SFDS: Selective File Disclosure System
2026-07-10 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors explain that controlling who can access files on a network is usually complicated because it needs systems to check who you are and what you can do. Different file types use different ways to prove they are genuine, but some, like plain text, don’t have good ways to do this. They suggest a new method using a special kind of digital token (called SD-JWT) that attaches a secure signature directly to the file. This means you can verify the file's authenticity without needing big, complex user management systems. Their approach aims to make sharing files both simpler and more secure.
Access ControlIdentity and Access Management (IAM)Digital SignaturesPDF Advanced Electronic Signature (PAdES)Selective Disclosure JSON Web Token (SD-JWT)Cryptographic SignaturesIntegrity ProtectionAuthenticationAuthorizationImmutable Resources
Authors
Aditya Mitra, Quazi Fariha Tasnim, Hristina Mihajloska Trpcheska
Abstract
Access control to networked resources has been a longstanding challenge. The conventional solution relies on authentication mechanisms, which introduce additional complexities associated with Identity and Access Management (IAM). Such systems require user authentication, identity management, and authorization services, while also introducing security risks arising from vulnerabilities, misconfigurations, or implementation flaws. Furthermore, different file formats employ different mechanisms for ensuring authenticity and integrity through digital signatures. For example, PDF documents support the PDF Advanced Electronic Signature (PAdES) standard, whereas plain text files typically lack a standardized mechanism for embedding digital signatures. This paper proposes an architecture based on the Selective Disclosure JSON Web Token (SD-JWT) standard for securely sharing read-only files. The proposed architecture embeds cryptographic signatures and integrity protection directly into the shared resource, providing verifiable authenticity without relying on complex IAM infrastructures, such as centralized user databases, authentication services, or authorization mechanisms. By eliminating these components, the proposed solution simplifies deployment while maintaining strong security guarantees for the distribution of immutable resources.