]> Mozilla

mt@lowentropy.net

ISRG

divergentdave@gmail.com

Security Privacy Preserving Measurement vectors manhattan multi-dimensional A Prio Verifiable Distributed Aggregation Function is defined that supports vector or histogram addition, where the sum of the values in the contribution is less than a chosen value. About This Document The latest revision of this draft can be found at . Status information for this document may be found at . Discussion of this document takes place on the Privacy Preserving Measurement Working Group mailing list (), which is archived at . Subscribe at . Source for this draft and an issue tracker can be found at .

Introduction Existing Prio instantiations of a Verifiable Distributed Aggregation Function (VDAF) all support a simple summation of measurements. From Prio3Count (), which adds measurements containing a single one or a zero value, to Prio3SumVec (), which adds measurements containing a vector where each dimension is a limited number of bits, all instantations take the same basic form. One case that is presently not included in the suite of instantiations is the addition of vectors or histogram contributions, where each measurement has an L1 bound. The L1 norm of a vector is defined as the sum of its components. An L1 bound limits that sum to some maximum. This document defines the Prio3L1BoundSum instantiation. This instantiation limits the L1 norm of a vector or histogram to a value less than or equal to a predetermined maximum. This instantiation has similarities with other instantiations. Unlike Prio3Histogram (), in which measurements need to have an L1 norm of exactly 1, a valid measurement for Prio3L1BoundSum can have an L1 norm equal to any value between 0 and the chosen limit. Unlike Prio3MultiHotCountVec (), in which each component can only be zero or one, components in Prio3L1BoundSum can take any value up to the L1 bound as long as their sum is within that bound. defines the Prio3L1BoundSum VDAF.

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses the terminology, notation conventions, and functions defined in .

Prio3L1BoundSum Definition The Prio3L1BoundSum instantiation of Prio supports the addition of a vector of integers. It also uses bit_length(), which returns the minimum number of bits needed to encode an integer value. The instantiation is summarized in . Prio3L1BoundSum Parameters

Parameter	Value
field	Field128 ()
Valid	L1BoundSum(field, length, max, chunk_length)
PROOFS	1
XOF	XofTurboShake128 ()

The function takes three parameters: length, max_value, and chunk_length. The vector contains "length" components, each of which is a non-negative integer less than or equal to max_value. The value of max_value can be any positive integer. A value of 1 causes Prio3L1BoundSum to be nearly identical to Prio3Histogram, except that Prio3Histogram cannot encode an all-zero report.

Chunk Length Selection The chunk_length parameter can be chosen in approximately the same way as for Prio3SumVec, as detailed in . The difference is that Prio3L1BoundSum involves validation of bits * (length + 1) values, where bits = max_value.bit_length(). This might increase the most efficient value for chunk_length relative to a similar encoding of Prio3SumVec.

Encoding and Decoding The encoded form of each measurement appends a bitwise decomposition of the L1 norm (the sum of the vector components) to the encoding: list[F]: encoded = [] erci = encode_range_checked_int for v in measurement: encoded += erci(self.field, v, self.max_value) weight = erci(self.field, sum(measurement), self.max_value) return encoded + weight ]]> The encoded measurement has a total length of (length + 1) * bits. The encoding function encode_range_checked_int is described in . The encoded information is not included in the output share that is submitted for aggregation. That is, the truncate() function emits only the core measurements. list[F]: return [ decode_range_checked_int(self.field, m, self.max_value) for m in chunks(meas, self.max_value.bit_length()) ] ]]> This uses a chunks(v, c) function that takes a list of values, v, and a chunk length, c, to split v into multiple lists from v, where each chunk has a length c. The decode() function is therefore identical to that in Prio3SumVec. list[int]: return [x.int() for x in output] ]]>

Validity Circuit The validity circuit for Prio3L1BoundSum uses an extended version of the validity circuit used by Prio3SumVec, see . The encoded measurement is checked to ensure that every component of the vector – plus the added L1 norm – is encoded in the specified number of bits. That is, the circuit checks that each component has a value between 0 (inclusive) and max_value (exclusive) by first checking the value is correctly composed from bits, where each bit is either zero or one. This process is identical to the Prio3SumVec check, except that one additional value is checked. The validity circuit then checks whether the added L1 norm value is consistent with the encoded vector elements. The L1 norm is checked by decoding the measurement values, including the L1 norm. The decoded values are used to recompute the L1 norm as the sum of the individual components. The difference between reported and computed values is checked to confirm that the values are identical. The complete circuit is specified in .

