[Ppm] Interim topic: Shall DAP support heavy hitters?

[Christopher Patton <[e-mail]>]

Hi folks,

As noted at IETF 118, there are a number of issues for the DAP spec related
to supporting heavy hitters via Poplar1:
https://datatracker.ietf.org/meeting/118/materials/slides-118-ppm-dap-open-issues

We'd like to spend a significant chunk of time during the interim on
resolving these issues. To that end, Tim G. and I have been leading a small
design team over the last couple of months towards identifying a set
protocol changes to support this important use case. We need your help
deciding between three different options:

- Proposal #0: Don't support heavy hitters in DAP (punt to a future
protocol spec)
- Proposal #1: Support heavy hitters with minimal changes to DAP
- Proposal #2: Support heavy hitters, but amend the collection sub-protocol
to minimize the amount of information revealed to the Collector

Each proposal is detailed in the following google doc:
https://docs.google.com/document/d/1ZjXz-1kGsTDf2Vn2u-fwYqR8BSc3tOYlELVHAYvAfjk/edit?usp=sharing

It would be helpful if folks could spend some time ahead of the interim (22
April, two weeks from now) digesting these options, providing feedback, and
figuring out what information you need, if any, to form an opinion. My hope
is that we'll be prepared to make a decision during the interim on the
questions enumerated in Section 6.

Relatedly: If we decide to support heavy hitters, then we'll also need to
decide how to deal with a class of attacks against DAP/Poplar1 articulated
by Simon Friedberger and Phillipp Schoppmann. We call these "steering
attacks", as they exploit the fact that the attacker in our threat model
has partial control of the protocol execution that is not considered the
original Poplar paper (https://ia.cr/2021/017). There are a few mitigations
in the google doc that we'd like folks to mull over.

I'm looking forward to seeing folks online in a couple of weeks.

Thanks,
Chris P.