search

WICG / attribution-reporting-api

Attribution Reporting API
https://wicg.github.io/attribution-reporting-api/
Other
347 stars 161 forks source link

Incorrect Bitwise Operation in aggregatable-histogram creation #1353

Closed hiratara closed 2 days ago

hiratara commented 6 days ago

Hello,

I have identified a discrepancy in the implementation of the Attribution Reporting API concerning the handling of aggregation keys. According to the Privacy Sandbox documentation on aggregation keys (https://developers.google.com/privacy-sandbox/relevance/attribution-reporting/aggregation-keys), a key should be calculated using the XOR (^) operation, specifically stating, "A key is calculated by taking the XOR (^) of its key pieces."

However, the current implementation in the API seems to use the OR bitwise operation instead of XOR. This contradicts both the documentation and the original specification detailed in pull request https://github.com/WICG/attribution-reporting-api/pull/416, which clearly states: Set |aggregationKeys|[|sourceKey|] to |aggregationKeys|[|sourceKey|] XOR |triggerData|'s [=attribution aggregatable trigger data/key piece=].

It appears that there may have been a misunderstanding or an error in implementing the intended bitwise operation. Can this be confirmed and corrected if necessary? This issue could potentially affect the accuracy and intended functionality of key aggregation in the API.

Thank you for your attention to this matter.

linnan-github commented 5 days ago

Thanks for reporting the issue in the documentation. The bitwise OR is the intended behavior, which is what has been implemented and corrected in the specification (step 2.2.2 in https://wicg.github.io/attribution-reporting-api/#create-aggregatable-contributions).

We will fix the documentation to avoid confusion.

hiratara commented 3 days ago

Thank you for the clarification and for your prompt response. I appreciate the update and look forward to seeing the revised documentation.

hiratara commented 2 days ago

Hello @apasel422,

I noticed that the ticket was closed as completed, but the documentation still appears to be unchanged. Could you please clarify why the ticket was closed? Additionally, could you inform me where I can track the progress or check for updates regarding the documentation revision? Is there a specific issue or pull request that I should follow?

Thank you for your assistance.

apasel422 commented 2 days ago

@hiratara The documentation issue you identified is not covered by this repository, which covers the Attribution Reporting specification. I suggest filing a bug there if @linnan-github hasn't already.

hiratara commented 2 days ago

Hello @apasel422, @linnan-github and @akashnadan,

I have created a new issue to address the incorrect use of XOR in place of OR in the aggregatable-histogram creation as discussed. The issue can be found here: https://github.com/privacysandbox/privacy-sandbox-dev-support/issues/387 . I appreciate your guidance on this matter and look forward to the resolution.

Thank you.