exercise-3-solution.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "2856edce-b316-4d47-a561-668a4edc2bc0",
   "metadata": {},
   "source": [
    "# Solutions for Exercise 3 - Range proofs with ZKPs\n",
    "\n",
    "This only holds the answer to the questions, and the solution to the last coding exercise."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "54ecc8ab-24e2-4fb6-9499-1a47977a62e2",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## 1 - Challenges for Issuer - Setting up and signing a credential"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "26a04d81-9345-4bac-9a53-5cc15d5fd592",
   "metadata": {},
   "outputs": [],
   "source": [
    "// Defining the schema and one credential.\n",
    "const E_ID_SCHEMA = {\n",
    "    type: 'object',\n",
    "    properties: {\n",
    "        name: { type: 'string' },\n",
    "        // CHALLENGE 1.3\n",
    "        placeOfOrigin: { type: 'string' },\n",
    "        profession: { type: 'string' },\n",
    "        timeOfBirth: { type: 'integer', minimum: 0},\n",
    "        postalCode: {type: 'integer', minimum: 1000, maximum: 9999},\n",
    "        height: {type: 'integer', minimum: 130, maximum: 210},\n",
    "        weight: {type: 'number', minimum: 40, multipleOf: 0.1}\n",
    "    }\n",
    "}\n",
    "\n",
    "const E_ID_DATA = {\n",
    "    name: \"Jack Sparrow\",\n",
    "    // CHALLENGE 1.3\n",
    "    placeOfOrigin: \"Vierwaldstättersee\",\n",
    "    timeOfBirth: new Date(\"1993-08-01T00:00:00\").getTime(),\n",
    "    postalCode: 1000,\n",
    "    profession: \"IT Manager\",\n",
    "    height: 176,\n",
    "    // CHALLENGE 1.1: we had a good meal, so increase the weight.\n",
    "    weight: 90\n",
    "}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1c30011b-a462-4096-8666-2845db3362a1",
   "metadata": {},
   "outputs": [],
   "source": [
    "import { initializeWasm, BBSKeypair, BBSSignatureParams, BBS_SIGNATURE_PARAMS_LABEL_BYTES,\n",
    "        CredentialSchema, BBSCredentialBuilder, BBSCredential, SUBJECT_STR,\n",
    "       KBUniversalAccumulator, dockAccumulatorParams, STATUS_STR, REV_ID_STR,\n",
    "       NON_MEM_CHECK_STR, RevocationStatusProtocol } from '@docknetwork/crypto-wasm-ts'\n",
    "await initializeWasm();\n",
    "const stringToBytes = (str: string) => Uint8Array.from(Buffer.from(str, \"utf-8\"));\n",
    "\n",
    "// Generating a keypair for the issuer.\n",
    "// We suppose that there is a PKI available which lets the verifier\n",
    "// know the public key of the issuer.\n",
    "const params = BBSSignatureParams.generate(100, BBS_SIGNATURE_PARAMS_LABEL_BYTES);\n",
    "const keypair = BBSKeypair.generate(params, stringToBytes('seed1'));\n",
    "const secretKey = keypair.secretKey;\n",
    "const publicKey = keypair.publicKey;\n",
    "\n",
    "// Issuing a credential based on the E-ID data based on the specified schema,\n",
    "// and sign it using the BBS+ library.\n",
    "const baseSchema = CredentialSchema.essential();\n",
    "baseSchema.properties[SUBJECT_STR] = E_ID_SCHEMA;\n",
    "// CHALLENGE 6 - add the status (revoked or not) to the schema\n",
    "baseSchema.properties[STATUS_STR] = CredentialSchema.statusAsJsonSchema();\n",
    "const eIDSchema = new CredentialSchema(baseSchema);\n",
    "\n",
    "// CHALLENGE 6 - Setting up an accumulator and a witness of non-inclusion\n",
    "const accumulatorKP = KBUniversalAccumulator.generateKeypair(dockAccumulatorParams());\n",
    "const accumulatorSk = accumulatorKP.secretKey;\n",
    "const accumulatorPk = accumulatorKP.publicKey;\n",
    "const users = ['user1', 'user2'];\n",
    "const users_encoded = users.map((user) => eIDSchema.encoder.encodeMessage(`${STATUS_STR}.${REV_ID_STR}`, user));\n",
    "const accumulator = await KBUniversalAccumulator.initialize(users_encoded, dockAccumulatorParams(), accumulatorSk);\n",
    "\n",
    "// CHALLENGE 6 - Creating the witness that this user hasn't been added to the accumulator.\n",
    "const nonMemWitness = await accumulator.nonMembershipWitness(users_encoded[0], accumulatorSk);\n",
    "accumulator.add(users_encoded[0], accumulatorSk);\n",
    "\n",
    "const builder = new BBSCredentialBuilder();\n",
