Add a new explainer for the FLEDGE Key/Value Server trust model #295

p-j-l · 2022-04-27T17:30:10Z

No description provided.

michaelkleber · 2022-05-05T23:15:55Z

FLEDGE_Key_Value_Server_trust_model.md

+*   _Client software_: shorthand for the implementation of FLEDGE in a browser or on a device (such as a [Chrome browser](https://www.google.com/url?q=https://github.com/WICG/turtledove/blob/main/FLEDGE.md%2331-fetching-real-time-data-from-a-trusted-server&sa=D&source=docs&ust=1651077929049635&usg=AOvVaw2mNLZwBgIzzYL7iUKJTUwb) or an [Android device](https://www.google.com/url?q=https://developer.android.com/design-for-safety/ads/fledge%23ad-selection-ad-tech-platform-managed-trusted-server&sa=D&source=docs&ust=1651077929049793&usg=AOvVaw19U97RKrvuOGjGH-tIk98Y)).
+*   _Attestation_: a mechanism to authenticate software identity, usually with [cryptographic hashes](https://en.wikipedia.org/wiki/Cryptographic_hash_function) or signatures. In this proposal, attestation matches the code running in the adtech-operated key/value service with the open source code.
+*   _Trusted Execution Environment (TEE)_: a dedicated, closed execution context that is isolated through hardware memory protection and cryptographic protection of storage. The TEE's contents are protected from observation and tampering by unauthorized parties, including the root user.
+*   _Key management service (KMS): _a centralized component tasked with provision of decryption keys to appropriately secured aggregation server instances. Provision of public encryption keys to end user devices and key rotation also fall under key management.


(Need to move an _ one character left, to get your italics to work right...)

michaelkleber · 2022-05-05T23:22:30Z

FLEDGE_Key_Value_Server_trust_model.md

+
+
+
+![alt_text](assets/fledge_key_value_server.png "FLEDGE Key Value Server system diagram")


Is "FLEDGE Key Value Server system diagram" intended as alt text? Looks like it needs to be in the brackets in that case. It breaks the image embed as-is.

https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#images

michaelkleber · 2022-05-06T00:35:19Z

FLEDGE_Key_Value_Server_trust_model.md

+
+
+1. That the timestamp of the request could be used to correlate the lookup keys with the request of the top-level page and thus identify a user. This is mitigated by limiting the logs that are written.
+2. During the FLEDGE auction, a client asks a key/value server about an assortment of keys that were previously stored on the client — perhaps including keys that were stored in multiple different contexts (different sites or different apps, via [Shared Storage](https://github.com/pythagoraskitty/shared-storage)).  That set of keys, therefore, risks leaking some information about the client's activity.  The privacy goal of key/value server design is to give the client confidence that the set of keys cannot be used for tracking or profiling purposes.  This threat is mitigated by the TEE protections to allow only pre-approved code.


I don't think Shared Storage is relevant here. The keys might come from different contexts because the same Interest Group owner might have called joinAdInterestGroup() (and set lookup keys) on multiple different domains.

Thanks, I've removed the reference to Shared Storage there.

michaelkleber · 2022-05-06T00:40:10Z

FLEDGE_Key_Value_Server_trust_model.md

+
+
+1. _Monitoring metrics_ - Only noised aggregate metrics will be available for monitoring and alerting.  These will be aggregated to at least k size.
+    1. For example, counting the approximate number of failed requests in the past n minutes is likely to be fine but doing so at millisecond granularity is not.


Formatting for nested lists is wrong — the "1." of the nested lists needs to be indented to be under the first character of the list item. See details here:

https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#nested-lists

Thanks, fixed

Remove reference to Shared Storage that was confusing

p-j-l added 5 commits April 27, 2022 13:19

Create FLEDGE_Key_Value_Server_trust_model.md

4c98674

Add FLEDGE Key/Value Server system diagram

b7af6ce

Update FLEDGE_Key_Value_Server_trust_model.md

97c64ef

Add files via upload

759925c

Delete fledge_key_value_server.png

d950973

p-j-l closed this Apr 27, 2022

Update FLEDGE_Key_Value_Server_trust_model.md

989214d

p-j-l reopened this May 5, 2022

michaelkleber self-requested a review May 5, 2022 23:14

michaelkleber requested changes May 6, 2022

View reviewed changes

p-j-l added 3 commits May 6, 2022 16:20

Fix typos

65ad484

Fix more typos

66c441e

Remove reference to Shared Storage that was confusing

Correct list formatting

cc140e9

p-j-l requested a review from michaelkleber May 6, 2022 20:24

michaelkleber merged commit 5154f0c into WICG:main May 6, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add a new explainer for the FLEDGE Key/Value Server trust model #295

Add a new explainer for the FLEDGE Key/Value Server trust model #295

p-j-l commented Apr 27, 2022

michaelkleber May 5, 2022

p-j-l May 6, 2022

michaelkleber May 5, 2022

p-j-l May 6, 2022

michaelkleber May 6, 2022

p-j-l May 6, 2022

michaelkleber May 6, 2022

p-j-l May 6, 2022




		![alt_text](assets/fledge_key_value_server.png "FLEDGE Key Value Server system diagram")



		1. That the timestamp of the request could be used to correlate the lookup keys with the request of the top-level page and thus identify a user. This is mitigated by limiting the logs that are written.
		2. During the FLEDGE auction, a client asks a key/value server about an assortment of keys that were previously stored on the client — perhaps including keys that were stored in multiple different contexts (different sites or different apps, via [Shared Storage](https://github.com/pythagoraskitty/shared-storage)). That set of keys, therefore, risks leaking some information about the client's activity. The privacy goal of key/value server design is to give the client confidence that the set of keys cannot be used for tracking or profiling purposes. This threat is mitigated by the TEE protections to allow only pre-approved code.



		1. _Monitoring metrics_ - Only noised aggregate metrics will be available for monitoring and alerting. These will be aggregated to at least k size.
		1. For example, counting the approximate number of failed requests in the past n minutes is likely to be fine but doing so at millisecond granularity is not.

Add a new explainer for the FLEDGE Key/Value Server trust model #295

Add a new explainer for the FLEDGE Key/Value Server trust model #295

Conversation

p-j-l commented Apr 27, 2022

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment