Idemix "Role" is shadowed by marshalled interface

[johannww]

Role is supposed to be an int:

fabric-ca/lib/client.go

Line 517 in b3ae5fc

role, _ := result.Attrs["Role"].(int)

However, probably due to the marshalling of the attrMap (map[string]interface{}), the role becomes a float64 (/golang reddit discussion)

fabric-ca/lib/server/idemix/enroll.go

Lines 156 to 160 in b3ae5fc

	resp := &EnrollmentResponse{
	Credential: b64CredBytes,
	Attrs: attrMap,
	CRI: b64CriBytes,
	}

Possible solutions

1. Cast to float64 before converting to int

	roleFloat, _ := result.Attrs["Role"].(float64) // marshalling interface makes number float64
	role := int(roleFloat)

2. Plus: test for errors

	roleFloat, ok := result.Attrs["Role"].(float64) // marshalling interface makes number float64
	if !ok {
		return nil, errors.New("Failed to convert role to float64")
	}
	role := int(roleFloat)

Replicate

1. Add log messages:

	// Create SignerConfig object with credential bytes from the response
	// and secret key
	role, _ := result.Attrs["Role"].(int)
	ou, _ := result.Attrs["OU"].(string)
	enrollmentID, _ := result.Attrs["EnrollmentID"].(string)
	revocationHandle := result.Attrs[sidemix.AttrRevocationHandle].(string)
	signerConfig := &idemixcred.SignerConfig{
		CurveID:                         cidemix.Curves.ByID(c.curveID),
		Cred:                            credBytes,
		Sk:                              sk.Bytes(),
		Role:                            role,
		OrganizationalUnitIdentifier:    ou,
		EnrollmentID:                    enrollmentID,
		CredentialRevocationInformation: criBytes,
		RevocationHandle:                revocationHandle,
	}

	kind := reflect.TypeOf(result.Attrs["Role"]).Kind()
	log.Infof("kind: %s", kind)
	log.Infof("Attrs: %v", result.Attrs)
	log.Infof("Attrs in signer config: %d", signerConfig.Role)

2. Register and enroll with role 1:

fabric-ca-client register -u http://localhost:27054 --id.name alice --id.secret password --id.type client  --enrollment.type idemix --id.attrs 'role=1' --id.affiliation "org1.department1"
fabric-ca-client enroll -u http://alice:password@localhost:27054  -M "$(pwd)/keys/owner1/wallet/alice/msp" --enrollment.type idemix

3. Verify that the saved SignerConfig has no "role" attribute:

{
    "Cred": "CkQKIC6o6Uz33XosEntANagpoJQdyfpbnacbk/dsW4z3JKqxEiCvo//GIXRKgIi4yt6x3RxwpEXzECXo4mVdqb2DGnYgfxJECiCX+RCJq4l7A75be2pgs0La/ZV6cXpeEHaJlDMkscSVnRIg42VQR/OGpuMOCD2la7VhcBW6BQnPZO0UWtlvER3rCW4aIBWUPW8xgTNI/RTZey6UrfJDd2dExig1hxaO9uS0cRrcIiDEW8biruxGd6vGW97CeznZd1wU0fmxyTv14cXnXBiX2CogO9JiNVuB+erB4v8Cf7ch+8j/aCf59RgcDd5f662qAcUqIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABKiAr2AbJfw4ArxofwzKPp2OpJpcjyNuPrE+Tr3HbGG1ukCoga4ayc/80/OGda4BO/1o/V0etpOqiLx1JwB5S3beHW0s=",
    "Sk": "mcT93zqYeXq+pUgQUZd9E7ryQbUPI/u4DIUkPvgSSb4=",
    "organizational_unit_identifier": "org1.department1",
    "enrollment_id": "alice",
    "credential_revocation_information": "CAESiAEKIP4MM1C0yWwgKFYPV3wokTrOHFOaEr+EPNImFraJwJ77EiBOpmBXc4rAVNta4cY32BO5JN144ofQNYnSae00o35qKxogcCBG58VCo7N2dw11Ek4+Ue/LJHWNYVhI6Qm0gb7cJ/8iIAVU47zTiMKQQu6mSSl+sp+LTL6AghqYs+ASgRFKrQSbGmcwZQIxAJm8eXfyNWdShXp0p1VDLiI+B2Z9sey/udSO51VsCBeYJ8yU0yT48urhM4QuRX01dQIwCm7cbPuN4v60kRpCIYZ0+0ZTLbUo1PJGZAEGbRKx5jSiMalDjlrWDQ641KBpAYT4",
    "curveID": "amcl.Fp256bn",
    "revocation_handle": "1"
}

