SLIDE 1
Elaine Shi @ Cornell
Joint with T-H. Hubert Chan (HKU) & Rafael Pass (Cornell)
Sublinear-Round Byzantine Agreement under Corrupt Majority Elaine - - PowerPoint PPT Presentation
Sublinear-Round Byzantine Agreement under Corrupt Majority Elaine - - PowerPoint PPT Presentation
Sublinear-Round Byzantine Agreement under Corrupt Majority Elaine Shi @ Cornell Joint with T-H. Hubert Chan (HKU) & Rafael Pass (Cornell) PKC2021 Virtual or Physical? Chair makes a suggestion Virtual Everyone discusses
SLIDE 2
SLIDE 3
“Virtual”
Chair makes a suggestion
SLIDE 4
Everyone discusses
SLIDE 5
Everyone decides
Virtual Virtual Virtual Virtual Virtual Virtual
SLIDE 6
Some are unhappy
(e.g., had papers rejected from pkc)
SLIDE 7
Consis
happy players agree on decision
Validity:
if chair happy, agree on chair’s suggestion
Consistency Validity
SLIDE 8
Consisten
happy players agree on decision
Validity:
if chair happy, agree on chair’s suggestion
Consistency Validity
Byzantine Broadcast
[Lamport’82]
SLIDE 9
Byzantine Broadcast
f+1 rounds
[DS’83]
Corrupt majority
f: number of corrupt players
SLIDE 10
Byzantine Broadcast
f+1 rounds
[DS’83]
Corrupt majority
≥ f+1 rounds
[DS’83]
Deterministic lower bound
SLIDE 11
Byzantine Broadcast
Expected O(1) rounds
[FM’97]
Honest majority
f+1 rounds
[DS’83]
Corrupt majority
≥ f+1 rounds
[DS’83]
Deterministic lower bound
SLIDE 12
Can we achieve sublinear rounds under corrupt majority (with randomization) ?
Expected O(1) rounds
[FM’97]
Honest majority
f+1 rounds
[DS’83]
Corrupt majority
≥ f+1 rounds
[DS’83]
Deterministic lower bound
SLIDE 13
Can we achieve sublinear rounds under corrupt majority (with randomization) ?
Expected O(1) rounds
[FM’97]
Honest majority
f+1 rounds
[DS’83]
Corrupt majority
≥ f+1 rounds
[DS’83]
Deterministic lower bound
Expected Θ(2f-n) rounds
[GKKO’07, FN’09]
Corrupt majority
SLIDE 14
Can we achieve sublinear rounds under corrupt majority (with randomization) ?
SLIDE 15
Can we achieve sublinear rounds under corrupt majority (with randomization) ?
Hard even for static corruption Folklore committee election fails
SLIDE 16
Folklore committee election
SLIDE 17
Majority vote Folklore committee election
SLIDE 18
Corrupt majority: majority voting fails
SLIDE 19
Can we achieve sublinear rounds under corrupt majority (with randomization) ?
Hard even for static corruption Nothing known for 51% corrupt
SLIDE 20
Assume trusted setup and standard hardness assumptions, there exists poly-log round BB even in the presence of 99.9% weakly adaptive corruptions.
Our Result
See paper for a more generalized statement.
SLIDE 21
Challenge 1
Convey decision to those outside the committee Adaptive corruption of the committee
Challenge 2
SLIDE 22
Dolev-Strong among the committee Non-committee-members participate as non-voters
SLIDE 23
b r : bit b with r sigs from distinct s including
committee size: C = polylog(λ)
SLIDE 24
b r : bit b with r sigs from distinct s including
committee size: C = polylog(λ)
Round 0: multicasts b 1
SLIDE 25
b r : bit b with r sigs from distinct s including
committee size: C = polylog(λ)
Round 0: multicasts Round r = 1.. C+1: Round 0 (everyone): if player i sees a bit b with r-batch of sigs if b not in Ei : add b to Ei forward b and the r-batch of sigs Committee: if committee member j sees if b not in Ej : add b to Ej, multicasts Finally: player j outputs elem in Ej if its size is 1, else output 0
b 1 b r b (r + 1)
Round r = 1.. C:
SLIDE 26
b r : bit b with r sigs from distinct s including
committee size: C = polylog(λ)
Round 0: multicasts Round r = 1.. C+1: Round 0 (everyone): if player i sees a bit b with r-batch of sigs if b not in Ei : add b to Ei forward b and the r-batch of sigs Committee: if committee member j sees if b not in Ej : add b to Ej, multicasts Finally: player j outputs elem in Ej if its size is 1, else output 0
b 1 b r b (r + 1)
add its own sig
Round r = 1.. C:
SLIDE 27
b r : bit b with r sigs from distinct s including
committee size: C = polylog(λ)
Round 0: multicasts Round r = 1.. C+1: Round 0 (everyone): if player i sees a bit b with r-batch of sigs if b not in Ei : add b to Ei forward b and the r-batch of sigs Committee: if committee member j sees if b not in Ej : add b to Ej, multicasts Finally: player j outputs elem in Ej if its size is 1, else output 0
b 1 b r b (r + 1)
Round r = 1.. C:
SLIDE 28
Lemma 1: if in round r < C, honest player j has b in its Ej, then in round r+1, every honest player i has b in Ei Lemma 2: if in round C, honest player j has b in its Ej, then in round C, every honest player i has b in Ei
SLIDE 29
b r : bit b with r sigs from distinct s including
committee size: C = polylog(λ)
Phase 0: multicasts Phase r = 1.. C: Relay round (everyone): if player i sees if b not in Ei : add b to Ei , multicast Voting round (committee): if committee member j sees if b not in Ej : add b to Ej, multicasts Finally: player j outputs elem in Ej if its size is 1, else output 0
b 1 b r b (r + 1) b r b r
SLIDE 30
Challenge 1
Convey decision to those outside the committee
Challenge 2
Adaptive corruption of the committee
SLIDE 31
Challenge 2
Adaptive corruption of the committee
Secret committee election Reveal membership
- n voting
SLIDE 32
Player j is member of the b-committee iff
ρ, Π = VRF(skj, b) & ρ < D VRF.Vf(pkj, b, ρ) = 1 & ρ < D
Player j itself:
SLIDE 33
Player j is member of the b-committee iff
ρ, Π = VRF(skj, b) & ρ < D VRF.Vf(pkj, b, ρ, Π) = 1 & ρ < D
Player j itself: Everyone else:
SLIDE 34
ρ, Π = VRF(skj, b) & ρ < D VRF.Vf(pkj, b, ρ, Π) = 1 & ρ < D
Player j itself: Everyone else:
Membership in the two committees decided independently
SLIDE 35
b r : bit b w/ r votes from distinct s including
committee size: C = polylog(λ)
Phase 0: multicasts Phase r = 1.. polylog(λ): Relay round: if player i sees if b not in Ei : add b to Ei , multicast Voting round: if player j sees and is member of b-committee: if b not in Ej : add b to Ej, multicasts Finally: player j outputs elem in Ej if its size is 1, else output 0
b 1 b r b (r + 1) b r b r
SLIDE 36
Open Questions and Ongoing Work
Can we achieve expected constant rounds with corrupt majority?
https://eprint.iacr.org/2020/590