From nobody Fri Aug 27 11:50:37 2021 Return-Path: X-Original-To: ppm@ietf.org Delivered-To: ppm@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4BA5C3A0060; Fri, 27 Aug 2021 11:50:24 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: IETF Secretariat To: "IETF Announcement List" Cc: ppm@ietf.org, ekr@rtfm.com, caw@heapingbits.net X-Test-IDTracker: no X-IETF-IDTracker: 7.36.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: ietf@ietf.org Message-ID: <163009022421.31949.13435147885375623535@ietfa.amsl.com> Date: Fri, 27 Aug 2021 11:50:24 -0700 Archived-At: Subject: [Ppm] New Non-WG Mailing List: ppm -- Privacy Preserving Measurement technologies X-BeenThere: ppm@ietf.org X-Mailman-Version: 2.1.29 List-Id: Privacy Preserving Measurement technologies List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 27 Aug 2021 18:50:25 -0000 A new IETF non-working group email list has been created. List address: ppm@ietf.org Archive: https://mailarchive.ietf.org/arch/browse/ppm/ To subscribe: https://www.ietf.org/mailman/listinfo/ppm Purpose: There are many situations in which it is desirable to take measurements of data which people consider sensitive. In these cases, the entity taking the measurement is usually not interested in people's individual responses but rather in aggregated data but conventional methods require collecting individual responses and then aggregating them, thus representing a threat to user privacy and rendering many such measurements difficult and impractical. This mailing list is for discussions of technologies for collecting aggregate data without revealing any individual user's data. The IETF Area to which the list belongs: SEC For additional information, please contact the list administrators. From nobody Fri Aug 27 18:59:14 2021 Return-Path: X-Original-To: ppm@ietfa.amsl.com Delivered-To: ppm@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 74B463A2652 for ; Fri, 27 Aug 2021 18:59:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.896 X-Spam-Level: X-Spam-Status: No, score=-1.896 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=rtfm-com.20150623.gappssmtp.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ALDFNJvL_rG5 for ; Fri, 27 Aug 2021 18:59:06 -0700 (PDT) Received: from mail-io1-xd30.google.com (mail-io1-xd30.google.com [IPv6:2607:f8b0:4864:20::d30]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 564E83A2650 for ; Fri, 27 Aug 2021 18:59:06 -0700 (PDT) Received: by mail-io1-xd30.google.com with SMTP id n24so11301482ion.10 for ; Fri, 27 Aug 2021 18:59:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=rtfm-com.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=RXFsPhJ1PwVt9sxdGjqedcwprSdAcjJ9ai4e1q0aVfI=; b=yOMWQGj5is5VIbmHQ36/8WaYFaXTKvmi/mggoLTvTT/+0bIt7ornx6myE4HsHchkkS 9lMJi3RHzXnF/EoqlwSodE34+x1Ikx6GlYAFzzTnpP9vCg0AspaUQ8CQPbPb57Ro9sQN +wHyrfM74nD8dmC+0JVywFf4c5XVoie6AUbisOq4FLbX07/K7zWZiMLX3iBTnYaZiMZT k0kZbjhTZicLugqt+SuyKCcKugiWJfRYW5wknQSo4R1N/Ay2G4CicRToQUIxNnxKJ2VH HtzEWfPjJtgWix4EU54++nBLQu6/knqyCD8lqnnmStgO4m8KLcHJMB6wN9SZVSbP9I1K OENg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=RXFsPhJ1PwVt9sxdGjqedcwprSdAcjJ9ai4e1q0aVfI=; b=U7Rm0EbZ7B/WMexnbCIarzETnCj+1fsoOrLMUHgLpaEw8haOaxm4WKHDgaLAdEr7Qn nBVdQTe4qEqs7wUBpARjPDdP4XnYugVLjVz+KsNfYduuB+U71ykrmqhH/A9hJdGl1OI4 syQZ67IKadlDGmtP5p/TbrL+lUAMRp+m+iL+LUXkuI964GAWWD1DR598K44I451U3t3g s5Fs2gWpEMXuZijnqVwyB6yVQAm5yL+WCmbSIckwCIot5P6KIuszqT0TgHDt1QKewmKk muDBVP/WKtwdoXWlEH8djYLdz4rXTEqexR4pi2TpJCwC42Kx8BA13pFxkjxf7aNCfVjR EOMw== X-Gm-Message-State: AOAM531dgyh226RQiG18Xj3gFHylwcm0LrAIdtIHuUnPlKWyeZ9LI53f kTyRjoRKa7hELsBJC3joelzyAZ0kD3Q8+M67L6mLNbNjw3hVIGcF X-Google-Smtp-Source: ABdhPJynkPZ0pXzguK9eJVIeDbmTdvYlH2FWh3yZiRvhHIBxDez8HM4eM02UtS+llhYa2AoTsuAKpGlMXvwHMYT0P4s= X-Received: by 2002:a5e:c609:: with SMTP id f9mr9288814iok.127.1630115944121; Fri, 27 Aug 2021 18:59:04 -0700 (PDT) MIME-Version: 1.0 From: Eric Rescorla Date: Fri, 27 Aug 2021 18:58:28 -0700 Message-ID: To: ppm@ietf.org Content-Type: