Reliable Broadcast. We now describe the reliable broadcast service, which is a straightforward extension of the broadcast protocol proposed by Xxxxxx [6]. A process begins by broadcasting its message to everyone. Every process that receives the message directly, echoes it, along with a signature. Every process that receives 𝑛−𝑡0 distinct ECHO messages, sends a READY message. And if a process receives 𝑡0 + 1 distinct READY messages, it also sends a READY message. Finally, if a process receives 𝑛 − 𝑡0 distinct READY messages, then it delivers it. The key difference from [6] is that, as in the binary value consensus protocol, we construct ledgers to justify the mes- sages we send. Specifically, when a process sends a READY message, if it has received 𝑛 − 𝑡0 distinct ECHO messages, each of which is signed, it packages them into a ledger, and forwards that with its READY message. Alternatively, if a process sends a READY message because it received 𝑡0 + 1 distinct READY messages, then it simply copies an existing (valid) ledger. Either way, if a process 𝑝𝑖 sends a READY mes- sage for value 𝑣 which was sent by process 𝑝 𝑗 , then it has stored a ledger containing 𝑛 − 𝑡0 signed ECHO messages for 𝑣, and it has sent that ledger to everyone. As before, two ledgers conflict if they justify two different values 𝑣 and 𝑣 ′, both supposedly sent by the same process 𝑝 𝑗 . In that case, one ledger contains 𝑛 −𝑡0 signed ECHO message for 𝑣 and the other contains 𝑛 − 𝑡0 signed ECHO message for 𝑣 ′. Since any two sets of size 𝑛 − 𝑡0 have an intersection of size 𝑡0 + 1, this immediately identifies at least 𝑡0 + 1 processes that illegally sent ECHO messages for both 𝑣 and 𝑣 ′. These process can by irrefutably proved to be Byzantine. We now prove that the reliable broadcast protocol satisfies the desired properties. First, we show that it delivers only one value from each process, and that if 𝑡 ≤ 𝑡0, then it only delivers a value if it was previously RB-broadcast by that process: Lemma C.3 (RB-Unicity). At most one value (𝑣, 𝑗 ) is deliv- ered from process 𝑝 𝑗 .
Reliable Broadcast. We recall the definition of Reliable Broadcast. We make explicit the concrete running time and simultaneous termination properties, since they will be required when the network is synchronous.
Reliable Broadcast. Reliable broadcast allows a sender to consistently distribute a message to a set of parties. In contrast to full-fledged broadcast, reliable broadcast does not require termination. Definition 4 (Reliable broadcast) Let Π be a protocol executed by parties P1, . . . , Pn, where a designated sender P∗ initially holds input v∗, and parties terminate upon generating output. Π is an f -secure reliable broadcast protocol if the following hold if at most f parties are corrupted: • Validity: if P∗ is honest at the start of the protocol, then every honest party outputs v∗. • Consistency: either no honest party terminates, or all honest parties output the same value. It is easy to obtain reliable broadcast ΠRBC from reliable consensus: the sender simply signs its message and sends it to all parties, who then run reliable consensus on what they received. The communication complexity is O(κn), the same as for reliable consensus. We formally describe a reliable broadcast protocol ΠRBC in Figure 2. Protocol ΠRBC The sender is P∗ with secret key sk∗.
Reliable Broadcast. Reliable broadcast allows a sender to consistently distribute a message to a set of parties. In contrast to full-fledged broadcast (and by analogy to reliable consensus), reliable broadcast does not require termination. Definition 4 (Reliable broadcast) Let Π be a protocol executed by parties P1, . . . , Pn, where a designated sender P∗ initially holds input v∗, and parties terminate upon generating output. Π is an f -secure reliable broadcast protocol if the following hold when at most f parties are corrupted: • Validity: if P∗ is honest at the start of the protocol, then every honest party out- puts v∗. • Consistency: either no honest party terminates, or all honest parties output the same value. It is easy to obtain a reliable broadcast protocol ΠRBC (cf. Figure 2) from reliable consensus: the sender P∗ simply signs its message and sends it to all parties, who then run reliable consensus on what they received. In addition to the setup for the underlying reliable consensus protocol, ΠRBC assumes P∗ has a public/private key pair (pk∗, sk∗) with pk∗ known to all other parties. Theorem 5 Let 0 < s < 1/3 and f ≤ (1 − 2s) · n/3. Then ΠRBC is an f-secure reliable broadcast protocol with expected setup size O(κ ) and expected communication complexity O((κ + I) · κn), where I is the size of the sender’s input. Protocol ΠRBC
Reliable Broadcast. The goal of Reliable-Broadcast is to simulate a broadcast channel using the underlying point-to-point message passing system. In Byzantine Agreement protocols, each process initiates a series of Reliable-Broadcasts. Call mp,ℓ the ℓth message broadcast by process p.
Reliable Broadcast. Our Reliable Broadcast protocol is based on the protocol by Momose and Ren in [19], adapted to the hybrid network setting. In a nutshell, the idea is that at each step of the protocol, the parties wait for at least Δ time. When the network is synchronous, this ensures that 1) for an honest sender, all parties simultaneously obtain output after a fixed number 2 Composing protocols with probabilistic termination is known to pose several challenges. See [6, 7, 17] for a nice discussion. Xxxxx Xxxxxx, Xxxx-Xx Xxx-Xxxxx, and Xxxxx XxXxxxxxxx of rounds, and 2) for a corrupted sender, the parties output at times that differ in at most Δ time. Moreover, when the network is asynchronous, security is retained. Initially, each party marks the time when it starts executing the protocol in 𝜏start. At the same time, the sender sends its signed value to all the parties. If the network is synchronous, any message is delivered within Δ time. Hence, the honest parties wait until time 𝜏start + Δ to ensure that, if the sender is honest, every honest party has received the sender’s message before taking any further step. Then, at time 𝜏start + Δ, the honest parties forward this signed value to all the parties. Hence, by time 𝜏start + 2 · Δ, any inconsistent messages sent by a dishonest sender in the first step are observed. Detecting such consistencies is the key in tolerating a higher number of corruptions. Then, if the sender is honest, each honest party sends a signed vote message at time 𝜏start + 2 · Δ, meaning that each honest party should always expect 𝑛 − 𝑡𝑠 vote messages by time at least 𝜏start + 3 · Δ in order to make a decision and output a value. On the other hand, if the sender is corrupted, a party 𝑃 that receives 𝑛 − 𝑡𝑠 vote messages cannot be certain that every honest party has received enough vote messages as well, hence 𝑃 forwards the signed votes to all the honest parties. If this is the case, the signed votes are received after at most Δ time by every honest party. A party can safely terminate as soon as it receives and forwards the 𝑛 − 𝑡𝑠 signed votes, hence, if the sender is honest, at time 𝜏start + 3 · Δ. Note that, if the sender is corrupted, the honest parties may output much later than time 𝜏start + 3 · Δ. In this case, the only guarantee is that once the first honest party outputs, every honest party outputs the same value within Δ time. If the network is asynchronous, once an honest party outputs a value, every honest party is guar...
Reliable Broadcast. Reliable broadcast allows a sender to consistently distribute a message to a set of parties. In contrast to full-fledged broadcast (and by analogy to reliable consensus), reliable broadcast does not require termination.
