Skip to content

Restrict YClient visibility to prevent queries without key generation#11

Open
p0mvn wants to merge 1 commit intomenonsamir:artifactfrom
valargroup:security/restrict-yclient-visibility
Open

Restrict YClient visibility to prevent queries without key generation#11
p0mvn wants to merge 1 commit intomenonsamir:artifactfrom
valargroup:security/restrict-yclient-visibility

Conversation

@p0mvn
Copy link
Copy Markdown

@p0mvn p0mvn commented Mar 27, 2026

Summary

  • Bug: YClient methods were pub, allowing external callers to generate queries without first calling generate_secret_keys(). Not regenerating keys for each query could expose an attack that is closed by this PR.
  • Fix: Tighten visibility so the only public query API is YPIRClient, which handles key generation internally via generate_secret_keys_from_seed(). All YClient methods are now either fn (private) or pub(crate) (the minimum two that server.rs needs due to Rust lifetime constraints on PolyMatrixRaw<'a>).
  • Refactor: scheme.rs benchmarks now use YPIRClient's seed-based API (generate_query_normal / generate_query_simplepir + decode_response_normal / decode_response_simplepir_raw) instead of directly constructing YClient.
  • Moved: test_linear_accumulation_noise relocated from noise_analysis.rs to client.rs test module where it has private access to YClient.

Changes

src/client.rs

  • YClient::newpubpub(crate) (server.rs needs it)
  • YClient::generate_query_implpubpub(crate) (server.rs needs it)
  • YClient::from_seed, lwe_client, client, generate_query, generate_query_lwe_low_mem, generate_full_query, generate_full_query_simplepir, decode_responsepubfn (private)
  • decode_response_normal_yclient, decode_response_simplepir_yclientpubfn (private, wrapped by public YPIRClient methods)
  • Added YPIRClient::decode_response_simplepir_raw() — returns Vec<u64> for internal benchmarks
  • Added test_linear_accumulation_noise to test module (moved from noise_analysis)

src/scheme.rs

  • run_simple_ypir_on_params: uses YPIRClient::generate_query_simplepir + decode_response_simplepir_raw instead of YClient directly
  • run_ypir_on_params: uses YPIRClient::generate_query_normal + decode_response_normal instead of YClient directly
  • Stores Seed in query tuples instead of YClient references
  • Removed unused spiral_rs::client::* import

src/noise_analysis.rs

  • Removed test_linear_accumulation_noise (moved to client.rs)
  • Cleaned up unused imports (YClient, decrypt_ct_reg_measured, constants::*, barrett_reduction_u128)

YClient methods were publicly exported, allowing callers to generate
queries without first calling generate_secret_keys(). This tightens
visibility so external consumers must use YPIRClient, which handles
key generation internally.

- Make most YClient methods private (fn); keep new() and
  generate_query_impl() as pub(crate) for server.rs
- Refactor scheme.rs to use YPIRClient seed-based API instead of
  constructing YClient directly
- Add decode_response_simplepir_raw() returning Vec<u64> for
  internal benchmarks
- Move noise test into client.rs where it has private access
- Make decode_response_*_yclient helpers private

Made-with: Cursor
@p0mvn p0mvn closed this Mar 27, 2026
@p0mvn p0mvn reopened this Mar 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant