[Ppm] Re: DAP and disagreements about the active VDAF

[Martin Thomson <[e-mail]>]

On Tue, Dec 16, 2025, at 04:27, Christopher Patton wrote:
> It sounds like Attribution would want to early-bind to all parameters 
> of the task config. Is that correct?

Only in the sense that we can do so in the specification.  For that case, it doesn't make sense to allow flexibility in time precision, to give a concrete example.

> What about the Collector? Is the HPKE config determined at upload time, 
> aggregation time, or collection time? I'm wondering if Attribution 
> needs to allow multiple Collectors to collect the same batch.

The Collector identity is supposed to be the website that registers conversions.  We could maybe fix that identity at the time of submission, but the initial thought was to make that a separate parameter and therefore a separate report extension: https://martinthomson.github.io/dap-dp-ext/draft-thomson-ppm-dap-dp-ext.html#name-requester-website-identity

No need for multiple collectors, but it's desirable to avoid delivering too many of the Collector details to Clients. This is not because it can't be known, but because deploying and synchronizing that configuration is undesirable for much the same reason that deploying task IDs to Clients.

Websites driving the API will have to distribute accurate information about aggregation to every load of pages that involve conversions.  The current design is geared toward having the aggregation service as a whole identified with a single identifier, having many parameters fixed, and having only items relevant to the action the site wants to record being added. Right now, this is limited to histogram size and epsilon budget.

Adding the Collector identity (which might be the HPKE public key) is probably feasible, but it does add complexity.  I can see how we might argue that it is useful, which is not the case for task ID, which will change far more frequently and could become a maintenance challenge.

The main reason I would prefer not to add something like Collector identity is not complexity, but the effect it would have on rotation of those keys.  Sites would be justifiably reluctant to rotate things that are deployed to millions of browsers.  That might motivate some sort of indirection (supplying a URL where the keys can be found, for example, or, though I feel dirty typing it, a /.well-known/ resource).
 
> Actually, the `TaskConfig` structure has a `start_time` field:
> https://ietf-wg-ppm.github.io/draft-ietf-ppm-dap-taskprov/draft-ietf-ppm-dap-taskprov.html#section-3.1-2

Reading comprehension failure on my part.  Why doesn't this use Interval?

It's still hard for Attribution to use times like this.  It might be that we fix these values to (0, →∞) to get them out of the way.