-
Notifications
You must be signed in to change notification settings - Fork 2.2k
Description
Once macaroons are created, the issuer does not need to keep a copy of them because they can always be verified if re-presented to them. This increases scalability but also creates a drawback in that they must require an explicit revocation process rather than an implicit revocation process.
For LND macaroons, we likely are not going to be creating millions or billions of macaroons like we might want to do for something like an L402 that is used on a web service.
Therefor, I propose that by default, every macaroon that is baked (even macaroons that are auto-baked on lnd startup) that we automatically generate a new root_key for it. If we expand on #10594 and save a memo for the root_key, then the user could use lncli listmacaroonids and lncli deletemacaroonid to remove the root key associated with each macaroon and allow for easy revoking of a macaroon that has been issued.
This approach now makes the macaroon revocation process implicit rather than implicit. It comes at the expense of needing to explicitly persist a new root_key for every macaroon that is generated, but I think that is worth doing since likely the number of macaroons that an individual LND node will be issuing is not too large.
Users can manually do this right now, but it is not obvious because of #10592 . Also, they need to manually keep track of the root_key_id that have been used and what macaroons are issued (see also #10594, #10593).
I think we should make this a lot easier for people. In the past, a user that does not understand may want to just delete macaroons.db and let that be re-created, but with the shift to SQLite and postgres, that file might not exist at all for the user.