Skip to content

Commit 6ada4eb

Browse files
committed
updates
Signed-off-by: Angelo De Caro <[email protected]>
1 parent 064204f commit 6ada4eb

File tree

20 files changed

+851
-1170
lines changed

20 files changed

+851
-1170
lines changed

docs/driverapi.md

Lines changed: 5 additions & 377 deletions
Large diffs are not rendered by default.

docs/drivers/dlogwogh.md

Lines changed: 356 additions & 0 deletions
Large diffs are not rendered by default.

docs/drivers/fabtoken.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# FabToken
2+
3+
FabToken is a straightforward implementation of the Driver API.
4+
It prioritizes simplicity over privacy, storing all token transaction details openly on the ledger for anyone with access to view ownership and activity.
5+
FabToken exclusively supports long-term identities based on a standard X.509 certificate scheme,
6+
which reveals the owner's enrollment ID in plain text.
7+
Tokens are directly represented on the ledger as JSON-formatted data based on the `token.Token` structure.
8+
The `Owner` field of this structure stores the identity information.
9+
The `Identity Service` handles the encoding/decoding of this field.
10+
11+
## Security
12+
13+
`FabToken` does not provide privacy for tokens or identities.
14+
The validator guarantees the following:
15+
* **Issuer Authorization**: Only issuers listed in the public parameters can issue tokens.
16+
* **Auditor Authorization**: Only auditors listed in the public parameters can audit transactions.
17+
* **Owner Authorization**: Only legitimate owners can spend their tokens.
18+
* **Value Preservation**: In a transfer, the sum of inputs matches the sum of outputs.

docs/services/identity.md

Lines changed: 160 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
# Identity Service
22

3-
The **Identity Service** (`token/services/identity`) provides a unified interface for managing identities, signatures, and verification within the Fabric Token SDK. It abstracts the underlying cryptographic details, allowing the SDK to support multiple identity types (e.g., X.509, Idemix) and different storage backends seamlessly.
3+
The **Identity Service** (`token/services/identity`) provides a unified interface for managing identities, signatures, and verification within the Fabric Token SDK.
4+
It abstracts the underlying cryptographic details, allowing the SDK to support multiple identity types (e.g., X.509, Idemix) and different storage backends seamlessly.
45

56
This service is a fundamental component used by token drivers and other services (like the Token Transaction (TTX) service) to handle:
67
* **Signatures**: Generating and verifying signatures for transactions.
@@ -10,87 +11,177 @@ This service is a fundamental component used by token drivers and other services
1011

