Verifiable Distributed Aggregation Functions
draft-irtf-cfrg-vdaf-22

Technical Summary

This document defines a class of cryptographic mechanisms — VDAF. This class of mechanisms is designed to solve the following problem. There is a set of data owned by different entities (the number of owners is arbitrary). The goal is to compute certain aggregated statistics over this data in such a way that no party other than the data owner gains any non trivial information about their data, while it remains possible to verify the correctness of the data in a specified sense. To solve this problem, VDAF proposes the following architecture. The data owners are clients (for example, they may be banks, and the data may be user data). To compute the aggregated statistics, specialized entities — aggregators — are used. The result is obtained by a participant acting in the role of a collector. Some participants may combine several roles. VDAF is a class of cryptographic computations that falls within the scope of MPC based on secret sharing.

The document defines two specific representatives of the VDAF class and assigns IANA identifiers to them:

- The Prio3 protocol (Section 7) enables the computation of a wide variety of aggregation functions, including (but not limited to) the sum, mean, standard deviation, histograms, and linear regression. There are five variants of the protocol: Prio3Count, Prio3Sum, Prio3SumVec, Prio3Histogram, and Prio3MultihotCountVec.

- The Poplar1 protocol (Section 8) enables the computation of the number of clients’ string data that have a specified prefix.
Section 9 informally describes the properties that the mechanisms of the VDAF class are able to provide and includes a reference to the work containing the formal definition. It also specifies a number of considerations for selecting parameters for mechanisms belonging to the VDAF class. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

Research Group Summary
The zero version of the document was adopted in April 2022. There was a Research Group Last Call for the draft in 2026 (June-July). There were no major concerns raised during the RGLC. A number of minor concerns raised during the RGLC were addressed by the authors. The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered. Crypto Review Panel review was solicited between November 2024 and June 2026.  The reviews were provided by Julia Hesse. Comments from that review were addressed in -16.

Document Quality
There are several publicly available implementations:
A Rust implementation at https://github.com/divviup/libprio-rs/
CloudFlare's CIRCL library has an implementation at https://github.com/cloudflare/circl/tree/main/vdaf
All authors of the document have confirmed that they are not aware of any IPRs related to the document.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Dirk Kutscher is the IRTF Chair.

Technical Summary

This document defines a class of cryptographic mechanisms — VDAF. This class of mechanisms is designed to solve the following problem. There is a set of data owned by different entities (the number of owners is arbitrary). The goal is to compute certain aggregated statistics over this data in such a way that no party other than the data owner gains any non trivial information about their data, while it remains possible to verify the correctness of the data in a specified sense. To solve this problem, VDAF proposes the following architecture. The data owners are clients (for example, they may be banks, and the data may be user data). To compute the aggregated statistics, specialized entities — aggregators — are used. The result is obtained by a participant acting in the role of a collector. Some participants may combine several roles. VDAF is a class of cryptographic computations that falls within the scope of MPC based on secret sharing.

The document defines two specific representatives of the VDAF class and assigns IANA identifiers to them:

- The Prio3 protocol (Section 7) enables the computation of a wide variety of aggregation functions, including (but not limited to) the sum, mean, standard deviation, histograms, and linear regression. There are five variants of the protocol: Prio3Count, Prio3Sum, Prio3SumVec, Prio3Histogram, and Prio3MultihotCountVec.

- The Poplar1 protocol (Section 8) enables the computation of the number of clients’ string data that have a specified prefix.
Section 9 informally describes the properties that the mechanisms of the VDAF class are able to provide and includes a reference to the work containing the formal definition. It also specifies a number of considerations for selecting parameters for mechanisms belonging to the VDAF class. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.


There are a number of comments accompanying the document text.
1. Section 3 states: «it is possible for the same entity to play more than one role». Let’s consider a scenario where each aggregator starts playing the role of a single client, and there are no other clients. In this case, if only one aggregator is honest (and the document claims that this is sufficient), an attacker who learns the sum of the data could reconstruct the data of the client whose role is played by the honest aggregator.
What should be done in this situation? The text should be revised to address this case. For example, it could be possible to remove the claim that a single honest party is sufficient for any VDAF schemes, or explicitly state that this particular architecture is not considered in the analysis.

2. The document defines another class of mechanisms — DAF (see Section 4). This is a more basic mechanism; unlike VDAF, it does not provide verifiability of clients’ data. Note that Section 1 presents DAF and VDAF with roughly equal emphasis, but the rest of the document makes it clear that the primary focus is on VDAF, while DAF is merely a supplementary concept. It may therefore be advisable to omit the mention of the DAF mechanism class in Section 1.
Furthermore, Section 4 states that the use of DAF is not recommended for most applications. Given that there are applications in which DAF is appropriate, it is proposed to either remove this remark or present the phrase “not recommended” not as key world (in smaller font).