    "builder.schema = eIDSchema;\n",
    "builder.subject = E_ID_DATA;\n",
    "// CHALLENGE 6 - Add the encoded userID to the credential.\n",
    "builder.setCredentialStatus('dock:accumulator:accumId123', NON_MEM_CHECK_STR, users[0], RevocationStatusProtocol.KbUni24);\n",
    "const credential = builder.sign(secretKey);\n",
    "\n",
    "// This is the data which is sent to the holder.\n",
    "const credentialToSendToHolder = credential.toJSON();\n",
    "console.log(\"This data is sent to the holder:\", credentialToSendToHolder);"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4e504af0-e03f-4529-9928-92514c5927e1",
   "metadata": {},
   "source": [
    "### Challenges\n",
    "\n",
    "1. Change the content of the credential\n",
    "\n",
    "> Done in the creation of the credential.\n",
    "\n",
    "2. Why is the `timeOfBirth` not a string like \"21st of March 1998\"?\n",
    "\n",
    "> It is much more lightweight for a ZKP to prove that a positive number\n",
    "> is in a given range than to create a proof for a string.\n",
    "> An intuition is that for a number, the ZKP can directly prove that\n",
    "> a certain bit-pattern is given.\n",
    "> Whereas proving that a string represents a date within a given range\n",
    "> requires much more description.\n",
    "\n",
    "3. Add a new field to the credential, but don't forget to also add it to the schema\n",
    "\n",
    "> Done in the creation of the credential."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f4db5ab7-20f8-49ae-8f75-b9cfc14404a3",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## 2 - Challenges for Creating a range proof using LegoGroth16"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "493d049b-3267-4826-a621-4bb8027830cb",
   "metadata": {},
   "outputs": [],
   "source": [
    "// The verifier is responsible for creating these keys, then sharing only the proving key with \n",
    "// the credential holder.\n",
    "import { BoundCheckSnarkSetup, SetupParam } from '@docknetwork/crypto-wasm-ts';\n",
    "const provingKey = BoundCheckSnarkSetup();\n",
    "const snarkProvingKey = provingKey.decompress();\n",
    "const snarkVerifyingKey = provingKey.getVerifyingKeyUncompressed();"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b70c8b80-d9c7-4f37-b36f-2306d4386b9e",
   "metadata": {},
   "outputs": [],
   "source": [
    "import { PresentationBuilder } from '@docknetwork/crypto-wasm-ts'\n",
    "\n",
    "// The holder creates a proof for their height, as requested from the verifier.\n",
    "// Instead of signing it, they call `finalize` to create the proof.\n",
    "// The use-case is left as an exercise to the reader.\n",
    "// My oldest daughter once convinced my youngest daughter that there is a minimal height\n",
    "// for admission to UNIL, to avoid people signing up their dogs.\n",
    "const builder = new PresentationBuilder();\n",
    "builder.addCredential(credential, publicKey)\n",
    "builder.markAttributesRevealed(0, new Set<string>(['credentialSubject.name', 'credentialSubject.profession']));\n",
    "\n",
    "// CHALLENGE 2.1\n",
    "// This will fail, as the holder cannot create that proof.\n",
    "// builder.enforceBounds(0, 'credentialSubject.height', 70, 90, 'heightRangeCheck', snarkProvingKey);\n",
    "// Create a proof that `170 <= height < 190`\n",
    "builder.enforceBounds(0, 'credentialSubject.height', 170, 190, 'heightRangeCheck', snarkProvingKey);\n",
    "\n",
    "// CHALLENGE 2.3 and 2.4\n",
    "// Create a proof that `80 <= weight < 100`\n",
    "builder.enforceBounds(0, 'credentialSubject.weight', 80, 100, 'weightRangeCheck', snarkProvingKey);\n",
    "\n",
    "// CHALLENGE 5.1\n",
    "// Create a proof that the holder is above 18.\n",
    "// Calculate the latest birthday allowed for the holder to be at least\n",
    "// 18 years old.\n",
    "const currentDate = new Date();\n",
    "const nowMinus18Years = new Date(currentDate.setFullYear(currentDate.getFullYear())).getTime();\n",
    "builder.enforceBounds(0, 'credentialSubject.timeOfBirth', 0, nowMinus18Years, 'ageCheck', snarkProvingKey);\n",
    "// CHALLENGE 6 - Add the proof of non-inclusion in the accumulator.\n",