multipart/alternative; boundary="000000000000cad85305ca94f14b" Archived-At: Subject: [Ppm] Background X-BeenThere: ppm@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Privacy Preserving Measurement technologies List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 28 Aug 2021 01:59:13 -0000 --000000000000cad85305ca94f14b Content-Type: text/plain; charset="UTF-8" Welcome to PPM, Hi folks, welcome to the PPM list. I just wanted to send out a bit of introduction/background. There are a lot of cases where one wants to take measurements of values that are sensitive individually but not in aggregate, and the person/entity taking the measurement doesn't care about people's individual values. These cases include both technical measurements as well as non-technical ones, for instance: - Medical status of various kinds - Financial status - Web sites that don't render properly or cause an error of some kind Historically, the options for taking this kind of measurement were fairly limited: in a few cases the person taking the measurement could credibly convince people their data would be kept confidential and in others you could use Randomized Response or similar techniques such as RAPPOR. You could also sometimes send anonymous reports over some sort of proxy network like Tor or Apple's Private Relay. However, there are a lot of situations where these options don't work well. In the past few years, cryptographic techniques have emerged that allow for efficient measurement of aggregates without requiring trust in a single party. The basic idea is that there are two independent servers and the client takes their reported value and divides it up into 2 or more secret shares, sending one to each server. The servers then independently aggregate (e.g., add up) the reports and then exchange the aggregates to get the final value. Because each server only has a share, as long as at least one server is trustworthy, the user's value is never revealed [Technical Note: each share also comes with a zero-knowledge proof of validity which prevents clients from reporting values which would invalidate the result. For instance, we might allow clients to report that they had incomes up to 10^9 but not 10^100th. This lines up with other surveying techniques which attempt to prevent plainly invalid responses but still allow people to lie.] The available techniques [CB17][BBCGI21] allow for a variety of aggregation tasks, including: - Sum/Mean/geometric mean - Other statistics such as variance that can be computed by addition of values - Histograms - Finding the most common strings out of a collection of client-submitted values ("heavy hitters") There have already been two prototype deployments of one of these techniques (Prio), one by Mozilla and the other by Apple, Google, ISRG, NCI, and MITRE, so we have some evidence they can be deployed at scale. There's already a fair amount of interest in these technologies and ISRG has already announced that they plan to offer a public Prio service https://www.abetterinternet.org/post/introducing-prio-services/ . We're looking to standardize these technologies for Privacy Preserving Measurement. The idea would be to have a protocol in IETF that described the networking pieces and then work in CFRG to define the crypto pieces. A draft of the protocol can be found at: https://abetterinternet.github.io/prio-documents/draft-ppm-protocol.html The CFRG pieces are still in development. We've asked for a BOF at IETF 112: https://datatracker.ietf.org/doc/bofreq-privacy-preserving-measurement/ Happy to answer any questions people might have. -Ekr [CB17] Corrigan-Gibbs and Boneh, "Prio: Private, Robust, and Scalable Computation of Aggregate Statistics" https://www.usenix.org/system/files/conference/nsdi17/nsdi17-corrigan-gibbs.pdf [BBCGI21] Boneh, Boyle, Corrigan-Bibbs, Gilboa, Ishai, "Lightweight Techniques for Private Heavy Hitters", https://eprint.iacr.org/2021/017 --000000000000cad85305ca94f14b Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Welcome to PPM,

