[CFRG] Re: RGLC on draft-irtf-cfrg-vdaf-20

[Christopher Patton <[e-mail]>]

As author: Thanks Martin, Tim, and Junye for the support, I'll note that
this draft has gone through several iterations, addressing both adopter
needs and security/efficiency improvements pointed out by researchers. A
brief history:

   - Draft 02 was the first feature complete version of the document, as it
   accommodated the initial use cases of the PPM working group (
   https://datatracker.ietf.org/wg/ppm/documents/)
   - Drafts 03 and 04 addressed various gaps in security (
   https://eprint.iacr.org/2023/130)
   - Drafts 05 through 11 addressed feedback from implementation experience
   and added various features required for PPM. We also finalized our
   symmetric crypto during this period: we landed on TurboSHAKE as our default
   XOF, after some debate on the list; and we adopted an idea from the MPC
   literature that exploits hardware acceleration for AES.
   - Draft 12 includes a bunch of breaking changes we were holding off on
   while we were getting deployment experience with a previous version (draft
   09). The changes include various security improvements, changes to circuit
   specifications that make Prio3 more efficient, and the introduction of
   applicaiton context to the VDAF interface.
   - Drafts 13 through 17 were mainly editorial, but we also adopted some
   ideas from PPM to make it to adopt VDAFs in higher level protocols. We also
   aligned the document with draft-irtf-cfrg-cryptography-specification.
   - Draft 18 is about efficiency of Prio3: It adopts Armando Faz's idea
   for changing the representation of the proof polynomial without impacting
   security (https://eprint.iacr.org/2025/1727) and it aligns the range
   proofs with an idea discussed on list for draft-irtf-cfrg-sigma-protocools.

As individual: I think this draft serves its purpose and is ready for
publication. The specification of Prio3 is in excellent shape. Poplar1 is
usable, and I think there are applications where it will work really well.
It can be improved (Mastic,
https://datatracker.ietf.org/doc/draft-mouris-cfrg-mastic/) but I don't
think we should wait for a replacement before publishing the core VDAF spec.

Best,
Chris P.

On Mon, Jun 29, 2026 at 3:27 PM Martin Thomson <[e-mail]> wrote:

> I've spent a lot of time with this document.  The editors have integrated
> a bunch of the suggestions I've made over time.  I'm generally happy with
> the shape of the document.  We are actively using this and plan to continue
> and even expand our usage.
>
> On Sat, Jun 27, 2026, at 07:01, Tim Geoghegan wrote:
> > I've made a few contributions to this draft and am a co-author of
> > draft-ietf-ppm-dap [1], which depends on VDAF. Additionally, at work
> > [2], we've implemented this draft [3] and have been running several
> > VDAF configurations in production at quite significant scale for years
> > now. I think this document is ready for an RFC number. Can we have a
> > prime?
> >
> > Thanks,
> > Tim
> >
> > [1]: https://datatracker.ietf.org/doc/draft-ietf-ppm-dap/
> > [2]: https://divviup.org
> > [3]: https://github.com/divviup/libprio-rs
> >
> > On Fri, Jun 26, 2026 at 5:29 AM Stanislav V. Smyshlyaev
> > <[e-mail]> wrote:
> >> Dear CFRG participants,
> >>
> >> This message is starting a 3-week RGLC on draft-irtf-cfrg-vdaf-20
> ("Verifiable Distributed Aggregation Functions"),
> https://datatracker.ietf.org/doc/draft-irtf-cfrg-vdaf/, that will end on
> July 17th 2026. If you've read the document and think that it is ready (or
> not ready) for publication as an RFC, please send a message in reply to
> this email or directly to CFRG chairs ([e-mail]) If you have
> detailed comments, these would also be very helpful at this point.
> >>
> >> We've got a review for the draft from Julia Hesse on behalf of the
> Crypto Review Panel:
> >> https://mailarchive.ietf.org/arch/msg/cfrg/Omdhr4rO1pla_nlju2l7OJEGWPM/
> >> The authors later addressed the concerns in the further versions of the
> draft, Julia has confirmed that she is fine with the changes (
> https://mailarchive.ietf.org/arch/msg/cfrg/_NnJ0Q2QG6N7NKiU6hedWmtTA2M/)
> >>
> >> Thank you,
> >> Stanislav, for CFRG chairs
> >> _______________________________________________
> >> CFRG mailing list -- [e-mail]
> >> To unsubscribe send an email to [e-mail]
> > _______________________________________________
> > CFRG mailing list -- [e-mail]
> > To unsubscribe send an email to [e-mail]
>
> _______________________________________________
> CFRG mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
>