    "builder.addAccumInfoForCredStatus(0, nonMemWitness, accumulator.accumulated, accumulatorPk);\n",
    "const presentation = builder.finalize();\n",
    "\n",
    "// This is a serialized version, to be sent across an API to the verifier.\n",
    "const lgProofForVerifier = presentation.toJSON();\n",
    "console.log(\"Data sent to verifier:\", lgProofForVerifier);"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9a7ae62e-a246-4aa0-91d3-f95f9d1a58bf",
   "metadata": {},
   "outputs": [],
   "source": [
    "import { Presentation } from '@docknetwork/crypto-wasm-ts'\n",
    "\n",
    "// Now the verifier can check whether the proof is valid.\n",
    "// CHALLENGE 2.3, 2.4, and 5.1\n",
    "// Add the additional / modified range check here, using the same verifying key.\n",
    "const predicateParams = new Map([['heightRangeCheck', snarkVerifyingKey],\n",
    "                                ['weightRangeCheck', snarkVerifyingKey],\n",
    "                                ['ageCheck', snarkVerifyingKey]]);\n",
    "\n",
    "// CHALLENGE 6 - Hand over the public key of the accumulator to the verify method.\n",
    "// Here we don't check for the up-to-date accumulator.\n",
    "const accParams = new Map([[0, accumulatorPk]]);\n",
    "const recreatedPres = Presentation.fromJSON(lgProofForVerifier)\n",
    "console.log(\"Verification succeeded:\", recreatedPres.verify([publicKey], accParams, predicateParams).verified);\n",
    "console.log(\"Revealed attributes:\");\n",
    "console.dir(recreatedPres.spec.credentials[0].revealedAttributes, {depth: null});\n",
    "console.log(\"Bounds proven:\");\n",
    "console.dir(recreatedPres.spec.credentials[0].bounds, {depth: null});\n",
    "console.log(\"Revocation check:\", recreatedPres.spec.credentials[0].status.revocationCheck);"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fde7cff9-44ab-4096-843f-16f3eacfa2c0",
   "metadata": {
    "jp-MarkdownHeadingCollapsed": true
   },
   "source": [
    "### Challenges\n",
    "\n",
    "1. What happens if you try to create a proof which is not satisfied by the credential? Why?\n",
    "\n",
    "> The proof creation will fail, as it is not possible to create a mathematical represention\n",
    "> of a wrong proof.\n",
    "> \n",
    "> For most of the SNARKs the creator of the setup could use their `verifierKey` to create\n",
    "> any proof.\n",
    "> This is the reason that the setup phase is critical, and that the machine doing the setup\n",
    "> is trusted.\n",
    "> If it's only to prove something from the holder to the verifier, this is less of a problem,\n",
    "> as the verifier is not interested to cheat on the proof it receives.\n",
    "\n",
    "2. How does the verifier know the bounds check performed? Does it need this information? Why (not)?\n",
    "\n",
    "> In a normal interaction, the verifier will send the bounds check to be performed to\n",
    "> the holder.\n",
    "> The library will include these bound checks in the proof being sent to the verifier.\n",
    "> First of all the verifier needs to verify that the bound checks are what it wants\n",
    "> them to be.\n",
    ">\n",
    "> Next the verifier needs to create the `statement x` which needs the bound checks.\n",
    "> Once the `statement x` is created, the verifier can call it using the proof of the\n",
    "> holder.\n",
    "> If the proof is correct, the `statement x` will run successfully.\n",
    "\n",
    "3. Change the proof to be on a different field of the credential\n",
    "4. Add a second range proof\n",
    "\n",
    "> Both are implemented using a second range proof on the weight."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e52b7bb0-8148-4721-9cb9-fd231bf42cdf",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## 3 - Challenges for Creating a range proof using Bulletproofs++"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "43d435dc-c634-47ac-b018-58fd4310998a",
   "metadata": {},
   "outputs": [],
   "source": [
    "import { BoundCheckBppParams, PresentationBuilder } from '@docknetwork/crypto-wasm-ts'\n",
    "\n",
    "// The holder creates a proof for their height, as requested from the verifier.\n",
