Randomized Algorithms for Reliable Broadcast

1. Randomized Algorithmsfor Reliable Broadcast Vinod Vaikuntanathan (IBM T.J. Watson) Michael Ben-Or Shafi Goldwasser Elan Pavlov

2. P1 P3 S P2 P4 Reliable Broadcast Channel The Internet m P1 • Physical Device Sender P2 S • Guarantee: “All players receive the same message” P3 P4  Useful: Multiparty protocols [BL’85, GMW’87, BGW’88, RB’89, GGL’91, RZ’98, F’99, GVZ’01]  Unavailable: x Point-to-point Networks S y

3. S Q P Reliable Broadcast Channel m P1 • Physical Device Sender P2 S • Guarantee: “All players receive the same message” P3 P4  Useful: Multiparty protocols [BL’85, GMW’87, BGW’88, RB’89, GGL’91, RZ’98, F’99, GVZ’01] m  Unavailable: Point-to-point Networks M m ?? m Wireless/Radio Networks

4. P1 P3 S P2 P4 Reliable Broadcast Problem [PSL’80] m P1 Sender P2 S P3 “Simulate a reliable broadcast channel over traditional networks” P4 ≡ IN THIS WORK: Point-to-point network

5. P1 P3 S P2 P4 Reliable Broadcast Problem [PSL’80] m P1 Sender P2 Validity (completeness): S If S is honest, all players receive m. P3 Agreement (soundness): P4 All players receive the same message (even if S is dishonest) ≡ Reliable Broadcast = Byzantine Agreement

6. The Model S P3 P3 The Network • Completely connected • Reliable and authenticated links P2 P4 • Synchronous (“rounds”) The Adversary • Corrupts t players (t = constant fraction of n) • Computationally unbounded • Full-information

7. Previous Work DETERMINISTIC: [PSL’80, DFFLS’82, DRS’86, BDDS’87, BGP’89, CW’90, BG’91, GM’93] Best Known: t+1 rounds [PSL’80, GM’93] Best Possible: t+1 rounds [FL’82] RANDOMIZED (probabilistic termination): [B’83, R’83, CC’85, DSS’86] Best Known: ExpectedO(t/log n) rounds [CC’85] + Private Channels: O(1) rounds [FM’88]

8. Why Private Channels? P1 P3 • Perfectly private physical devices • Leaks Nothing • the message sent P2 P4 • Implemented using “strong encryption” “Is privacy necessary for reliability”? [FM’88]

9. Our Results Theorem:There exists a reliable broadcast protocol in the full-information model: • tolerates t < (1/3-ε)n faults (for any ε>0). • runs in O(log n/ε2) rounds, in expectation. Remarks: • Near-best fault-tolerance Optimal: t < n/3 [PSL’80, KY’86] • Near-best communication complexity n2·logO(1)(n) Best known: O(n2) [KKKSS’08]

10. Classical Approach [B’83,R’83] Lemma [B’83, R’83]: Reduction from reliable broadcast protocol to leader election • δ-leader election • Reliable broadcast • r rounds • expected O(r/δ) rounds • fault-tolerance t • fault-tolerance t δ-Leader Election: Collectively elect a player P such that Pr[P is honest] ≥ δ

11. Our Approach Lemma: Reduction from reliable broadcast protocol to committee election • (c,δ)-committee election • Reliable broadcast • r rounds • expected O((r+c)/δ) rounds • fault-tolerance t • fault-tolerance t (c,δ)-Committee Election: Collectively elect a set of players S such that • S has at most c players • Pr[S has at least one honest player] ≥δ

12. RZ Committee-Election Lemma [Russell and Zuckerman’01]: Committee-election protocol among n players with (1-ε)n faults • elects a committee of size O(log n/ε2) • runs in 1 round! (assuming built-in reliable broadcast channels!) Our Work: Committee-election protocol without built-in reliable broadcast!

13. RZ Committee-Election IDEA: “Election by Elimination” NOT BUT

14. RZ Committee-Election Step 1: Fix a collection of prospective committees such that: (a) m = poly(n) committees (b) each committee is “small” (c) number of bad committees is “very very small” C1 C2 C3 C3 C4 C4 Cm P1 P1 P6 P6 P9 P4 P4 P5 P5 P7 P7 P6 P6 P10 … P2 P3 P3 P5 P5 P2 P10 P8 P9 P8 P7 P7

15. RZ Committee-Election Step 1: Fix a collection of prospective committees such that: Lemma: There is a collection of committees s.t. (a)m = n2+1 committees (b) each committee has O(log n) players (c) number of bad committees is at most 3n Proof: Probabilistic method (existential), or Extractors (explicit) [TZS’01] C1 C2 C3 C4 Cm P1 P1 P6 P9 P4 P4 P5 P7 P6 P10 … P2 P3 P3 P5 P2 P10 P8 P9 P8 P7

16. C1 C3 C4 Cm P1 P6 P9 P4 P4 P7 P6 P10 … P2 P3 P5 P2 P10 P9 P8 P7 RZ Committee-Election Step 1: Fix a collection of prospective committees Step 2: Vote out n committees “at random” Broadcast the identity of these committees Step 3: Output (any) committee that is not voted out. P1 P2 Pn … n C2 P1 P5 P3 P8