1112
## Architecture
1213

13-
The core of the service is the `Provider` struct, which implements the `driver.IdentityProvider` interface. It orchestrates interactions between:
14-
15-
1. **Storage**: Persists identity data, including audit information, secrets (via keystore), and bindings between wallets and identities.
16-
2. **Deserializers**: Parses raw identity bytes into typed identity structures (e.g., converting an Idemix byte array into a usable object).
17-
3. **Signers and Verifiers**: Interfaces for cryptographic operations.
18-
4. **Binder**: Handles binding long-term identities to ephemeral ones.
19-
20-
### Key Components
21-
22-
* **`Provider`** (`token/services/identity/provider.go`): The main entry point. It manages caches for signers and "is-me" checks to optimize performance.
23-
* **`Storage`** (`token/services/identity/driver/storage.go`): Interface for the underlying storage. It handles storing and retrieving audit info, token metadata, and signer info.
24-
* **`Role`** (`token/services/identity/driver/role.go`): Defines abstract roles (Issuer, Auditor, etc.) and how they map to long-term identities.
25-
26-
## Identity Types
27-
28-
The service supports multiple identity types, extensible via drivers. The two primary built-in types are:
14+
The Identity Service is designed to implement the **Driver API** interfaces defined in `token/driver/wallet.go`.
15+
This ensures that the token management system can interact with any identity implementation through a standard set of methods.
16+
17+
### Conceptual Metaphor
18+
19+
To better understand the components, imagine a **Corporate Security Department**:
20+
21+
* **Identity Service (The Department)**: The entire division responsible for security and access.
22+
* **Wallet Service (The Keymaster)**: Maintains a registry of all employees (Wallets) and the badges (Keys) they possess. It knows who has access to what.
23+
* **Identity Provider (The Passport Office)**: Verifies identities. It checks if a badge is authentic and extracts information from it (Project ID, Department ID).
24+
* **Roles (Job Titles)**: Groups of employees with similar access rights (e.g., "Auditors" have special keys to view records, "Issuers" have keys to create assets).
25+
* **Key Managers (The Badge Makers)**: The specific machines or protocols used to create the badges (e.g., one machine makes standard plastic cards (X.509), another makes high-tech smart cards (Idemix)).
26+
27+
### Component Mapping
28+
29+
Here is how the service components map to the Driver API:
30+
31+
| Component | Implements Driver Interface | Description |
32+
|:-----------------------|:----------------------------|:------------------------------------------------------|
33+
| `identity.Provider` | `driver.IdentityProvider` | Core identity management & verification. |
34+
| `wallet.Service` | `driver.WalletService` | Registry for all wallets (Owner, Issuer, etc.). |
35+
| `role.LongTermOwnerWallet` | `driver.OwnerWallet` | Long Term Identity-based Onwer wallet functionality. |
36+
| `role.AnonymousOwnerWallet` | `driver.OwnerWallet` | Anonymous Identity-based Onwer wallet functionality. |
37+
| `role.IssuerWallet` | `driver.IssuerWallet` | Issuer wallet functionality. |
38+
| `role.AuditorWallet` | `driver.AuditorWallet` | Auditor wallet functionality. |
39+
| `role.CertifierWallet` | `driver.CertifierWallet` | Certifier wallet functionality. |
40+
41+
### Component Interaction Diagram
42+
43+
```mermaid
44+
classDiagram
45+
direction TB
46+
%% Driver Interfaces
47+
class IdentityProvider {
48+
<<interface>>
49+
+GetSigner()
50+
+GetAuditInfo()
51+
+IsMe()
52+
}
53+
class WalletService {
54+
<<interface>>
55+
+OwnerWallet()
56+
+IssuerWallet()
57+
+RegisterRecipientIdentity()
58+
}
59+
60+
%% Concrete Implementations
61+
class identity.Provider {
62+
-Storage
63+
-Deserializers
64+
-SignerCache
65+
}
66+
class wallet.Service {
67+
-RoleRegistry
68+
-IdentityProvider
69+
-OwnerWallet
70+
-IssuerWallet
71+
-AuditorWallet
72+
-CertifierWallet
73+
}
74+
class role.Role {
75+
-LocalMembership
76+
+GetIdentityInfo()
77+
}
78+
class membership.KeyManagerProvider {
79+
<<interface>>
80+
+Get() KeyManager
81+
}
82+
83+
identity.Provider ..|> IdentityProvider : Implements
84+
wallet.Service ..|> WalletService : Implements
85+
wallet.Service --> identity.Provider : Uses
86+
wallet.Service --> role.Role : Uses (via RoleRegistry)
87+
role.Role --> membership.KeyManagerProvider : Uses (via LocalMembership)
88+
89+
note for identity.Provider "Handles low-level crypto\nand identity verification"
90+
note for wallet.Service "High-level management\nof wallets and roles"
91+
```
2992

30-
### 1. X.509
31-
Standard PKIX identities.
32-
* **Transparency**: Identity is known.
33-
* **Usage**: Typically used for component identification (e.g., orderingers, peers) or when anonymity is not required.
34-
* **Implementation**: Located in `token/services/identity/x509`.
93+
### LocalMembership
3594

36-
### 2. Idemix (Identity Mixer)
37-
Zero-Knowledge Proof (ZKP) based identities.
38-
* **Anonymity**: Allows users to prove possession of a credential without revealing the credential itself.
39-
* **Unlinkability**: Transactions cannot be linked to the same user.
40-
* **Auditability**: Special "audit info" allows authorized auditors to reveal the identity if needed.
41-
* **Implementation**: Located in `token/services/identity/idemix`.
95+
The `LocalMembership` component (`token/services/identity/membership`) plays a pivotal role in managing local identities for a specific role (e.g., Owner, Issuer).
4296

43-
## Usage
97+
* **Binding**: Each instance is bound to a list of **Key Managers**.
98+
* **Identity Wrapping**: When a Key Manager generates an identity (based on the configuration), `LocalMembership` automatically wraps it using `WrapWithType`.
99+
This ensures that the generated identity carries the correct type information required by the system (as defined in `token/services/identity/typed.go`).
100+
* **Role Implementation**: `LocalMembership` serves as the foundational implementation for `role.Role`.
101+
When you interact with a Role to resolve an identity or sign a transaction, you are effectively delegating to the underlying `LocalMembership`.
44102

45-
### Retrieving the Identity Provider
46-
The Identity Provider is usually accessed via the `Token Management Service` (TMS) API or injected into other services.
103+
### Example: Wiring Services
47104

