search

iden3 / circuits

Circom circuits used by the iden3 core protocol.
GNU General Public License v3.0
81 stars 14 forks source link

Expiry of issuer's auth claim is not checked #96

Open nedgar opened 1 year ago

nedgar commented 1 year ago

Looking through the query circuits, I see that they check the base claim's expiry, but not the auth claim's. Should they?

I know that in the example scenarios the auth claims are always self-issued, with no expiry. But is it possible for auth claims to be issued by another party, with an expiry?

https://github.com/search?q=repo%3Aiden3/circuits%20verifyExpirationTime&type=code

nedgar commented 1 year ago

FYI @OBrezhniev

OBrezhniev commented 1 year ago

Hi @nedgar! Auth claims must be self-issued and only using claims merkle tree. But in general auth claim expiration could be an interesting feature, we may consider adding the check.