint process. Each adds power and risk. The system should disclose who can link records, under what conditions, with what authorization, and whether the action is audited.
Even a mathematically unlinkable credential can become socially linkable. A rare combination of attributes may identify a person. A verifier may demand a selfie or a phone number alongside the proof. A small community may know who used a credential at a particular time. Privacy review must therefore include contextual, organizational, and behavioral analysis. Cryptography can remove one path to correlation while institutions create another.
Recovery Is Part of the Privacy Threat Model
A credential is not privacy-preserving if the person cannot use it after a stolen device, a lost key, or an issuer's mistake. Recovery authorities can become powerful linkers, while strict revocation can exclude people who share devices, lack stable documents, or have intermittent connectivity. A serious design therefore names the asset being protected, the likely adversary, the issuer and recovery assumptions, and the failure path. It asks whether a person can recover without surrendering a complete activity history, whether a verifier can challenge an erroneous issuer claim, and whether a non-digital route is available.
These are testable requirements even when no universal performance result is available. Pilots should measure recovery time and success, exclusion and false-revocation rates, correlation from metadata, and the burden placed on shared-device and low-connectivity users. A threshold-deanonymization rule may help investigate serious abuse, but it should identify the authority, approval condition, expiry, and audit path rather than treating “trusted issuer” as a guarantee. The construction sources explain what the mechanisms can do; they do not establish that a deployment is accessible, affordable, or just.
Revocation and the Cost of Forgetting
Verification systems must handle change. A license expires, a professional authorization is withdrawn, a benefit ends, or a device is lost. Revocation allows a verifier to reject a credential that was once valid. The simple approach is a public list of credential identifiers. It may be easy to implement, but checking the list can create a record of who asked about which credential and can expose a stable identifier that defeats unlinkability.
Privacy-preserving revocation mechanisms can use accumulators, short-lived credentials, status lists, or other constructions. Each introduces different tradeoffs involving freshness, availability, proof complexity, update timing, and the ability to recover from compromise. A verifier may need to learn that a credential is currently valid without learning the holder's full history. A public service should state which failure mode it prefers: temporary inability to verify, acceptance of a recently revoked credential, or additional disclosure for stronger real-time checks.
Anti-Fraud Without Universal Exposure
Fraud prevention is the strongest practical objection to privacy- preserving verification. Public programs and private services need to prevent duplicate claims, forged qualifications, account farms, credential theft, and coordinated abuse. If every presentation is anonymous and unlinkable, how can an institution enforce a one-person, one-benefit rule or investigate a serious attack?
The answer is not to collect everything by default. It is to state the fraud question and design a bounded control for it. A system may issue a single-use or rate-limited token, prove membership in an eligible set, use a nullifier that prevents duplicate use without revealing ordinary activity, or reserve identity disclosure for a defined investigation. These mechanisms are not interchangeable, and some can be gamed if accounts or devices are cheap. Stronger anti-fraud controls may require more linkability, which should be treated as a cost rather than hidden as a technical detail.
Anti-fraud measures can also produce exclusion. Biometric binding may fail for people whose bodies, documents, housing, or connectivity do not fit the system. Device fingerprints can classify shared computers or public networks as suspicious. A strict recovery rule can punish a person whose phone was stolen. Fairness therefore requires alternate channels, human review, accessible evidence, and a proportionate response to uncertainty. Privacy-preserving verification should reduce unnecessary exposure, not turn a failed cryptographic interaction into a presumption of guilt.
Public Services as the Test Case
Public services are where the moral promise becomes concrete. Consider a transit benefit for residents of a municipality. The agency may need to know that a rider holds a valid benefit and that the benefit has not been used beyond an authorized limit. It may not need a durable map of every ride. A credential could prove eligibility and a bounded-use mechanism could prevent duplication, while the validator receives no name or travel history during ordinary use.
Consider a housing or income-support program. The administering agency may need verified income for a defined period, household status, or disability determination. A landlord, contractor, or front-desk worker usually needs much less. Layered disclosure can allow the authorized agency to inspect evidence while giving downstream actors only the entitlement they must honor. Separation of roles matters: a proof should not become a portable invitation for every employee or vendor to see the underlying file.
Legitimacy Comes Before Mathematics
The Proof Is Not the Claim
A cryptographic proof can answer “does this presentation satisfy the defined relation?” It cannot answer “was the relation worth enforcing?” An issuer may certify a category that was created through discrimination or administrative error. A government may issue a valid credential under an unjust law. A private company may make a verifier dependent on a proprietary standard. Technical soundness does not transform an illegitimate authority into a legitimate one.
The same qualification applies to truth. A proof of a signed claim establishes a relationship to the signer or to a computation. It does not guarantee that the signer knew the truth, that the source was competent, or that the claim remains morally relevant. A person can prove possession of a credential and still deserve an opportunity to explain the circumstance that the credential cannot represent. Verification should support judgment, not eliminate the human responsibility to interpret evidence.
