Skip to content

Commit 7634a8a

Browse files
authored
Minor updates to filtering ID explainer (#129)
Updates the variable name (ByteSize -> MaxBytes), the limit on the ID space (from 32 bits/4 bytes to 64 bits/8 bytes) and to make the filteringId's type a bigint.
1 parent a857522 commit 7634a8a

File tree

1 file changed

+14
-13
lines changed

1 file changed

+14
-13
lines changed

flexible_filtering.md

+14-13
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,8 @@ within a worklet/script runner — e.g. for a Protected Audience bidder — and
9191
could even be chosen based on cross-site data. For example:
9292

9393
```js
94-
privateAggregation.contributeToHistogram({bucket: 1234n, value: 56, filteringId: 3});
94+
privateAggregation.contributeToHistogram(
95+
{bucket: 1234n, value: 56, filteringId: 3n});
9596
```
9697

9798
If no filtering ID is provided, a default ID of 0 will be used. (See also
@@ -163,10 +164,10 @@ number of IDs used can be much larger while keeping processing costs reasonable.
163164

164165
#### Small ID space by default, but configurable
165166

166-
The filtering ID would be an unsigned integer limited to a small number of bits
167-
(e.g. 8) by default. If no filtering ID is provided, a value of 0 will be used.
168-
We limit the size of the ID space to prevent unnecessarily increasing the
169-
payload size and thus storage and processing costs. As filtering IDs are not
167+
The filtering ID would be an unsigned integer limited to a small number of bytes
168+
(1 byte = 8 bits) by default. If no filtering ID is provided, a value of 0 will
169+
be used. We limit the size of the ID space to prevent unnecessarily increasing
170+
the payload size and thus storage and processing costs. As filtering IDs are not
170171
readable by the reporting endpoint, processing multiple filtering IDs separately
171172
would typically require reprocessing the same reports for each query (see [the
172173
first example use](#processing-contributions-at-different-cadences-1) above).
@@ -175,13 +176,13 @@ practical with this flow.
175176

176177
However, other flows could make use of a larger ID space (see [the second
177178
example use case](#processing-contributions-by-campaign-id-1) above), so we plan
178-
to allow for the ID space to be configurable per-report, e.g. to 32 bits. To
179-
avoid amplifying a counting attack due to the different payload size, we plan to
180-
make the number of reports emitted with this custom label size deterministic.
181-
This will result in a null report being sent if no contributions are made. Note
182-
that this means the filtering ID _space_ for Private Aggregation reports must
183-
also be specified outside Shared Storage worklets/Protected Audience script
184-
runners.
179+
to allow for the ID space to be configurable per-report, up to 8 bytes (i.e. 64
180+
bits). To avoid amplifying a counting attack due to the different payload size,
181+
we plan to make the number of reports emitted with this custom label size
182+
deterministic. This will result in a null report being sent if no contributions
183+
are made. Note that this means the filtering ID _space_ for Private Aggregation
184+
reports must also be specified outside Shared Storage worklets/Protected
185+
Audience script runners.
185186

186187
For Shared Storage and Protected Audience sellers, we propose reusing the
187188
`privateAggregationConfig` implemented/proposed for report verification, adding
@@ -191,7 +192,7 @@ a new field, e.g.
191192
sharedStorage.run('example-operation', {
192193
privateAggregationConfig: {
193194
contextId: 'example-id',
194-
filteringIdBitSize: 32
195+
filteringIdMaxBytes: 8 // i.e. allow up to a 64-bit integer
195196
}
196197
});
197198
```

0 commit comments

Comments
 (0)