Microsoft Research has introduced Crescent, an open-source cryptographic privacy library that brings unlinkability and selective disclosure to common credential formats such as JSON Web Tokens (JWTs) and mobile driver’s licenses (mDLs). The goal is straightforward: let people prove exactly what is needed, for example “age over 18” or “license not expired,” while preventing hidden identifiers from linking separate presentations of the same credential across sites or sessions.
What Crescent Adds to Today’s Stacks
Crescent wraps existing credentials with zero-knowledge proofs so a holder can reveal only chosen claims. The library uses Groth16 proofs and splits computation into two phases, Prepare for one-time on-device work and Show for fast, per-presentation proving. This design targets mobile performance while keeping presentations unlinkable. The sample implementation shows paths to integrate with OpenID Connect and OAuth flows, W3C Verifiable Credentials wallets, and the mDL ecosystem, so issuers do not need to retool back ends to try it.
Selective disclosure includes common JWT fields as well as range proofs, for example asserting that a birth date meets an age threshold or that a credential is valid within a time window. Device-bound credentials are supported as an option, which lets a verifier check proof of possession without turning the device identifier into a tracking handle. Microsoft has released the code under the MIT license with Circom circuits, Rust components, and a demo issuer, verifier, and browser-extension wallet. The repository clearly notes that the code has not yet been security-audited for production use.
Why It Matters and Microsoft’s Broader Authentication Push
Unlinkability and data minimization address a growing privacy gap in mainstream identity systems that rely on bearer tokens or static identifiers. By layering privacy proofs over formats that enterprises already use, Crescent offers a practical way to reduce tracking risk while keeping existing issuance and policy controls intact. The approach complements Microsoft’s broader move toward phishing-resistant sign-in, including making new accounts passwordless by default, expanding Windows Hello passkey options, and adding native passkey support in Microsoft Authenticator. It also aligns with Microsoft Entra scenarios such as selfie-based identity verification, where verifiers want high assurance while limiting the personal data they receive.
From a deployment perspective, Groth16 proofs are compact and fast to verify, which can help with mobile UX and verifier latency. Teams will still need to plan parameter governance for each circuit or credential template and define policies for revocation and freshness that align with proof verification. For privacy and compliance programs, Crescent’s unlinkability and selective disclosure support common data-minimization goals, although outcomes depend on how issuers and relying parties design their presentation flows and consent prompts.
Getting started is straightforward: review the Microsoft Research overview for the architecture and the Prepare and Show model, audit the GitHub repo, and run the sample JWT and mDL demos to evaluate on-device latency and verifier throughput. Organizations that already issue JWTs or work with mDL readers can prototype Crescent as an additional presentation option before considering standardization work.
Source: Microsoft
–
By Cass Kennedy