48-
### Getting a Signer
49-
To sign a message with a specific identity:
105+
The following example demonstrates how these services are instantiated and wired together, as seen in the ZKATDLog driver:
50106

51107
```go
52-
// identity is of type driver.Identity (byte array)
53-
signer, err := identityProvider.GetSigner(ctx, identity)
54-
if err != nil {
55-
return err
108+
func (d *Base) NewWalletService(...) (*wallet.Service, error) {
109+
// 1. Create Identity Provider
110+
identityProvider := identity.NewProvider(...)
111+
112+
// 2. Initialize Membership Role Factory
113+
roleFactory := membership.NewRoleFactory(...)
114+
115+
// 3. Configure Key Managers (e.g. Idemix and X.509 for Owner role)
116+
// we have one key manager to handle fabtoken tokens and one for each idemix issuer public key in the public parameters
117+
kmps := make([]membership.KeyManagerProvider, 0)
118+
// ... add Idemix Key Manager Providers ...
119+
kmps = append(kmps, x509.NewKeyManagerProvider(...))
120+
121+
// 4. Create and Register Roles
122+
roles := role.NewRoles()
123+
124+
// Owner Role (with anonymous identities)
125+
ownerRole, err := roleFactory.NewRole(identity.OwnerRole, true, nil, kmps...)
126+
roles.Register(identity.OwnerRole, ownerRole)
127+
128+
// Issuer Role (no anonymous identities)
129+
issuerRole, err := roleFactory.NewRole(identity.IssuerRole, false, pp.Issuers(), x509.NewKeyManagerProvider(...))
130+
roles.Register(identity.IssuerRole, issuerRole)
131+
132+
// ... Register Auditor and Certifier roles ...
133+
134+
// 5. Create Wallet Service with the registered roles
135+
return wallet.NewService(
136+
logger,
137+
identityProvider,
138+
deserializer,
139+
// Convert the roles registry into the format expected by the wallet service
140+
wallet.Convert(roles.Registries(...)),
141+
), nil
56142
}
57-
58-
signature, err := signer.Sign(message)
59143
```
60144

61-
### Verifying a Signature
62-
Unless you have the `Verifier` directly, verification often happens implicitly during transaction processing or via the `Deserializer` if you need to manually verify:
63-
64-
```go
65-
verifier, err := deserializer.DeserializeVerifier(ctx, identity)
66-
if err != nil {
67-
return err
68-
}
69-
70-
err = verifier.Verify(message, signature)
71-
```
145+
## Identity Types
72146

73-
### Checking "Is Me"
74-
To check if a given identity belongs to the local node (i.e., we have the private key for it):
147+
The Identity Service leverages a wrapper called **TypedIdentity** to support various identity schemes uniformly.
148+
This allows the SDK to be extensible and capable of handling different cryptographic requirements.
75149

76-
```go
77-
if identityProvider.IsMe(ctx, identity) {
78-
// This identity is managed by this node
79-
}
80-
```
150+
### TypedIdentity
81151

82-
### Audit Information
83-
For anonymous identities (Idemix), "Audit Information" is a crucial concept. It contains the data needed to de-anonymize the identity (e.g., to checking against a revocation list or for regulatory auditing).
152+
`TypedIdentity` (defined in `token/services/identity/typed.go`) acts as a generic container.
153+
It wraps the raw identity bytes with a type label, enabling the system to verify deserializers and process signatures correctly without hardcoding implementation details.
154+
* **Structure**: Contains a `Type` (string) and the `Identity` (raw bytes).
84155

85-
```go
86-
// Retrieve the Enrollment ID from audit info
87-
eid, err := identityProvider.GetEnrollmentID(ctx, identity, auditInfo)
88-
```
156+
### Default Key Managers
89157

90-
## Storage & Caching
91-
The service aggressively caches:
92-
* **Signers**: Once deserialized/created, signers are cached to avoid expensive re-initialization.
93-
* **"Is Me" Checks**: Results of ownership checks are cached to speed up transaction filtering.
158+
The identity service includes two primary implementations for concrete identities:
94159