Context

I was trying to generate testing credentials for the implementation of idemix on fabric-gateway: hyperledger/fabric-gateway#242

[johannww]

Furthermore, the json tag for CurveId differes from the one defined in https://github.com/IBM/idemix:

fabric-ca/lib/client/credential/idemix/signerconfig.go

Line 24 in b3ae5fc

CurveID string `protobuf:"bytes,7,opt,name=curve_id,json=curveID" json:"curveID,omitempty"`

https://github.com/IBM/idemix/blob/832db18b94785ad2657d91da96dd6c3401af1616/idemixmsp/msp_config.pb.go#L134

	// curve_id indicates which Elliptic Curve should be used
	CurveId string `protobuf:"bytes,8,opt,name=curve_id,json=curveId,proto3" json:"curve_id,omitempty"`

[johannww]

There is an incompatibility between the CA and IDEMIX lib regarding the issuer revocation public key file location:

https://github.com/hyperledger/fabric/blob/435a7f1a780a128756fb2f72bf4cad164bf13fbb/vendor/github.com/IBM/idemix/idemixmsp.go#L722:

	IdemixConfigFileRevocationPublicKey = "RevocationPublicKey"

fabric-ca/lib/server/idemix/config.go

Line 23 in b3ae5fc

DefaultRevocationPrivateKeyFile = "IssuerRevocationPrivateKey"

[johannww]

The Fabric CA stores SignerConfig at (msp/user/SignerConfig) a different folder than the one expected by the idemix msp (msp/../user/SignerConfig) :

Also, the Fabric CA exports SignerConfig as json, while the idemix msp expects a proto.

fabric-ca/lib/client.go

Lines 127 to 134 in b3ae5fc

	// Idemix credentials directory
	c.idemixCredsDir = path.Join(mspDir, "user")
	err = os.MkdirAll(c.idemixCredsDir, 0o755)
	if err != nil {
	return errors.Wrap(err, "Failed to create Idemix credentials directory 'user'")
	}
	c.idemixCredFile = path.Join(c.idemixCredsDir, "SignerConfig")

https://github.com/IBM/idemix/blob/832db18b94785ad2657d91da96dd6c3401af1616/idemixmsp.go#L733-L749

	ipkBytes, err := readFile(filepath.Join(dir, IdemixConfigDirMsp, IdemixConfigFileIssuerPublicKey))
...
	revocationPkBytes, err := readFile(filepath.Join(dir, IdemixConfigDirMsp, IdemixConfigFileRevocationPublicKey))       
...
	signerBytes, err := readFile(filepath.Join(dir, IdemixConfigDirUser, IdemixConfigFileSigner))

[bestbeforetoday]

At least some of the issues highlighted here look common to the ones described in #303. That issue has accompanying commits that were subsequently reverted due to breaking incompatibility with legacy client SDKs. The legacy SDKs are no longer supported so we might be in a position to re-apply those commits.

[bestbeforetoday]

@johannww Do the changes in PR #470 address any the issues describes here? If you can confirm those changes are good, I can see about getting them merged.

[johannww]

@bestbeforetoday, in my tests, #470 saves the SignerConfig at the root of the organization dir (e. g. fabric-samples/test-network/organizations/peerOrganizations/org3.example.com/)., instead of the user specific folder (e. g. fabric-samples/test-network/organizations/peerOrganizations/org3.example.com/users/Admin@org3.example.com/). Therefore I could not run an invoke with idemix credentials using:

export CORE_PEER_LOCALMSPID=Org3MSP
export CORE_PEER_LOCALMSPTYPE=idemix
export CORE_PEER_TLS_ROOTCERT_FILE=${PWD}/organizations/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem
export CORE_PEER_MSPCONFIGPATH=${PWD}/organizations/peerOrganizations/org3.example.com/users/Admin@org3.example.com
peer chaincode invoke -C mychannel -n CC_NAME -c '{"Args":["CheckCredAttr","ou"]}' -o localhost:7050 --tls --cafile $ORDERER_TLS_ROOTCERT_FILE