    "// Instead of signing it, they call `finalize` to create the proof.\n",
    "const builder = new PresentationBuilder();\n",
    "builder.addCredential(credential, publicKey);\n",
    "builder.markAttributesRevealed(0, new Set<string>(['credentialSubject.name', 'credentialSubject.profession']));\n",
    "const boundCheckBppParams1 = new BoundCheckBppParams(stringToBytes('Common Reference String')).decompress();\n",
    "builder.enforceBounds(0, 'credentialSubject.height', 170, 190, 'heightRangeCheck', boundCheckBppParams1);\n",
    "\n",
    "// CHALLENGE 5.2\n",
    "builder.enforceBounds(0, 'credentialSubject.postalCode', 1000, 1199, 'VaudCheck', boundCheckBppParams1);\n",
    "\n",
    "// CHALLENGE 6 - Add the proof of absence in the accumulator to the proof.\n",
    "builder.addAccumInfoForCredStatus(0, nonMemWitness, accumulator.accumulated, accumulatorPk);\n",
    "const presentation = builder.finalize();\n",
    "\n",
    "// This is a serialized version, to be sent across an API to the verifier.\n",
    "const bpProofForVerifier = presentation.toJSON()\n",
    "console.log(\"Data sent to the verifier:\");\n",
    "console.dir(bpProofForVerifier, {depth: null});"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b07e3e40-da17-4c0d-ac31-66e3c750aaa5",
   "metadata": {},
   "outputs": [],
   "source": [
    "import { Presentation } from '@docknetwork/crypto-wasm-ts'\n",
    "\n",
    "// The verifier now proceeds to check the proof to see if it's valid.\n",
    "const boundCheckBppParams2 = new BoundCheckBppParams(stringToBytes('Common Reference String')).decompress();\n",
    "const predicateParams1 = new Map([['heightRangeCheck', boundCheckBppParams2],\n",
    "                                 ['VaudCheck', boundCheckBppParams2]]);\n",
    "\n",
    "// CHALLENGE 6 - Hand over the public key of the accumulator to the verify method.\n",
    "// Here we don't check for the up-to-date accumulator.\n",
    "const accParams = new Map([[0, accumulatorPk]]);\n",
    "const recreatedPres = Presentation.fromJSON(bpProofForVerifier);\n",
    "console.log(\"Verification succeeded:\", recreatedPres.verify([publicKey], accParams, predicateParams1).verified);\n",
    "\n",
    "console.log(\"Revealed attributes:\");\n",
    "console.dir(recreatedPres.spec.credentials[0].revealedAttributes, {depth: null});\n",
    "console.log(\"Bounds proven:\");\n",
    "console.dir(recreatedPres.spec.credentials[0].bounds, {depth: null});\n",
    "console.log(\"Revocation check:\", recreatedPres.spec.credentials[0].status.revocationCheck);"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4d771f67-edfd-4032-90c8-e44b869578f3",
   "metadata": {},
   "source": [
    "### Challenges\n",
    "\n",
    "1. If you do the same exercises as for the LegoGroth16, what is the difference in the code?\n",
    "\n",
    "> - The setup needs to be done both by the prover (holder) and the verifier.\n",
    ">   As the setup is very fast, this is not a problem.\n",
    ">   Also, the setup needs a common secret key, which can be the challenge sent by\n",
    ">   the verifier to the prover (holder).\n",
    "> - Besides that the code is the same, which shows the nice abstraction level\n",
    ">   attained by the code.\n",
    "\n",
    "2. What other difference do you experience when running the code?\n",
    "\n",
    "> - Bulletproofs++ are much faster than LegoGroth16, because they are a much more\n",
    ">   recent construct.\n",
    "> - Bulletproofs++ create a bit larger proofs, but still in the low kBytes range.\n",
    "\n",
    "3. Can you find how the verifier can be sure what is proven by the holder?\n",
    "\n",
    "> Like for LegoGroth16, the bounds are in the structure sent to the verifier.\n",
    "> Again, the verifier will have to re-create the `statement x`, before being\n",
    "> able to plug-in the `proof p` and checking for a correct result."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "95981aeb-a28f-49df-bdb8-7d0f8115bdd4",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## 4 - Discussion: are we anonymous and unlinkable now?\n",
    "\n",
    "1. What did we gain by using Zero Knowledge Proofs?\n",