95-
## Integration with Drivers
96-
Token drivers (like the UTXO driver) heavily rely on this service. They delegate identity management tasks to it, ensuring that the driver code remains agnostic to the specific identity technology (X.509 vs Idemix) being used.
160+
#### 1. X.509
161+
Standard PKIX identities.
162+
* **Transparency**: Verification reveals the identity of the signer.
163+
* **Usage**: Ideal for infrastructure components (nodes, services) or scenarios where anonymity is not required.
164+
* **Implementation**: `token/services/identity/x509`.
165+
166+
#### 2. Idemix (Identity Mixer)
167+
Advanced identity encryption based on Zero-Knowledge Proofs (ZKP).
168+
* **Anonymity**: Users can prove they hold a valid credential without revealing their actual identity.
169+
* **Unlinkability**: Different transactions from the same user appear uncorrelated.
170+
* **Auditability**: Includes "audit info" facilitating regulatory compliance by allowing authorized auditors to reveal the identity.
171+
* **Implementation**: `token/services/identity/idemix`.
172+
173+
### Other Identity Types
174+
175+
The architecture supports specialized identity types for complex use cases:
176+
177+
#### Multisig
178+
Located in `token/services/identity/multisig`.
179+
* **Concept**: An identity that wraps multiple sub-identities.
180+
* **Usage**: Useful for requiring multiple signatures or representing a group of parties.
181+
* **Auditability**: Aggregates audit information for all underlying identities.
182+
183+
#### HTLC (Hashed Time Lock Contract)
184+
Located in `token/services/identity/interop/htlc`.
185+
* **Concept**: A script-based identity used primarily for interoperability mechanisms like atomic swaps.
186+
* **Structure**: Encapsulates a **Sender** identity, a **Recipient** identity, hash lock information, and a timeout.
187+
* **Behavior**: Validation involves satisfying the script conditions (e.g., providing the hash preimage).

docs/tokenapi.md

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,6 @@ The Token API empowers developers with essential operations:
3333

3434
**Token Requests** bundle these operations, ensuring they are executed atomically; meaning all operations succeed or fail together.
3535

36-
3736
## Token Management Service and Provider
3837

3938
The Token Management Service (TMS) acts as the central hub for the Token SDK.

token/driver/identity.go

Lines changed: 0 additions & 54 deletions
This file was deleted.

token/driver/wallet.go

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,51 @@ package driver
99
import (
1010
"context"
1111

12+
"github.com/hyperledger-labs/fabric-smart-client/platform/view/view"
1213
"github.com/hyperledger-labs/fabric-token-sdk/token/token"
1314
)
1415

16+
// Identity represents a generic identity
17+
type Identity = view.Identity
18+
19+
// IdentityProvider manages identity-related concepts like signature signers, verifiers, audit information, and so on.
20+
//
21+
//go:generate counterfeiter -o mock/ip.go -fake-name IdentityProvider . IdentityProvider
22+
type IdentityProvider interface {
23+
// RegisterRecipientData stores the passed recipient data
24+
RegisterRecipientData(ctx context.Context, data *RecipientData) error
25+
26+
// GetAuditInfo returns the audit information associated to the passed identity, nil otherwise
27+
GetAuditInfo(ctx context.Context, identity Identity) ([]byte, error)
28+
29+
// GetSigner returns a Signer for passed identity.
30+
GetSigner(ctx context.Context, identity Identity) (Signer, error)
31+
32+
// RegisterSigner registers a Signer and a Verifier for passed identity.
33+
RegisterSigner(ctx context.Context, identity Identity, signer Signer, verifier Verifier, signerInfo []byte, ephemeral bool) error
34+
35+
// AreMe returns the hashes of the passed identities that have a signer registered before
36+
AreMe(ctx context.Context, identities ...Identity) []string
37+
38+
// IsMe returns true if a signer was ever registered for the passed identity
39+
IsMe(ctx context.Context, party Identity) bool
40+
41+
// GetEnrollmentID extracts the enrollment ID from the passed audit info
42+
GetEnrollmentID(ctx context.Context, identity Identity, auditInfo []byte) (string, error)
43+
44+
// GetRevocationHandler extracts the revocation handler from the passed audit info
45+
GetRevocationHandler(ctx context.Context, identity Identity, auditInfo []byte) (string, error)
46+
47+
// GetEIDAndRH returns both enrollment ID and revocation handle
48+
GetEIDAndRH(ctx context.Context, identity Identity, auditInfo []byte) (string, string, error)
49+
50+
// Bind binds longTerm to the passed ephemeral identities.
51+
Bind(ctx context.Context, longTerm Identity, ephemeralIdentities ...Identity) error
52+
53+
// RegisterRecipientIdentity register the passed identity as a third-party recipient identity.
54+
RegisterRecipientIdentity(ctx context.Context, id Identity) error
55+
}
56+
1557
// RecipientData contains information about the identity of a token owner
1658
type RecipientData struct {
1759
// Identity is the identity of the token owner

0 commit comments

Comments
 (0)