17. RZ Committee-Election Step 1: Fix a collection of prospective committees Step 2: Vote out n committees “at random” Broadcastthe identity of these committees Step 3: Output (any) committee that is not voted out. Lemma [RZ’01]: With probability 1-1/n (over the coin-tosses of the honest players), (a) Each bad committee is voted out by a good player “Intuition:” The number of bad committees is “very very small” (b) At least one committee is not voted out Proof: Total number of committees voted out ≤ n·n < n2+1 = m

18. C1 C1 C3 C2 C3 P1 P1 P4 P4 P6 P1 P6 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P9 P8 P9 RZ with no broadcast? BAD NEWS: No Agreement! GOOD NEWS: Both P and Q eliminate all bad committees. Pf: (Each bad committee voted out by a good player) Honest Player P’s View Honest Player Q’s View P1 P1 C2 P1 P5 P3 P8

19. Honest Player P’s View Honest Player Q’s View P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 Our Solution AN OLD IDEA “Limit cheating” Use graded broadcast [FM’88] TWO NEW IDEAS “Detect disagreement” “Self-destruct”

20. S Q P Graded Broadcast [FM’88] Motivating Example: Radio Networks m m ?? m Limit Cheating: P and Q do not get different messages

21. S Q P Graded Broadcast [FM’88] Motivating Example: Radio Networks m ?? m Graded Broadcast: Each player P gets a pair (m, grade) “P accepts m, and knows that everyone else has seen m” grade=2: “P sees m, and knows that noone else sees m’ ≠ m” grade=1: “P sees nothing” grade=0:

22. S Q P Graded Broadcast [FM’88] Motivating Example: Radio Networks m ?? m Graded Broadcast: Each player P gets a pair (m, grade) • Completeness: If S is honest, everyone gets (m,2) • Soundness: (a) If an honest player P gets (m,2), everyone gets (m,≥1) (b) If P gets (m,≥1) and Q gets (m’,≥1), m=m’

23. S Q P Graded Broadcast [FM’88] Motivating Example: Radio Networks m ?? m Lemma [FM’88]: Deterministic graded broadcast among n players • tolerating t < n/3 faults. • runs in 3 rounds

24. Honest Player P Honest Player Q P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 Our Committee-Election Protocol Step 1: Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcastthe identity of these committees Step 3: Each committee runs disagreement detection grade ≥ 1 grade=2

25. Honest Player P Honest Player Q P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 Our Committee-Election Protocol C1-Disagreement Detection and Self-Destruct: Step 1: Fix a collection of prospective committees Participants: All players in C1 Step 2: Vote out n committees “at random” Goal: Decide if the honest players disagree about C1 Graded-broadcastthe identity of these committees

26. Honest Player P Honest Player Q P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 Our Committee-Election Protocol C1-Disagreement Detection and Self-Destruct: (1) Local detection: If a player in C1 sees C1 voted out with grade ≥ 1, set C1-self-destruct = true Step 1: Fix a collection of prospective committees Step 2: Vote out n committees “at random” (2) Consensus in C1: Agree on the majority decision about C1-self-destruct Graded-broadcastthe identity of these committees • Each player reliable-broadcasts C1-self-destruct to all • players in C1 (3) Self-destruct: If majority decide to self-destruct, send “C1-self-destruct” msg to all players in the network • Each player computes majority of received values.

27. Honest Player P Honest Player Q P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 Our Committee-Election Protocol Step 1: Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcastthe identity of these committees Step 3: Each committee runs disagreement detection Step 4: Eliminate C if(a) C is voted out with grade = 2 OR (b) C self-destructs

28. Honest Player P Honest Player Q P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 Our Committee-Election Protocol Step 1: Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcastthe identity of these committees Step 3: Each committee runs disagreement detection Step 4: Eliminate C if(a) C is voted out with grade ≥ 2 OR (b) C self-destructs

29. Honest Player P Honest Player Q P1 P1 C1 C1 C2 C3 C2 C3 P1 P1 P4 P4 P1 P6 P1 P6 P5 P7 P5 P7 P2 P2 P10 P10 P3 P3 P3 P3 P8 P9 P8 P9 The RZ Protocol Agreement (“win-win” argument) Step 1: Fix a collection of prospective committees • Ci is bad: All players see Ci Step 2: Each player graded broadcasts n random committees • Ci is good: Say an honest player P sets Ci Step 3: • Because Ci self-destructed: All other honest players get the self-destruct notification Correct potential disagreement. Step 4: Eliminate Ci if Ci • Because P sees Ci after graded broadcast: All honest players in Ci decide to self-destruct Ci

30. Extensions and Open Questions TODAY: Fault-tolerance ≈ 1/3 (optimal) THESIS: With PKI and one-way functions, fault-tolerance ≈ 1/2 TODAY: Complete Network THESIS: Simulate complete network over an incomplete network (overhead ≈ diameter) OPEN: Asynchronous Networks [FLP’85] Best known: quasi-polynomial rounds [KKKSS’08]

31. Thank you!