Make PrincipalId abstract

[nomeata]

done in this commit:

• Abstract PrincipalId
• Equality, ordering
• Primitive conversion to blob
  (meaning that hashing, pretty-printing can be done in stdlib)
• IDL mapping as blob.

[nomeata]

This is the ASAP implementation called for by Andreas in
https://dfinity.slack.com/archives/CPL67E7MX/p1579249416002000?thread_ts=1579204528.239900&cid=CPL67E7MX

For Linkedup, we also need stdlib.PrincipalId.hash(). (done)
Although it looks like Linkedup uses the hash as the user id, that’s a gaping security hole, because the hash is not crytographic!

[nomeata]

Also, should we map this, when used as a parameter in the IDL, to

• a blob (probably not)
• a service {} (since we want users to be indistinguishable from canisters)
• a fresh principal_id?

[ggreif]

hash is not crytographic!

Cannot be, it is only 32 bits!

[nomeata]

hash is not crytographic!

Cannot be, it is only 32 bits!

Right! (I wasn’t complaining about the hash, but the misuse). Let’s continue that LinkedUp discussion in dfinity/linkedup#6 (comment)

[crusso]

Do we need blob in the IDL for anything else, why not rename IDL blob to Principal ID. Also, I'm really note sure we should identify users with canisters - aren't there operations on canister but not users (like upgrade) that don't make sense?

[nomeata]

Do we need blob in the IDL for anything else

blob = vec nat8 in the IDL, and that’s of course a useful alias.

Also, I'm really note sure we should identify users with canisters - aren't there operations on canister but not users (like upgrade) that don't make sense?

Well, you can only upgrade a canister if are its admin (or later: if you have the capability). For users, nobody gets that ability.

There are always things you can do to some canisters that you can’t do to other canisters or users.

[nomeata]

Ok, this should be all we need to to make the caller abstract, without breaking too much.

IDL type discussion can happen later if we don't want that bike shed to hold up this ASAP change.

[crusso]

In case you need expedited delivery.

[rossberg]

LGTM, my only suggestion would be to rename it to simply Principal -- the Id suffix seems redundant.

[matthewhammer]

Although it looks like Linkedup uses the hash as the user id, that’s a gaping security hole, because the hash is not crytographic!

@stanleygjones knows about this. We've already corrected it together, once. I think he reverted it because he was missing this PR. He can confirm.