Alternative Multi-dimensional Rappor

components/rappor/rappor_metric.cc

Index: components/rappor/rappor_metric.cc
diff --git a/components/rappor/rappor_metric.cc b/components/rappor/rappor_metric.cc
index 862ead8933a0612026378722dca0abeab8398242..3c368a3c98ae9820963a223632af74b904af2df7 100644
--- a/components/rappor/rappor_metric.cc
+++ b/components/rappor/rappor_metric.cc
@@ -6,6 +6,7 @@
 
 #include "base/logging.h"
 #include "base/rand_util.h"
+#include "components/rappor/reports.h"
 
 namespace rappor {
 
@@ -38,35 +39,7 @@ void RapporMetric::AddSample(const std::string& str) {
 }
 
 ByteVector RapporMetric::GetReport(const std::string& secret) const {
-  // Generate a deterministically random mask of fake data using the
-  // client's secret key + real data as a seed.  The inclusion of the secret
-  // in the seed avoids correlations between real and fake data.
-  // The seed isn't a human-readable string.
-  const std::string personalization_string = metric_name_ +
-      std::string(bytes().begin(), bytes().end());
-  HmacByteVectorGenerator hmac_generator(bytes().size(), secret,
-                                         personalization_string);
-  const ByteVector fake_mask =
-      hmac_generator.GetWeightedRandomByteVector(parameters().fake_prob);
-  ByteVector fake_bits =
-      hmac_generator.GetWeightedRandomByteVector(parameters().fake_one_prob);
-
-  // Redact most of the real data by replacing it with the fake data, hiding
-  // and limiting the amount of information an individual client reports on.
-  const ByteVector* fake_and_redacted_bits =
-      ByteVectorMerge(fake_mask, bytes(), &fake_bits);
-
-  // Generate biased coin flips for each bit.
-  ByteVectorGenerator coin_generator(bytes().size());
-  const ByteVector zero_coins =
-      coin_generator.GetWeightedRandomByteVector(parameters().zero_coin_prob);
-  ByteVector one_coins =
-      coin_generator.GetWeightedRandomByteVector(parameters().one_coin_prob);
-
-  // Create a randomized response report on the fake and redacted data, sending
-  // the outcome of flipping a zero coin for the zero bits in that data, and of
-  // flipping a one coin for the one bits in that data, as the final report.
-  return *ByteVectorMerge(*fake_and_redacted_bits, zero_coins, &one_coins);
+  return internal::GenerateReport(secret, parameters(), bytes());

[Alexei Svitkine (slow), 2015/04/23 21:42:34]

It looks like with this refactoring we're losing the metric_name_ prefix when
building the personalization_string. I don't think that's intentional?

[Steven Holte, 2015/04/24 16:59:05]

It's intentional, I mentioned it in this earlier comment:
https://codereview.chromium.org/1090683003/diff/1/components/rappor/reports.c...

It should actually improve privacy slightly.

[Alexei Svitkine (slow), 2015/04/24 18:10:01]

Okay, please mention this in the CL description. Also, please expand CL
description to briefly summarize what's being added here - maybe even include a
sample of the API use in it.

 }
 
 void RapporMetric::SetBytesForTesting(const ByteVector& bytes) {