Evaluation function for Prio3L1BoundSum list[F]: bits = self.max_value.bit_length() assert len(meas) == (self.length + 1) * bits shares_inv = self.field(num_shares).inv() parallel_sum = ParallelSum(Mul(), chunk_length) num_chunks = ceil(len(meas) / self.chunk_length) pad_len = self.chunk_length * num_chunks - len(meas) meas += [self.field(0)] * pad_len range_check = self.field(0) for (r, m) in zip(joint_rand, chunks(meas, self.chunk_length)): inputs = [] for i in range(self.chunk_length): inputs += [ r**(i + 1) * m[i], m[i] - shares_inv, ] range_check += parallel_sum.eval(self.field, inputs) c = chunks(meas, bits) components = [ decode_range_checked_int(self,field, m, self.max_value) for m in c[:self.length] ] observed_weight = sum(components) claimed_weight = decode_range_checked_int( self.field, c[self.length], self.max_value ) weight_check = observed_weight - claimed_weight return [range_check, weight_check] ]]>

This evaluation uses the decode_range_checked_int() function defined in .

DAP Integration The integration of Prio3L1BoundSum in DAP requires the definition of an encoding for the configuration of the VDAF. defines the encoding of Prio3L1BoundSumConfig, using the syntax definitions from .

VDAF Configuration Encoding for Prio3L1BoundSum

This configuration is three integers, each in network byte order, with semantics described in , as follows:

length:

The total number of values in each measurement.

max_value:

The maximum value, inclusive, for the sum of all measurement values.

chunk_length:

The size of each chunk used in the evaluation circuit; see .

Security Considerations The Prio3L1BoundSum VDAF is subject to the same considerations as other Prio-based VDAFs. These considerations are detailed in . In particular, this instantiation uses Field128 to ensure robustness despite the use of joint randomness in proofs. Joint randomness increases the risk of an attacker finding a combination of invalid inputs that passes validation. A larger field increases the computational cost of finding such a combination.

IANA Considerations This document registers a codepoint for Prio3L1BoundSum in the "Verifiable Distributed Aggregation Functions (VDAF)" registry as defined by . This entry contains the following fields:

Value:

0x00000007

Scheme:

Prio3L1BoundSum

Type:

VDAF

Reference:

RFCXXXX (this document)

References Normative References Cisco ISRG Cloudflare Google This document describes Verifiable Distributed Aggregation Functions (VDAFs), a family of multi-party protocols for computing aggregate statistics over user measurements. These protocols are designed to ensure that, as long as at least one aggregation server executes the protocol honestly, individual measurements are never seen by any server in the clear. At the same time, VDAFs allow the servers to detect if a malicious or misconfigured client submitted an invalid measurement. Two concrete VDAFs are specified, one for general- purpose aggregation (Prio3) and another for heavy hitters (Poplar1). ISRG Cloudflare ISRG Independent Cloudflare There are many situations in which it is desirable to take measurements of data which people consider sensitive. In these cases, the entity taking the measurement is usually not interested in people's individual responses but rather in aggregated data. Conventional methods require collecting individual responses and then aggregating them on some server, thus representing a threat to user privacy and rendering many such measurements difficult and impractical. This document describes a multi-party Distributed Aggregation Protocol (DAP) for privacy preserving measurement which can be used to collect aggregate data without revealing any individual contributor's data. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This document specifies version 1.3 of the Transport Layer Security (TLS) protocol. TLS allows client/server applications to communicate over the Internet in a way that is designed to prevent eavesdropping, tampering, and message forgery. This document updates RFCs 5705 and 6066, and obsoletes RFCs 5077, 5246, and 6961. This document also specifies new requirements for TLS 1.2 implementations. Informative References USENIX Symposium on Networked Systems Design and Implementation (NSDI)

Acknowledgments Chris Patton provided extensive input into the construction of this VDAF.