notes: research/papers/how-sd-jwt-and-acdc-are-similar-and-different

This data as json

path title type status classification words body
research/papers/how-sd-jwt-and-acdc-are-similar-and-different How SD-JWT and ACDC are similar and different summary v0.1 — 2026-10-14: drafted by Claude from the web page (full text); unread by Mark; marked partner on Mark's word 2026-10-21, paraphrase only partner 463 # How SD-JWT and ACDC are similar and different **Abstract.** A comparison by Daniel Hardman of SD-JWT (Selective Disclosure for JSON Web Tokens) and ACDC (Authentic Chained Data Containers): what they share, then how they differ in scope, identifiers, signing, chaining, serialization, origins and standards path. The author states that he is not a neutral source. For practitioners choosing a credential format. ## Summary The paper compares SD-JWT (Selective Disclosure for JSON Web Tokens) and ACDC (Authentic Chained Data Containers). Under Similarities it notes that both are signed, serialized structures readable by a JSON-literate programmer, both came from the decentralized identity community, and both use salted hashes to hide parts of a credential. The author prefers ACDC's term graduated disclosure to selective disclosure, which he calls a loaded regulatory term. He states his own involvement with both camps. The Differences section has seven parts. Scope: both can express entitlement credentials, which is where SD-JWT practice centers; ACDCs may fit other evidence such as citations. Identifiers: SD-JWTs allow DIDs, URLs and other schemes, while ACDCs are stricter, requiring every issuer to be identified by an AID (section Identifiers), an autonomic identifier from KERI (Key Event Receipt Infrastructure). Signing mechanism: SD-JWTs rely on issuer keys and self-asserted timestamps; ACDCs are signed by identifiers whose key event logs (KELs) and transaction event logs (TELs) support rotation, multisignature, revocation and witnessed timing. Chaining: SD-JWTs are standalone, so verifiers rely on issuer registries; ACDCs chain to one another by SAID (self-addressing identifier), qualifying issuers the same way as holders. Serialization: SD-JWT uses compact base64url JSON with mature tooling; ACDCs use CESR (Composable Event Streaming Representation), with text and binary forms and less mature libraries. Intellectual and business roots: SD-JWT from the JWT authors, Microsoft and Ping Identity, close to OAuth2 and OpenID Connect; ACDC from Samuel Smith, Trust Over IP and the WebOfTrust community, with GLEIF sponsorship. Standards path: SD-JWT as IETF drafts with registered claims; ACDC with a stable specification and the vLEI ISO standard finalized in October 2024. There is no separate conclusion; the comparison ends with the standards path. ## Key terms SD-JWT, ACDC, graduated disclosure, selective disclosure, AID, KEL, TEL, SAID, CESR, vLEI ## Claims and their evidence - Both formats use salted hashes to hide credential parts [informative] - ACDC issuers must be identified with a KERI AID; SD-JWT issuers may use other identifier schemes [normative] - SD-JWT tooling is more mature than CESR tooling [informative] - The vLEI ISO standard was finalized in October 2024 [unverified] - The author declares he is not a neutral source [informative] ## Related - Why Anchored Signatures? - ACDC specification - CESR specification ## Provenance Drafted by Claude on 2026-10-14 from the web page at dhh1128.github.io, read in full as text. Not yet read by Mark.

Links from other tables