    "\n",
    "> Taking up the \"k-anonymity\" from before (where \"k\" is the number of holders\n",
    "> with the same attribute-value), we did increase \"k\" by a lot:\n",
    "> there are much more people having a height between 170cm and 190cm,\n",
    "> than people with a specific height like 176.\n",
    ">\n",
    "> Also, if we combine proofs, the \"k\" is still very hihg.\n",
    "> Except if we reveal low-k values like the name or the profession.\n",
    "\n",
    "2. What does the verifier learn about our credential?\n",
    "\n",
    "> - That it is a signed credential from the issuer\n",
    "> - The values we reveal\n",
    "> - The `statement`s we prove\n",
    "\n",
    "3. Does this make the proof anonymous? Why? Why not?\n",
    "\n",
    "> Depending on the \"k-anonymity\" we can consider ourselves anonymous if \"k\" is\n",
    "> above a certain threshold.\n",
    "> If \"k\" drops below a threshold, we can consider that the holders can be\n",
    "> de-anonymized.\n",
    "\n",
    "4. Is the proof unlinkable? When is it? When isn't it?\n",
    "\n",
    "> Same as for anonymity, because all the rest of the proof is randomized\n",
    "> and different for each proof."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e2085e79-4d4a-4ff8-8d04-9690e6571ef7",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## 5 - Coding challenge - Using the ZKPs\n",
    "\n",
    "Here are some more coding exercises to help you understand the code.\n",
    "We propose you to copy the exercise into a new notebook, so you always have the original code ready for comparisons.\n",
    "\n",
    "1. Create a proof that your age is in a certain range. Why is the age format given like this?\n",
    "\n",
    "> This challenge has been added to the LegoGroth part of this exercise.\n",
    "   \n",
    "3. Add a new field for the postal code to the credential and to the schema. Now create a proof that you live in the canton de Vaud.\n",
    "\n",
    "> As Ahmed shared during the hands-on workshop, the postal code in Switzerland are actually\n",
    "> not organized by canton, but by regions.\n",
    "> Unfortunately this doesn't allow us to simply prove that somebody lives in the canton\n",
    "> de Vaud using their postal code.\n",
    "> So we either need to have a field with the name of the canton, and reveal that one.\n",
    "> Or create many range proofs and `OR` them together."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f07ddfce-08a7-40bf-8335-c5ccd2f5987b",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## 6 - Hard Coding Exercise - Revocation test: add an accumlator using a negative membership check\n",
    "\n",
    "Implement a revocation test of the credential using an accumulator.\n",
    "\n",
    "This exercise is very hard, as unfortunately the docknetwork/crypto library is lacking a good documentation.\n",
    "A good starting point is the following test:\n",
    "[presentation-status-kb-accumulator.spec.ts](https://github.com/docknetwork/crypto-wasm-ts/blob/c32072b85150b6c1febadb29d2b8b7f4dbe7e40b/tests/anonymous-credentials/presentation-status-kb-accumulator.spec.ts#L143).\n",
    "If you want to dive into this, please keep in mind:\n",
    "\n",
    "- The tests in the `crypto-wasm-ts` library are written to work with different proving systems in mind.\n",
    "  So they have a lots of variables which are filled out by other parts of the tests to make it as universal as possible.\n",
    "- My preferred way to follow around the code is using VisualStudio, and then use `<CMD+CLICK>` to follow methods, `<CMD+OPTION+LEFT>`\n",
    "  to go back\n",
    "\n",
    "An accumulator is a cryptographic tool which allows to do (negative) membership proofs.\n",
    "Instead of simply listing a set of numbers, an accumulator compresses these numbers using cryptographic algorithms.\n",
    "Different accumulators exist with different trade-ofs:\n",
    "\n",
    "- the size of the accumulator, depending on the number of elements in it\n",
    "- whether it's possible to add and remove elements once the accumulator is set up\n",
    "- if you can prove the existence and/or the absence of an element in the accumulator\n",
