aries-cloudagent-python - how revocation works?

[Shweta-hlf]

Using open rest api demo,Bank agent has created cred_def_id using "support revocation=true" and then created new revocation-registry and update it into tails file and publish this to ledger.Now bank agent issues credential to customer.Credetial is saved into customer wallet with cred_Rev_id.Now Bank wants to revoke issued credential from Customer.but cred_rev_id is with customer credential.
How bank will get cred_Rev_id ?
AS /issue-credential/revoke api require rev_reg_id and cred_rev_id ?
Pls help out.

[swcurran]

The Bank must save the ID somewhere that it decides. This is data that the Controller would save in a database -- it shouldn't be kept in the Bank's agent storage. Typically, it would be stored in the bank's account tracking system.

[Shweta-hlf]

Thanks a lot Stephen for your quick reply....!!!
Here Cred_rev_id is auto incremented when credential issue.I am not able to customize with new value by using "cred_rev_id" or "revocation_id" while sending credential.

[sklump]

Cred rev id is not customizable. It is an index into a tails file.

[sklump]

The issuer agent generates the Revocation registry identifier with the revocation registry. It is not customizable either.

[swcurran]

Not sure about this, but should the algorithm for selection of a credential be more complex than incrementing from one? E.g. are we potentially leaking metadata if we give out the indices in order.

I'm asking -- not sure. Obviously tracking gets much more difficult if we don't just increment through the registry.

[andrewwhitehead]

We don't have a choice given the interface in the current indy-sdk. It could be something to look at in future revocation designs.

[sklump]

It is just an identifier. There is no reason why it should be anything other than an index. There is nothing wrong with an increment. Tails files are public, there is no sensitive data leaking here.

[swcurran]

Closing this as answered.

[Shweta-hlf]

Thanks a lot for your answer.Cred_Rev_Id is stored into holder wallet while issuer has revocation id (same as cred_rev_id) will get from /issue-credential/records.