zkToken: Empowering Holders to Limit Revocation Checks for Verifiable Credentials

2025-09-15

AI Summary

To address privacy leakage caused by verifiers’ continuous monitoring of revocation status in verifiable credential systems, this paper proposes the first zero-knowledge continuous verification framework enabling holders to autonomously configure verification intervals. The framework integrates non-membership proofs with an extensible blacklist mechanism, ensuring revocation status remains untraceable outside the designated verification period. We provide formal security proofs under standard cryptographic assumptions. Compared to the state-of-the-art, our solution reduces holder bandwidth overhead by approximately 40%, while maintaining comparable verification latency and computational cost. Our key contribution is the first privacy-controllable, time-bounded, and efficiently scalable continuous revocation verification mechanism—enabling fine-grained, holder-centric control over revocation checking frequency without compromising privacy or performance.

Technology Category

• Machine Learning: Privacy
• Data Mining & Knowledge Management: Representing, Reasoning, and Using Provenance, Trust
• Computer Vision: Bias, Fairness & Privacy

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• User Modeling, Personalization and Recommendation: User privacy protection in personalized systems

Abstract

Systems managing Verifiable Credentials are becoming increasingly popular. Unfortunately, their support for revoking previously issued credentials allows verifiers to effectively monitor the validity of the credentials, which is sensitive information. While the issue started to gain recognition, no adequate solution has been proposed so far. In this work, we propose a novel framework for time-limited continuous verification. The holder is able to individually configure the verification period when sharing information with the verifier, and the system guarantees proven untraceability of the revocation status after the verification period expires. Different from existing systems, the implementation adopts a more scalable blacklist approach where tokens corresponding to revoked credentials are stored in the registry. The approach employs ZK proofs that allow holders to prove non-membership in the blacklist. In addition to theoretically proving security, we evaluate the approach analytically and experimentally and show that it significantly improves bandwidth consumption on the holder while being on par with state-of-the-art solutions with respect to the other performance metrics.

Problem

• Limiting revocation checks to protect holder privacy
• Preventing verifier tracking of credential validity status
• Enabling configurable verification periods with untraceability guarantees

Innovation

• Time-limited continuous verification framework
• ZK proofs for blacklist non-membership
• Configurable verification periods for holders