    "\n",
    "Using the docknetwork/crypto library, you can add an inclusion or an absence proof using accumulators.\n",
    "In order to prove the validity of the credential, the following needs to be done:\n",
    "\n",
    "1. The issuer holds the accumulator which contains all revoked elements\n",
    "2. If a credential is revoked, its ID needs to be stored in the accumulator\n",
    "3. The holder creates an additional proof that their ID is not in the accumulator\n",
    "4. When the verifier checks the proof, it can be sure that the credential of the holder hasn't been revoked yet\n",
    "\n",
    "From a programming point of view, you have to add the following:\n",
    "\n",
    "- Issuer\n",
    "  - Setup the accumulator using something like [setupKBUniAccumulator](https://github.com/docknetwork/crypto-wasm-ts/blob/c32072b85150b6c1febadb29d2b8b7f4dbe7e40b/tests/anonymous-credentials/utils.ts#L824)\n",
    "    - the `state` is not necessary\n",
    "    - instead of adding 100 IDs, start with adding only two possible IDs\n",
    "  - use `builder.setCredentialStatus` with a non-member check, like [here](https://github.com/docknetwork/crypto-wasm-ts/blob/c32072b85150b6c1febadb29d2b8b7f4dbe7e40b/tests/anonymous-credentials/presentation-status-kb-accumulator.spec.ts#L97)\n",
    "    - the `registryID` can be any string\n",
    "    - the `memberValue` needs to be the encoded user-ID from the `schema.encoder.encodeMessage` call\n",
    "    - the `extra` field with the `blockNo` is optional and can be ignored.\n",
    "      It is used to transfer additional information from the holder to the verifier.\n",
    "- Holder\n",
    "  - call `builder.addAccumInfoForCredStatus` with the values from the issuer. These values are public.\n",
    "- Verifier\n",
    "  - add a map with the public key of the accumulator to the call of `recreatedPres.verify`"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6cd0b9ab-faaa-4ee1-a7e0-686cd970ad6f",
   "metadata": {},
   "source": [
    "### Questions:\n",
    "\n",
    "1. What security did we imply with this setup?\n",
    "\n",
    "> The issuer has to be trusted: with the private key, the issuer can\n",
    "> prove any value to be included or excluded in the accumulator!\n",
    "> In case of revocation, the security is only that the issuer will not send an\n",
    "> updated `witness` to the holder.\n",
    "> Which means that the holder will only be able to prove that they were not \n",
    "> revoked in a previous accumulator.\n",
    "   \n",
    "2. What can go wrong?\n",
    "\n",
    "> - The holder could use a stale accumulator proof when proving the statement.\n",
    "> - As the issuer needs to send out updates of the accumulator to all holders,\n",
    ">   this is usually only done on a periodic time base.\n",
    ">   Between two updates, a holder might have a revoked credential which is still\n",
    ">   valid until the next update.\n",
    "\n",
    "3. How can the verifier be sure that it didn't get a stale proof of the accumulator?\n",
    "\n",
    "> Like for any other of the proofs, the verifier can require the inclusion of a\n",
    "> challenge by the prover.\n",
    "> It can require this to be done directly in the `nonMemWitness` proof, or in\n",
    "> the `nonce` as seen previously.\n",
    "\n",
    "4. How can the verifier be sure that the proof hasn't been done on a stale accumulator?\n",
    "\n",
    "> As the accumulator is part of the computation whether the `statement x` is correct\n",
    "> for a given `proof p`, the verifier can check whether the accumulator sent by the\n",
    "> holder is the latest one or not."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "4259e466-1308-4b3e-98c7-c7cdb5b15ba6",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "TypeScript",
   "language": "typescript",
   "name": "tslab"
  },
  "language_info": {
   "codemirror_mode": {
    "mode": "typescript",
    "name": "javascript",
    "typescript": true
   },
   "file_extension": ".ts",
   "mimetype": "text/typescript",
   "name": "typescript",
   "version": "3.7.2"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}