Implement Verifiable Incremental Distributed Point Function (VIDPF).

benches/speed_tests.rs

@@ -794,8 +794,53 @@ fn poplar1(c: &mut Criterion) {
     group.finish();
 }
 
+/// Benchmark VIDPF performance.
 #[cfg(feature = "experimental")]
-criterion_group!(benches, poplar1, prio3, prio2, poly_mul, prng, idpf, dp_noise);
+fn vidpf(c: &mut Criterion) {
+    use prio::vidpf::{Vidpf, VidpfInput, VidpfWeight};
+
+    let test_sizes = [8usize, 8 * 16, 8 * 256];
+    const NONCE_SIZE: usize = 16;
+    const NONCE: &[u8; NONCE_SIZE] = b"Test Nonce VIDPF";
+
+    let mut group = c.benchmark_group("vidpf_gen");
+    for size in test_sizes.iter() {
+        group.throughput(Throughput::Bytes(*size as u64 / 8));
+        group.bench_with_input(BenchmarkId::from_parameter(size), size, |b, &size| {
+            let bits = iter::repeat_with(random).take(size).collect::<Vec<bool>>();
+            let input = VidpfInput::from_bools(&bits);
+            let weight = VidpfWeight::from(vec![Field255::one(), Field255::one()]);
+
+            let vidpf = Vidpf::<VidpfWeight<Field255>, NONCE_SIZE>::new(2);
+
+            b.iter(|| {
+                let _ = vidpf.gen(&input, &weight, NONCE).unwrap();
+            });
+        });
+    }
+    group.finish();
+
+    let mut group = c.benchmark_group("vidpf_eval");
+    for size in test_sizes.iter() {
+        group.throughput(Throughput::Bytes(*size as u64 / 8));
+        group.bench_with_input(BenchmarkId::from_parameter(size), size, |b, &size| {
+            let bits = iter::repeat_with(random).take(size).collect::<Vec<bool>>();
+            let input = VidpfInput::from_bools(&bits);
+            let weight = VidpfWeight::from(vec![Field255::one(), Field255::one()]);
+            let vidpf = Vidpf::<VidpfWeight<Field255>, NONCE_SIZE>::new(2);
+
+            let (public, keys) = vidpf.gen(&input, &weight, NONCE).unwrap();
+
+            b.iter(|| {
+                let _ = vidpf.eval(&keys[0], &public, &input, NONCE).unwrap();
+            });
+        });
+    }
+    group.finish();
+}
+
+#[cfg(feature = "experimental")]
+criterion_group!(benches, poplar1, prio3, prio2, poly_mul, prng, idpf, dp_noise, vidpf);
 #[cfg(not(feature = "experimental"))]
 criterion_group!(benches, prio3, prng, poly_mul);
 

src/idpf.rs

@@ -24,6 +24,7 @@ use std::{
     collections::{HashMap, VecDeque},
     fmt::Debug,
     io::{Cursor, Read},
+    iter::zip,
     ops::{Add, AddAssign, ControlFlow, Index, Sub},
 };
 use subtle::{Choice, ConditionallyNegatable, ConditionallySelectable, ConstantTimeEq};
@@ -108,6 +109,11 @@ impl IdpfInput {
             index: self.index[..=level].to_owned().into(),
         }
     }
+
+    /// Return the bit at the specified level if the level is in bounds.
+    pub fn get(&self, level: usize) -> Option<bool> {
+        self.index.get(level).as_deref().copied()
+    }
 }
 
 impl From<BitVec<usize, Lsb0>> for IdpfInput {
@@ -147,7 +153,7 @@ pub trait IdpfValue:
     + Sub<Output = Self>
     + ConditionallyNegatable
     + Encode
-    + Decode
+    + ParameterizedDecode<Self::ValueParameter>
     + Sized
 {
     /// Any run-time parameters needed to produce a value.
@@ -788,7 +794,7 @@ where
 
 impl<V> Eq for IdpfCorrectionWord<V> where V: ConstantTimeEq {}
 
-fn xor_seeds(left: &[u8; 16], right: &[u8; 16]) -> [u8; 16] {
+pub(crate) fn xor_seeds(left: &[u8; 16], right: &[u8; 16]) -> [u8; 16] {
     let mut seed = [0u8; 16];
     for (a, (b, c)) in left.iter().zip(right.iter().zip(seed.iter_mut())) {
         *c = a ^ b;
@@ -822,7 +828,7 @@ fn control_bit_to_seed_mask(control: Choice) -> [u8; 16] {
 
 /// Take two seeds and a control bit, and return the first seed if the control bit is zero, or the
 /// XOR of the two seeds if the control bit is one. This does not branch on the control bit.
-fn conditional_xor_seeds(
+pub(crate) fn conditional_xor_seeds(
     normal_input: &[u8; 16],
     switched_input: &[u8; 16],
     control: Choice,
@@ -835,13 +841,18 @@ fn conditional_xor_seeds(
 
 /// Returns one of two seeds, depending on the value of a selector bit. Does not branch on the
 /// selector input or make selector-dependent memory accesses.
-fn conditional_select_seed(select: Choice, seeds: &[[u8; 16]; 2]) -> [u8; 16] {
+pub(crate) fn conditional_select_seed(select: Choice, seeds: &[[u8; 16]; 2]) -> [u8; 16] {
     or_seeds(
         &and_seeds(&control_bit_to_seed_mask(!select), &seeds[0]),
         &and_seeds(&control_bit_to_seed_mask(select), &seeds[1]),
     )
 }
 
+/// Interchange the contents of seeds if the choice is 1, otherwise seeds remain unchanged.
+pub(crate) fn conditional_swap_seed(lhs: &mut [u8; 16], rhs: &mut [u8; 16], choice: Choice) {
+    zip(lhs, rhs).for_each(|(a, b)| u8::conditional_swap(a, b, choice));
+}
+
 /// An interface that provides memoization of IDPF computations.
 ///
 /// Each instance of a type implementing `IdpfCache` should only be used with one IDPF key and

src/lib.rs

@@ -33,3 +33,9 @@ mod polynomial;
 mod prng;
 pub mod topology;
 pub mod vdaf;
+#[cfg(all(feature = "crypto-dependencies", feature = "experimental"))]
+#[cfg_attr(
+    docsrs,
+    doc(cfg(all(feature = "crypto-dependencies", feature = "experimental")))
+)]
+pub mod vidpf;

src/vdaf.rs

@@ -9,6 +9,8 @@
 use crate::dp::DifferentialPrivacyStrategy;
 #[cfg(all(feature = "crypto-dependencies", feature = "experimental"))]
 use crate::idpf::IdpfError;
+#[cfg(all(feature = "crypto-dependencies", feature = "experimental"))]
+use crate::vidpf::VidpfError;
 use crate::{
     codec::{CodecError, Decode, Encode, ParameterizedDecode},
     field::{encode_fieldvec, merge_vector, FieldElement, FieldError},
@@ -57,6 +59,11 @@ pub enum VdafError {
     #[error("idpf error: {0}")]
     Idpf(#[from] IdpfError),
 
+    /// VIDPF error.
+    #[cfg(all(feature = "crypto-dependencies", feature = "experimental"))]
+    #[error("vidpf error: {0}")]
+    Vidpf(#[from] VidpfError),
+
     /// Errors from other VDAFs.
     #[error(transparent)]
     Other(Box<dyn Error + 'static + Send + Sync>),