3. Section 1 includes a comparison of DAF with differential privacy (DP). The rationale for this comparison is not entirely clear. DP and DAF mechanisms address different problems. From a practical perspective, for example, DP does not allow obtaining an exact value of the aggregate. It may be worthwhile to describe the problem more concretely from the outset (including the fact that the amount of data from which the aggregate is computed is unlimited) and focus the discussion solely on DAF (VDAF). Alternatively, it could be interesting to compare DAF with another mechanism, such as PSA (Private Stream Aggregation) scheme.

Research Group Summary
The zero version of the document was adopted in April 2022. There was a Research Group Last Call for the draft in 2026 (June-July). There were no major concerns raised during the RGLC. A number of minor concerns raised during the RGLC were addressed by the authors. The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered. Crypto Review Panel review was solicited between November 2024 and June 2026.  The reviews were provided by Julia Hesse. Comments from that review were addressed in -16.

Document Quality
There are several publicly available implementations:
A Rust implementation at https://github.com/divviup/libprio-rs/
CloudFlare's CIRCL library has an implementation at https://github.com/cloudflare/circl/tree/main/vdaf
All authors of the document have confirmed that they are not aware of any IPRs related to the document.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Dirk Kutscher is the IRTF Chair.

Technical Summary

This document defines a class of cryptographic mechanisms — VDAF. This class of mechanisms is designed to solve the following problem. There is a set of data owned by different entities (the number of owners is arbitrary). The goal is to compute certain aggregated statistics over this data in such a way that no party other than the data owner gains any non trivial information about their data, while it remains possible to verify the correctness of the data in a specified sense. To solve this problem, VDAF proposes the following architecture. The data owners are clients (for example, they may be banks, and the data may be user data). To compute the aggregated statistics, specialized entities — aggregators — are used. The result is obtained by a participant acting in the role of a collector. Some participants may combine several roles. VDAF is a class of cryptographic computations that falls within the scope of MPC based on secret sharing.
The document defines two specific representatives of the VDAF class and assigns IANA identifiers to them:
- The Prio3 protocol (Section 7) enables the computation of a wide variety of aggregation functions, including (but not limited to) the sum, mean, standard deviation, histograms, and linear regression. There are five variants of the protocol: Prio3Count, Prio3Sum, Prio3SumVec, Prio3Histogram, and Prio3MultihotCountVec.
- The Poplar1 protocol (Section 8) enables the computation of the number of clients’ string data that have a specified prefix.
Section 9 informally describes the properties that the mechanisms of the VDAF class are able to provide and includes a reference to the work containing the formal definition. It also specifies a number of considerations for selecting parameters for mechanisms belonging to the VDAF class. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

There are a number of comments accompanying the document text.
1. Section 3 states: «it is possible for the same entity to play more than one role». Let’s consider a scenario where each aggregator starts playing the role of a single client, and there are no other clients. In this case, if only one aggregator is honest (and the document claims that this is sufficient), an attacker who learns the sum of the data could reconstruct the data of the client whose role is played by the honest aggregator.
What should be done in this situation? The text should be revised to address this case. For example, it could be possible to remove the claim that a single honest party is sufficient for any VDAF schemes, or explicitly state that this particular architecture is not considered in the analysis.

2. The document defines another class of mechanisms — DAF (see Section 4). This is a more basic mechanism; unlike VDAF, it does not provide verifiability of clients’ data. Note that Section 1 presents DAF and VDAF with roughly equal emphasis, but the rest of the document makes it clear that the primary focus is on VDAF, while DAF is merely a supplementary concept. It may therefore be advisable to omit the mention of the DAF mechanism class in Section 1.
Furthermore, Section 4 states that the use of DAF is not recommended for most applications. Given that there are applications in which DAF is appropriate, it is proposed to either remove this remark or present the phrase “not recommended” not as key world (in smaller font).

3. Section 1 includes a comparison of DAF with differential privacy (DP). The rationale for this comparison is not entirely clear. DP and DAF mechanisms address different problems. From a practical perspective, for example, DP does not allow obtaining an exact value of the aggregate. It may be worthwhile to describe the problem more concretely from the outset (including the fact that the amount of data from which the aggregate is computed is unlimited) and focus the discussion solely on DAF (VDAF). Alternatively, it could be interesting to compare DAF with another mechanism, such as PSA (Private Stream Aggregation) scheme.

