The Contest between Simplicity and Efficiency in Asynchronous Byzantine Agreement

Allison Lewko

The University of Texas at Austin

Byzantine Agreement• n parties• each has an input bit• t corrupt parties

Goal: agree on a bit equal to input of some ``good” party

0 0 0 0 0

1

Byzantine Agreement• Simple problem, worst case adversary

HistoryImpossibility Constraints:

• >= 1/3 corrupted processors• deterministic algorithm, 1 crash failure [FLP]

Algorithms:

• termination with prob =1• adaptive adversary• exponential expected running time

[Ben-Or, Bracha]

[KKKSS]• termination/correctness with prob 1 – o(1)• non-adaptive adversary• polylogarithmic running time

Landscape of possible algorithms?

[Ben-Or, Bracha]

[KKKSS]

???

LLas Vegas polytime algorithm?

LAdaptive adversary polytime algorithm?

Our Result

𝐸𝑥𝑝𝑜𝑛𝑒𝑛𝑡𝑖𝑎𝑙 𝑇𝑖𝑚

𝑒[Ben-Or, Bracha]

Simple Algorithm Recipe

One Round:

bit b

broadcast b

validate set of responses = S

Compute b’ = N(S)b’

Repeat

Randomized function

Ben-Or, Bracha AlgorithmsS = Set of bits

• overwhelming majority

• strong majority

• mixed

Decide

Fix b’ to majority

Define b’ randomly

N = b

Why Exponential Time?

Decide 0 Fix 0 Random Decide 1Fix 1

S: mostly 0 . . . . . . . . mixed . . . . . . . . . mostly 1

N := number of processorsN := number of participantsT = eg= t

𝑛 :𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑝𝑟𝑜𝑐𝑒𝑠𝑠𝑜𝑟𝑠𝑡=Ω (𝑛) :𝑛𝑢𝑚𝑏𝑒𝑟 𝑜𝑓 𝑐𝑜𝑟𝑟𝑢𝑝𝑡𝑖𝑜𝑛𝑠

± O(

Exponential Loop!

Generalizing the Algorithm Recipe

t = gg= tx = yg= x

Round i:

bit b

broadcast b

validate set of responses = S

Compute b’ = N(S)

Randomized function

value v

broadcast v

i

S1 , S2 , …, Si

Compute v’ = N(S1, S2, … ,Si )

Randomized function with constant size range

Key Restrictions

• S1, . . . , Si are considered as sets

• N(S1 , . . . , Si) chooses randomly from a constant number of possible values

- messages divorced from senders

- values themselves can vary

How to Prove Exponential Time?Classic strategy:

Executiondeciding 0

Executiondeciding 1Indistinguishable

to some uncorruptedprocessor

Chain of executions, each execution of exponential length

Not deciding!

Challenge for Randomized Algorithms

Any single execution may be unlikely

Takes a class of executions to add up to constant probability

Execution ClassesDivide processors into groups

S

S

SClass defined by sets pergroup per round

Source of Adversary’s ControlSuppose Ω(n) processors receive the same sets:

S1, S2, . . . , Si S1, S2, . . . , Si S1, S2, . . . , Si

. . . N(S1 , . . . , Si) N(S1 , . . . , Si) N(S1 , . . . , Si). . .

Independent samples from same distribution

Chernoff Bound

D - a distribution on R valuesR - a constant

X 1; : : : ;X k - independent samples from D

\ k balls in R bins":

. . . p1 p2 p3 pR

bin i \ far" from pik with probabability exponentially small in k

Adversary Can Match Expectations

S1, S2, . . . , Si

Output = Expectation [N(S1, … , Si)]

Chain of Execution Classes• Each group kept in sync• Output sets match expectations

Execution classdeciding 0

Execution classdeciding 1

Execution class

Execution class…

Indistinguishableto some group One of these must

be non-deciding

Generating the Chain of Execution ClassesE rounds

…

0

0

0

1

1

1

Change group inputs onegroup at a time:

Adversary Strategy

• adversary divides processors into groups of t

• corrupts constant fraction per group

• all group members see same message sets

• tries to stay in the non-deciding execution class

Adversary’s Success ProbabilityS1, S2, … , Si Z1, Z2, … , Zi

V1, V2, …,Vi

Output = ExpectationWith Prob = 1 – 1/exp

Output = ExpectationWith Prob = 1 – 1/exp

Output = ExpectationWith Prob = 1 – 1/exp

By Union bound over groups and rounds, # of rounds = Exp with constant probability

Observations

• Adversary Strategy :

- Only leverages message schedulingand random coins of bad processors- No hope to detect bad behavior without risk

• Impossibility proof crucially leverages:

- Received messages treated as sets- Random Variables have bounded support

Open Problems

[KKKSS]

???

LLas Vegas polytime algorithm?

LAdaptive adversary polytime algorithm?

𝐸𝑥𝑝𝑜𝑛𝑒𝑛𝑡𝑖𝑎𝑙𝑇𝑖𝑚

𝑒

• Still simple structure, unbounded randomness?• Weaken symmetry in processing received messages?

[Ben-Or, Bracha]

Thank you!

Questions?