Notation

• Let                               be processes  and lets assume that every        can communicate with every        via messages

• Every       has a message       , called           's initial message and they have to agree on a common value for the message.

Notation

• To this end, each         executes a program         called the Agreement Protocol.

• As long as a        computes according to        it is called proper. Once a process        deviates from         it is faulty.

Def 1: Agreement

The processes in a set                           are said to  reach an agreement about the value of the message if each       ,             does stop, and at the end of the execution of their protocols, message(i) = message(j)

Def 2: Byzantine Agreement

We say that the proper processes have reached Byzantine Agreement if:

1. All the proper processes reach agreement.
2. If all proper         have same initial message                      then the proper processes agree on M as the value of the message.

Def 3: Byzantine Agreement Protocol (BAP)

Let n and t < n be integers. A set of protocols       for the processes                         , is a solution for the Byzantine Generals problem for (n, t) if the following holds:

Let S be a system of processes       computing according to      and assume that no more than t processes become faulty. Then, whenever the processes have initial messages, the proper       will reach Byzantine Agreement.

Def 4: Phase

A phase in the computation of a proper      , is the time interval between     's request for information from k other processes, and receipt of at least k-t replies. The computation time required by      , once the information is received, is also included in the phase.

We assume that each process       has a local phase-clock

      , and that       assigns                              at the end of each phase.

Authentication

One implementation is to have a public directory holding for each participant B  a public key        . When the participant needs to authenticate a message M, he employs a secret key       to compute another message                       .

Authentication

Every user can recover M from N by using

To avoid fraudulent message passing, every process      incorporates its current reading        . Therefore sending a message:

Authentication

The public key directory is part of the data in each      and must be incorporated by a non-faulty "dealer" at the creation of the processes

How to share a secret?

Eleven scientists are working on a secret project. They wish to lock up the documents in a cabinet so that the cabinet can be opened only if more than half (at least six) of the scientists are present. What is the smallest number of locks needed? What is the smallest number of keys to the locks each scientist must carry?

How to share a secret?

It is not hard to see....

456 locks

252 keys per scientist

How to share a secret?

More general problem:

The secret is some data D, our goal is to divide D into pieces                       in such a way that:

1. knowledge of any k or more      pieces makes D easily computable.
2. knowledge of any k-1 or fewer      pieces leaves  D completely undetermined.

How to share a secret?

Idea:

Pick a random polynomial q(x) of degree k-1. in which

Evaluate

Back to lottery

We are going to suppose a dealer that is a non-faulty process D which prepares in advance the programs for the individual      's. The dealer D takes k = t+1 to be the bound on the number of faulty processes.

It randomly and independently generates a sequence

                 where each                or

Back to lottery

Then the dealer computes

And sends to every process        the  sequence:

Back to lottery

When playing lottery(m),       requests from 2t other processes their

Procedure BAP; {for     }

begin
message(i) :=Mi; {Gi's initial message}
For k = I to k = R
 do {k local to Pi}
begin
Polling; {k is a parameter of Polling}
Lottery; {k is a parameter of Lottery}
Decision
end {For}
end; {BAP}

Procedure Polling

begin
  send sigma_i(message(i),k) to all; 
  request the k-th version of message(j) from all;
  collect incoming sigma_j(message(j),k), until n - t values received;
  temp (i)  := that M which occurred most often among the received 
               (message(j) ,k);
  count (i) := |{j : (message (j) ,k) = (temp(i) ,k) }|
end;

Procedure Lottery

begin
ask for E_j_k from all;
send E_i_k to all;
wait until t different values of E_j_k have arrived;
compute s_k from E_i_k and the available E_j_k;
end;

Procedure Decision

begin
  s:=s_k; {s_k is the current secret for G_i}
  if (s = 0 and n/2 <= count(i)) or (s = 1 and n-2t <= count(i)) then
     message(i):=temp(i)
  else
     message(i):="system faulty"
end;

Correctness

Let             . All the proper processes will end their execution of BAP. If the system is proper and the initial message of every proper process is M, then at the end of BAP we shall have message(i) = M for all proper      .

If the system is faulty then at the end of BAP, with probability at least             all proper processes       will have the same value for message(i).

Correctness

Key observation, if the proper processes enter the k-th iteration of the For statement of BAP in a state where all have the same value V, then they will end that iteration with the value message(i)=V.

Correctness

Key observation, if the proper processes enter the k-th iteration of the For statement of BAP in a state where all have the same value V, then they will end that iteration with the value message(i)=V.

begin
  send sigma_i(message(i),k) to all; 
  request the k-th version of message(j) from all;
  collect incoming sigma_j(message(j),k), until n - t values received;
  temp (i)  := that M which occurred most often among the received 
               (message(j) ,k);
  count (i) := |{j : (message (j) ,k) = (temp(i) ,k) }|
end;

Correctness

In particular, if the system is proper and its initial message is M for all proper processes, then all proper         will have message(i)=M at the end of BAP.

Correctness

Consider the first proper process        to have finished its k-th iteration of Polling. Let (w.l.o.g)

Be the set of proper processes of whom       received a response

And let         be any proper process.

Correctness

Suppose now that not all  proper processes in H have the same initial message.

Suppose there exists a V such that for at least n-4t proper processes                   message(j) = V.

CASE 1:

Correctness

Hence at the end of it's polling phase,        would have received at least n - 5t messages from               of the form message(j) = V.

Therefore:

temp(m) = V and

Correctness

With probability        we have that             independently of the condition on H.

Therefore:

With probability       we have that message(m) = V

Since       is an arbitrary proper process, this is true for every proper process. Hence we reach an agreement.

Correctness

Suppose

CASE 2

There are at least n-3t responses that        receives from H. Therefore at most 2t responses from outside.

Correctness

CASE 2

Even if all these responses are of the form               , we have that:

If now              then at the end of the k-th invocation message(m)="system faulty"

Correctness

CASE 2

In both cases the probability of not reaching and agreement is of        hence after R independent lotteries, the probability of not reaching an agreement is         . Hence the probability of reaching an agreement after R lotteries is

Procedure Decisionproof

Key observation:

If some process        finds that                                    then necessarily every other proper        will have

                                       . Hence message(j) = temp(j) at the end of Decision.

Procedure Decisionproof

begin
s:= s_k_i; 
if(s = 0 and n/2 <= count(i)) or (s = 1 and n-2t <= count(i)) then
message(i):= temp(i)
else
message(i):="system faulty";
if(s = 0 and n-2t <= count(i)) then 
send sigma_i ("agreement reached on V") to all Gj;
k(i) := k(i) + 1  {update the index of the secret to be shared}
end; 

Procedure ETBAP

begin
inround(i) := true;
k(i):=1;
message(i) := Mi {the initial message for Gi}
repeat
  begin
    Polling;
    Lottery;
    Decisionproof {increase k(i) by 1 each time}
  end
end;{ETBAP}

Procedure Closefinish

begin
  repeat
    If received new sigma_j("agreement reached on V") {Gi's own
    comunication of this form is included. V may differ for faulty
    Gi}
    then send sigma_j("agreement reached V")
        to all
   until t + 1 communications with the same V are counted;
   message(i):=V;
   inround(i):=false;
end;{Closefinish}

Lemma

Within an expected number of four rounds of iterations of the loop ETBAP, every proper       will send

    ("agreement reached on V") for some V

Conclusion

• This algorithm covers fully the asynchronous case of BGP.

• The solution as written here requires a total of             messages. This can be readily reduced to

• Under appropriate assumptions the solution is resilient. Transient failures of processes in agreement round do not affect subsequent rounds.