Add guidance for choosing the field size

[cjpatton]

Closes #311.

For Prio3, when joint randomness is used:

• RECOMMEND Field128
• Field64 MAY be used, but PROOFS MUST be 3

The latter is motivated by issue #177. The recommendation is based on the upper bound given by {{DPRS23}}, Theorem 1 and a matching attack described by @bwesterb (see issue #311).

[divergentdave]

Looks good. I think we should also add | PROOFS | 1 | to tables 9, 10, 11, and 12, right after Field, to be clear about the parameter values for the four concrete Prio3 VDAFs (and algorithm IDs) we define.

[wangshan]

Approved assuming "Connecting soundness and robustness" is addressed either in this PR or a future one.

[cjpatton]

Approved assuming "Connecting soundness and robustness" is addressed either in this PR or a future one.

Right, thanks for the reminder! I'll ping you for a quick review if you don't mind.

[cjpatton]

@divergentdave Looks good. I think we should also add | PROOFS | 1 | to tables 9, 10, 11, and 12, right after Field, to be clear about the parameter values for the four concrete Prio3 VDAFs (and algorithm IDs) we define.

These tables specify parameters of the circuit; the number of proofs is not a parameter of the circuit. In fact, the gudance here is about modifying one of the circuits, say SumVec by changing the field from Field64 to Field128.

What do you think about decoupling Field from the circuit and moving it to the Prio3 variant. There, PROOFS is (or should, at least) be specified.

[divergentdave]

Good point, I think that sounds better

[cjpatton]

I'll lift to an issue and handle it after this PR.