Hi folks, welcome to the PPM list. = I just wanted to send out
a bit of introduction/background.

There= are a lot of cases where one wants to take measurements of
values that = are sensitive individually but not in aggregate, and the
person/entity t= aking the measurement doesn't care about people's
individual val= ues. These cases include both technical measurements as
well as non-tech= nical ones, for instance:

- Medical status of various kinds
- Fin= ancial status
- Web sites that don't render properly or cause an err= or of
=C2=A0 some kind

Historically, the options for taking this = kind of measurement were
fairly limited: in a few cases the person takin= g the measurement could
credibly convince people their data would be kep= t confidential and in
others you could use Randomized Response or simila= r techniques such as
RAPPOR. You could also sometimes send anonymous rep= orts over some sort
of proxy network like Tor or Apple's Private Rel= ay. However, there are
a lot of situations where these options don't= work well.

In the past few years, cryptographic techniques have eme= rged that
allow for efficient measurement of aggregates without requirin= g trust
in a single party. The basic idea is that there are two independ= ent
servers and the client takes their reported value and divides it up<= br>into 2 or more secret shares, sending one to each server. The serversthen independently aggregate (e.g., add up) the reports and then
exchan= ge the aggregates to get the final value. Because each server
only has a= share, as long as at least one server is trustworthy, the
user's va= lue is never revealed [Technical Note: each share also comes
with a zero= -knowledge proof of validity which prevents clients from
reporting value= s which would invalidate the result.=C2=A0 For instance, we
might allow = clients to report that they had incomes up to 10^9 but not
10^100th. Thi= s lines up with other surveying techniques which attempt
to prevent plai= nly invalid responses but still allow people to lie.]

The available = techniques [CB17][BBCGI21] allow for a variety of
aggregation tasks, inc= luding:

- Sum/Mean/geometric mean
- Other statistics such as vari= ance that can be computed by
=C2=A0 addition of values
- Histograms- Finding the most common strings out of a collection of client-submitted=
=C2=A0 values ("heavy hitters")

There have already bee= n two prototype deployments of one of these
techniques (Prio), one by Mo= zilla and the other by Apple, Google,
ISRG, NCI, and MITRE, so we have s= ome evidence they can be deployed at
scale. There's already a fair a= mount of interest in these technologies
and ISRG has already announced t= hat they plan to offer a public
Prio service https://www.abetterinterne= t.org/post/introducing-prio-services/.

We're looking to stan= dardize these technologies for Privacy Preserving
Measurement. The idea = would be to have a protocol in IETF that
described the networking pieces= and then work in CFRG to define the
crypto pieces. A draft of the proto= col can be found at:
https://abetterinternet.github.io/prio-do= cuments/draft-ppm-protocol.html
The CFRG pieces are still in develop= ment.

We've asked for a BOF at IETF 112:
https://dat= atracker.ietf.org/doc/bofreq-privacy-preserving-measurement/

Hap= py to answer any questions people might have.

-Ekr

[CB17] Cor= rigan-Gibbs and Boneh, "Prio: Private, Robust, and Scalable
Computa= tion of Aggregate Statistics"
https://www.usenix.o= rg/system/files/conference/nsdi17/nsdi17-corrigan-gibbs.pdf

[BBC= GI21] Boneh, Boyle, Corrigan-Bibbs, Gilboa, Ishai, "Lightweight
Tec= hniques for Private Heavy Hitters", https://eprint.iacr.org/2021/017


--000000000000cad85305ca94f14b--