Loading vLEI.wiki
Fetching knowledge base...
Fetching knowledge base...
This comprehensive explanation has been generated from 17 GitHub source documents. All source documents are searchable here.
Last updated: October 7, 2025
This content is meant to be consumed by AI agents via MCP. Click here to get the MCP configuration.
Note: In rare cases it may contain LLM hallucinations.
For authoritative documentation, please consult the official GLEIF vLEI trainings and the ToIP Glossary.
A privacy threat where vendors or data capture points provide sufficient contextual metadata at the point of disclosure to enable statistical correlation with existing datasets, thereby linking disclosed attributes to known profiles and defeating cryptographic privacy protections like selective disclosure and zero-knowledge proofs.
Contextual linkability represents a fundamental privacy vulnerability in digital identity systems where the context surrounding data disclosure—rather than the disclosed data itself—enables re-identification and profiling. This threat occurs when verifiers, vendors, or data capture points gather sufficient auxiliary information (metadata, environmental data, behavioral patterns) at the moment of credential presentation or data disclosure to statistically correlate the disclosed attributes with existing datasets, effectively linking them to known profiles of individuals.
The core insight is that cryptographic privacy mechanisms alone are insufficient when the disclosure environment itself leaks correlatable information. Even when using advanced privacy-preserving techniques like selective disclosure or zero-knowledge proofs, the contextual metadata captured during the disclosure event can enable re-identification through statistical correlation attacks.
Key properties of contextual linkability:
The scope of contextual linkability extends beyond traditional correlation threats. While correlation typically refers to linking multiple uses of the same identifier or , contextual linkability enables correlation even when cryptographically unlinkable identifiers are used, by exploiting the surrounding each disclosure event.
Contractual Framework Design: Organizations implementing ACDC-based systems should establish clear contractual terms that:
Risk Assessment: Evaluate contextual linkability risks by:
Progressive Disclosure Workflows: Design disclosure interactions to:
Verifier Infrastructure: Implement technical controls that:
User Interface Design: Enable subjects to:
Ecosystem Coordination: Establish governance mechanisms for:
Contextual linkability protection in KERI/ACDC focuses on effective privacy against commercial exploitation rather than absolute privacy against all adversaries. State actors with unlimited resources are largely out-of-scope. The goal is making correlation attacks sufficiently difficult, expensive, or legally risky that they are not economically viable for most adversaries.
Contextual linkability emerged as a recognized threat through research demonstrating the failure of traditional privacy protection mechanisms:
Traditional privacy protection relied heavily on K-anonymity—the practice of ensuring that disclosed data could not be distinguished from at least K-1 other individuals. However, research demonstrated that K-anonymity is fundamentally broken:
These attacks revealed that the context of data—not just the data itself—creates exploitable correlation vectors.
The development of verifiable credentials with selective disclosure capabilities promised enhanced privacy by allowing subjects to disclose only necessary attributes. However, research by Samuel Smith and others demonstrated that selective disclosure mechanisms, including those using zero-knowledge proofs, are vulnerable to contextual linkability attacks.
The critical insight: verifiers control the presentation context. A verifier can structure the disclosure interaction to capture sufficient auxiliary data (device fingerprints, network metadata, behavioral patterns, temporal information) that, when combined with the selectively disclosed attributes, enables re-identification through correlation with existing profiles.
Research on social network anonymization demonstrated that even when all traditional identifiers are removed, interaction metadata alone enables re-identification:
These findings established that the context of interactions—not just the content—creates privacy vulnerabilities.
KERI and ACDC address contextual linkability through a multi-layered approach that combines cryptographic mechanisms with governance frameworks:
The primary defense against contextual linkability in the KERI ecosystem is contractually-protected-disclosure. This mechanism recognizes that purely technical solutions are insufficient and establishes legal and contractual frameworks that:
This approach acknowledges the PAC Theorem (Privacy-Authenticity-Confidentiality Trilemma): one can achieve any two of these properties at the highest level, but not all three simultaneously. KERI prioritizes authenticity first, confidentiality second, and implements effective privacy (protection against exploitable correlation) rather than absolute privacy.
ACDC implements graduated disclosure mechanisms that enable progressive revelation of information only after contractual protections are established:
This approach minimizes the window during which contextual linkability attacks can occur by ensuring protective agreements are in place before sensitive information is revealed.
ACDC supports chain-link-confidentiality clauses that create contractual chains binding all downstream recipients:
KERI's design minimizes inherent correlation vectors:
KERI's ambient-verifiability and duplicity detection mechanisms operate without requiring centralized correlation:
This architecture enables security and integrity verification while minimizing the creation of centralized databases that could enable large-scale contextual linkability attacks.
Retail Surveillance: Modern retail environments demonstrate contextual linkability in practice:
Even if customers use privacy-preserving payment methods, the contextual identification enables linking purchases to profiles.
Authentication Contexts: When subjects authenticate to services:
These contextual factors can enable re-identification even when cryptographically unlinkable credentials are used.
Communication Patterns: During regular browsing and client-server interactions:
Sustainable Privacy: By recognizing and addressing contextual linkability, KERI/ACDC systems enable sustainable privacy—privacy that persists over time despite the inherently leaky nature of information systems:
Trust in Verifiable Credentials: Addressing contextual linkability is essential for verifiable credential adoption:
Enterprise Risk Management: Organizations benefit from structured approaches to contextual linkability:
Performance vs. Privacy: Minimizing contextual linkability may require:
Usability Challenges: Progressive disclosure and contractual protections may:
Enforcement Limitations: Contractual protections depend on:
State Actor Threats: As noted in KERI documentation, state actors with unlimited resources are largely out-of-scope for mitigation. Contextual linkability protections focus on effective privacy against commercial exploitation rather than absolute privacy against nation-state surveillance.
Metadata Minimization Limits: Some contextual information is inherent to network protocols:
Complete elimination of contextual linkability is impossible; the goal is exploitable correlation prevention—making correlation attacks sufficiently difficult, expensive, or legally risky that they are not economically viable for most adversaries.
Governance Framework Integration: Effective protection against contextual linkability requires:
User Education: Subjects must understand:
Verifier Responsibilities: Organizations requesting credential disclosure must:
Ecosystem Coordination: Addressing contextual linkability requires coordination across:
The KERI/ACDC approach recognizes that contextual linkability is a socio-technical problem requiring both cryptographic mechanisms and governance frameworks. Technical privacy protections must be complemented by legal, contractual, and institutional measures to achieve sustainable privacy in practice.
Some contextual information is inherent to network protocols and physical presence—complete elimination is impossible. The approach prioritizes exploitable correlation prevention through a combination of technical minimization and legal/contractual protections.