search

0xPolygonID / issuer-node

Privado ID Self-Hosted Issuer Node
Apache License 2.0
86 stars 81 forks source link

Will using random numbers in Claim's RevNonce cause problems? #663

Closed yushihang closed 4 months ago

yushihang commented 4 months ago

The following code show that, the revocation nonce of the issuer's authClaim and claims/credentials issued to holders uses random numbers.

https://github.com/0xPolygonID/issuer-node/blob/7e0c6612a5b29cf48b1732ac5f5a89f12085e692/internal/core/services/identity.go#L1127

https://github.com/0xPolygonID/issuer-node/blob/7e0c6612a5b29cf48b1732ac5f5a89f12085e692/internal/core/services/claims.go#L132

The random algorithm used by both is the same. https://github.com/0xPolygonID/issuer-node/blob/7e0c6612a5b29cf48b1732ac5f5a89f12085e692/pkg/rand/rand.go#L8-L14 https://github.com/0xPolygonID/issuer-node/blob/7e0c6612a5b29cf48b1732ac5f5a89f12085e692/internal/common/util.go#L84-L91

Is it possible that the same revocationNonce may appear between different claims issued by the issuer to holders, as well as between these claims and the issuer's own authClaim?

Will this cause problems with the revocation of these claims? For example, when revoking one of them, will it mistakenly cause the other claim(with same revNonce) to be considered as revoked?

martinsaporiti commented 4 months ago

hi, the random number is assigned if the nonce is not specified when a claim is created. There is a parameter to do it: link. Same rev nonce could be a problem in some contexts because all the claims with that nonce will be revoked.

regarding your question: "Is it possible that the same revocationNonce may appear between different claims issued by the issuer to holders, as well as between these claims and the issuer's own authClaim?" yes it's possible but unlikely. btw authClaim rev nonce is 0.

yushihang commented 4 months ago

Thank you for your response.

btw authClaim rev nonce is 0.

From the code below, it seems that the issuer may create an identity with a random number as revNonce when creating an identity?

https://github.com/0xPolygonID/issuer-node/blob/7e0c6612a5b29cf48b1732ac5f5a89f12085e692/internal/core/services/identity.go#L1125-L1135

martinsaporiti commented 4 months ago

Hi @yushihang after calling that method rev nonce is set to 0: https://github.com/0xPolygonID/issuer-node/blob/7e0c6612a5b29cf48b1732ac5f5a89f12085e692/internal/core/services/identity.go#L709. Thanks

yushihang commented 4 months ago

A very clear answer, thank you for your patience in answering.