Catholic social teaching places this technical humility within a broader account of the person. Gaudium et Spes 26 and 27, the Catechism 1700 and 1731–1738, and the principles of subsidiarity and solidarity in Quadragesimo Anno 79–80 require social arrangements to serve dignity, responsibility, and participation. A privacy-preserving protocol can help keep a person from being reduced to a dossier. It cannot by itself supply mercy, prudence, due process, or the common good.
Design Requirements for Responsible Verification
A responsible design begins with a data-flow and authority map. Name the issuer, holder, verifier, recovery authority, revocation service, and infrastructure operators. State what each party learns during issuance, presentation, failure, recovery, and dispute. Identify stable identifiers, metadata, logs, timing information, and administrators who can join records. If the system cannot explain these flows to an ordinary user, its privacy claims are not yet credible.
Choose the least revealing credential and proof that meets the actual purpose. Prefer selective disclosure over whole-document transfer; separate contexts with pairwise pseudonyms where appropriate; and use anonymous or unlinkable presentations when routine identity is not necessary. Do not promise unlinkability if an issuer, verifier, network provider, or recovery authority can silently correlate every use. Publish threat models, cryptographic assumptions, implementation dependencies, and the circumstances in which identity can be exposed.
Build ordinary governance around the cryptography. Set retention and deletion rules, limit employee access, audit exceptional disclosure, provide accessible recovery, and create appeals that can correct both bad data and bad policy. Test the system with people who lack stable documents, private devices, fast connectivity, or technical fluency. Offer non-digital paths that do not mark a person as suspicious. A system that minimizes data for the well-equipped while excluding everyone else has not served the common good.
Sources and Qualifications
The cryptographic discussion relies on David Chaum, “Security without Identification: Transaction Systems to Make Big Brother Obsolete,”Communications of the ACM 28, no. 10 (1985), 1030–1044, for untraceable transactions and credential privacy; Jan Camenisch and Anna Lysyanskaya, “An Efficient System for Non-transferable Anonymous Credentials with Optional Anonymity Revocation,” in EUROCRYPT 2001, LNCS 2045 (2001), 93–118, for anonymous credentials and revocation; and Shafi Goldwasser, Silvio Micali, and Charles Rackoff, “The Knowledge Complexity of Interactive Proof Systems,” SIAM Journal on Computing 18, no. 1 (1989), 186–208, for the zero-knowledge foundations. These sources describe constructions, not guarantees that every implementation is secure or every deployment is just.
Catholic claims draw on Gaudium et Spes 16, 24, 26, and 27; the Catechism of the Catholic Church 1700, 1731–1738, 1883–1885, and 1905–1912; and Quadragesimo Anno 79–80. Data-protection principles such as purpose limitation, minimization, security, and accountability are reflected in instruments including the OECD Privacy Guidelines and the GDPR, whose application and exceptions vary by jurisdiction. This essay is not legal advice. Zero-knowledge proofs, selective disclosure, and unlinkability have concrete limits involving metadata, endpoint compromise, revocation, usability, implementation bugs, and issuer trust.
A Smaller Answer Can Be a More Just Answer
Verification is often treated as a demand for a complete portrait. The institution wants certainty, so it asks for identity, history, location, relationships, and every document that might later become relevant. That appetite is understandable and dangerous. It converts a limited entitlement into a standing invitation to inspect a person. Data minimization, selective disclosure, anonymous credentials, and zero-knowledge proofs offer another path: establish what must be established while leaving unrelated life outside the transaction.
A proof may be valid yet answer the wrong question. An unlinkable credential may fail when metadata identifies the person. Revocation may preserve privacy while making recovery impossible, and an anti-fraud control may protect a program while excluding its intended beneficiaries. These are governance questions as much as engineering questions.
The synthesis is therefore both technical and moral: disclose the minimum, separate contexts, make exceptional access accountable, and preserve a human route to correction. Cryptography can help institutions resist the temptation to know everything. It cannot tell them what they owe the person whose claim is being verified. That responsibility remains with the people and communities who design, authorize, and operate the system.
Source Notes
Foundational work on privacy-preserving electronic transactions and credentials that limit unnecessary identification and linkability.
Anonymous-credential construction supporting selective disclosure and bounded accountability without routine disclosure of a civil identity.
Foundational zero-knowledge proof theory supporting the distinction between proving a relation and disclosing the underlying witness.
A standard model for issuer, holder, verifier, selective disclosure, and bounded credential claims.
A technical specification for decentralized identifiers and their management, without treating a protocol as a guarantee of privacy or legitimacy.
Technical guidance for identity proofing, authentication, federation, assurance, and the risks introduced by each.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.