Conversation
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| // The caller must only call PrepNext with a message produced by a successful | ||
| // PrepSharesToPrep call over one authenticated prep share from each aggregator. | ||
| // PrepNext does not independently verify the FLP proof. |
There was a problem hiding this comment.
🟨 Output share released without verifying joint randomness when the prep message omits it
The verification step in PrepNext (vdaf/prio3/internal/prio3/prio3.go:377-383) is skipped entirely if msg.joinRand is nil, even when the aggregator's own state expects a corrected joint randomness seed (state.correctedJointRandSeed != nil). A caller (or a malicious peer supplying the prep message in a deployment that forwards it) can therefore obtain an output share for a measurement whose joint randomness was never validated, weakening the robustness guarantee of Prio3. The new documentation added in this PR shifts the responsibility to the caller instead of enforcing it in the library, which conflicts with the repository policy of validating inputs at API boundaries (AGENTS.md "Validate inputs at API boundaries").
Was this helpful? React with 👍 or 👎 to provide feedback.
2 participants
Uh oh!
There was an error while loading. Please reload this page.