[DAP-18] TaskConf AAD Part 3: Get all the bits and bobs in place for the TaskConfiguration at all endpoints#4698
Open
jcjones wants to merge 7 commits into
Conversation
6ba01cf to
366760a
Compare
AggregatorTask self-sufficientAggregatorTask self-sufficient
AggregatorTask self-sufficientAggregatorTask self-sufficient
366760a to
9791414
Compare
0f66551 to
ecc6608
Compare
AggregatorTask self-sufficientecc6608 to
3cca08a
Compare
…r startup Restructure JanusInProcess to provision its task via a new provision_task() method once its ephemeral port is known, so JanusInProcessPair builds one task with consistent real endpoints and provisions both aggregator views. Doesn't do anything else.
DAP-18 binds the task's TaskConfiguration -- which contains both the leader and helper endpoints -- into the HPKE AADs for input and aggregate shares. AggregatorTask previously stored only peer_aggregator_endpoint, so a party could not reconstruct both endpoints from the task alone. Add an own_aggregator_endpoint field (and DB column) alongside the peer endpoint: - API-provisioned tasks stamp it at creation from the aggregator's configured public_dap_url. - taskprov tasks populate it from the received TaskConfiguration's endpoint for this aggregator's role, which taskprov_opt_in previously discarded. In the process, we move to the janus_messages::Url.
Add the adapter that yields the canonical TaskConfiguration bound into HPKE AADs, so the upcoming AAD sites can obtain it from the task alone. For API-provisioned tasks it is synthesized via build_task_configuration, pairing the task's own and peer endpoints into leader/helper by role. For taskprov tasks it is the received wire configuration verbatim. Store that configuration on the task (new nullable taskprov_task_config column, populated in taskprov_opt_in). Re-synthesizing it from the stored parameters is not byte-safe: the VdafConfig<->VdafInstance round trip drops DP strategies and unknown task extensions would be lost, and any divergence breaks decryption.
…rams Add builder setters (with_task_info, with_min_batch_size, with_batch_config, with_vdaf_config, with_task_interval) supplying the parameters the client needs to reconstruct the task's canonical TaskConfiguration for HPKE AADs. The four non-optional parameters are validated at build(), which fails fast rather than deferring to the first upload's AAD construction. ClientParameters::task_configuration() is the single construction path; it is not yet AAD-load-bearing (wired in the flag day). In-tree builder callers (tests, integration harness, interop client) are updated to supply the fields.
… params Add builder setters (with_helper_endpoint, with_task_info, with_min_batch_size, with_batch_config, with_vdaf_config, with_task_interval) supplying the parameters the collector needs to reconstruct the task's canonical TaskConfiguration for aggregate-share AADs. The collector had no helper endpoint before. Required fields are validated at build(), which also fails fast on invalid endpoint bytes rather than deferring to the first collection's AAD construction. Collector::task_configuration() is the single construction path; it is not yet AAD-load-bearing (wired in the flag day). Collector::new is removed (it bypassed the setters and so could no longer build). In-tree callers (tests, integration harness, interop collector, collect tool) are updated to supply the fields.
Source task_info and the task interval from the provisioned task and thread them into the client (and TaskParameters) so tests build a TaskConfiguration that matches the aggregators'. Add TaskBuilder task_info()/task_interval() getters. Values are threaded but not yet cryptographically bound (the AAD struct changes land separately), so this is behavior-preserving. Also fix the get_config expectation to the byte-preserving dap_url (no trailing slash), which follows from persisting the own endpoint verbatim.
3cca08a to
b72429c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DAP-18 binds the task's TaskConfiguration -- both aggregator endpoints, task_info, the VDAF/batch config, and the validity interval -- into the HPKE AADs for input and aggregate shares, which requires every party (leader, helper, client, collector, candlestick maker) to independently reconstruct identical
TaskConfigurationbytes.This PR builds the machinery to do that, without yet touching the wire format, building atop #4707.
AggregatorTask gains an
own_aggregator_endpointbeside the existing peer endpoint, stamped at creation from the configuredpublic_dap_urlfor API tasks, and from the received config for taskprov tasks (whichtaskprov_opt_inpreviously discarded, can't save that memory now!)It also gains a
task_configuration()adapter that synthesizes the config for API tasks and returns the received wire bytes verbatim for taskprov.Endpoints move to
janus_messages::Urlso nothing is re-encoded.The Client and Collector builders grow the parameters needed to construct a matching config (the collector previously had no helper endpoint at all), validated fail-fast at
build(), and the integration-test harness threads the realtask_info/intervalthrough so client- and collector-built configs match those at the aggregators.Nothing is bound into an AAD yet: these values are threaded but not load-bearing, so the change is behavior-preserving. So, uh, the tests still pass.
The actual AAD turn-on -- the InputShareAad / AggregateShareAad / AggregateShareReq struct changes -- is in another castle, and I have to admit I am not sure I have all the byte-identical test changes in here yet, because that changeset still doesn't pass. But look, this one passes, and it is going in the right direction while only being +800/-100.
I just mean to say, while the AAD turn-on is theoretically ~150 lines, it might be ... more... still.