search

hyperledger / anoncreds-rs

anoncreds-rs
https://wiki.hyperledger.org/display/anoncreds
Apache License 2.0
74 stars 55 forks source link

Non revocation proof cannot be parsed by Indy-SDK #286

Open conanoc opened 11 months ago

conanoc commented 11 months ago

version: anoncreds-rs v0.2.0-dev.4

Non revocation proof created by anoncreds-rs fails to be parsed by Indy-SDK. This is due to anoncreds-clsignatures-rs, and I filed an issue there: https://github.com/hyperledger/anoncreds-clsignatures-rs/issues/37

swcurran commented 11 months ago

This requires a fix to the Indy SDK. The change in the format in the presentation is necessary.

It might be possible to code around the issue in the Indy SDK if anyone is interested in taking that path.

The (strong) recommendation is to upgrade from the Indy SDK to use the shared components.

TimoGlastra commented 11 months ago

Why would this require a change in the indy-sdk? was the change in anoncreds-cl-signatures made because of a security concern?

Because it would mean all deployments now using Indy SDK will be broken and this has quite some implications for adopting AnonCreds RS v0.2 over v0.1 as you don't always control the verifier (the important part here it seems)

swcurran commented 11 months ago

This was made because of a vulnerability. We let Aries maintainers know some time ago about it, and will be publishing the vulnerability information soon.