Research Group Summary
The zero version of the document was adopted in April 2022. There was a Research Group Last Call for the draft in 2026 (June-July). There were no major concerns raised during the RGLC. A number of minor concerns raised during the RGLC were addressed by the authors. The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered. Crypto Review Panel review was solicited between November 2024 and June 2026.  The reviews were provided by Julia Hesse. Comments from that review were addressed in -16.

Document Quality
There are several publicly available implementations:
A Rust implementation at https://github.com/divviup/libprio-rs/
CloudFlare's CIRCL library has an implementation at https://github.com/cloudflare/circl/tree/main/vdaf
All authors of the document have confirmed that they are not aware of any IPRs related to the document.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Dirk Kutscher is the IRTF Chair.

Technical Summary

This document defines a class of cryptographic mechanisms — VDAF. This class of mechanisms is designed to solve the following problem. There is a set of data owned by different entities (the number of owners is arbitrary). The goal is to compute certain aggregated statistics over this data in such a way that no party other than the data owner gains any non trivial information about their data, while it remains possible to verify the correctness of the data in a specified sense. To solve this problem, VDAF proposes the following architecture. The data owners are clients (for example, they may be banks, and the data may be user data). To compute the aggregated statistics, specialized entities — aggregators — are used. The result is obtained by a participant acting in the role of a collector. Some participants may combine several roles. VDAF is a class of cryptographic computations that falls within the scope of MPC based on secret sharing.
The document defines two specific representatives of the VDAF class and assigns IANA identifiers to them:
• The Prio3 protocol (Section 7) enables the computation of a wide variety of aggregation functions, including (but not limited to) the sum, mean, standard deviation, histograms, and linear regression. There are five variants of the protocol: Prio3Count, Prio3Sum, Prio3SumVec, Prio3Histogram, and Prio3MultihotCountVec.
• The Poplar1 protocol (Section 8) enables the computation of the number of clients’ string data that have a specified prefix.
Section 9 informally describes the properties that the mechanisms of the VDAF class are able to provide and includes a reference to the work containing the formal definition. It also specifies a number of considerations for selecting parameters for mechanisms belonging to the VDAF class. This document is a product of the Crypto Forum Research Group (CFRG) in the IRTF.

There are a number of comments accompanying the document text.
1. Section 3 states: «it is possible for the same entity to play more than one role». Let’s consider a scenario where each aggregator starts playing the role of a single client, and there are no other clients. In this case, if only one aggregator is honest (and the document claims that this is sufficient), an attacker who learns the sum of the data could reconstruct the data of the client whose role is played by the honest aggregator.
What should be done in this situation? The text should be revised to address this case. For example, it could be possible to remove the claim that a single honest party is sufficient for any VDAF schemes, or explicitly state that this particular architecture is not considered in the analysis.

2. The document defines another class of mechanisms — DAF (see Section 4). This is a more basic mechanism; unlike VDAF, it does not provide verifiability of clients’ data. Note that Section 1 presents DAF and VDAF with roughly equal emphasis, but the rest of the document makes it clear that the primary focus is on VDAF, while DAF is merely a supplementary concept. It may therefore be advisable to omit the mention of the DAF mechanism class in Section 1.
Furthermore, Section 4 states that the use of DAF is not recommended for most applications. Given that there are applications in which DAF is appropriate, it is proposed to either remove this remark or present the phrase “not recommended” not as key world (in smaller font).

3. Section 1 includes a comparison of DAF with differential privacy (DP). The rationale for this comparison is not entirely clear. DP and DAF mechanisms address different problems. From a practical perspective, for example, DP does not allow obtaining an exact value of the aggregate. It may be worthwhile to describe the problem more concretely from the outset (including the fact that the amount of data from which the aggregate is computed is unlimited) and focus the discussion solely on DAF (VDAF). Alternatively, it could be interesting to compare DAF with another mechanism, such as PSA (Private Stream Aggregation) scheme.

Research Group Summary
The zero version of the document was adopted in April 2022. There was a Research Group Last Call for the draft in 2026 (June-July). There were no major concerns raised during the RGLC. A number of minor concerns raised during the RGLC were addressed by the authors. The authors have answered the questions raised during the Research Group Last Call, no questions have remained unanswered. Crypto Review Panel review was solicited between November 2024 and June 2026.  The reviews were provided by Julia Hesse. Comments from that review were addressed in -16.

Document Quality
There are several publicly available implementations:
A Rust implementation at https://github.com/divviup/libprio-rs/
CloudFlare's CIRCL library has an implementation at https://github.com/cloudflare/circl/tree/main/vdaf
All authors of the document have confirmed that they are not aware of any IPRs related to the document.

Personnel
Stanislav Smyshlyaev is the Document Shepherd.
Dirk Kutscher is the IRTF Chair.