Intuition of the proof Sample Clauses

Intuition of the proof. For the proof we consider two executions 𝑒1 and 𝑒2, in which process 𝑖 decides 𝑠𝑖 at view 𝑣𝑖 while process 𝑗 decides 𝑠 𝑗 ≠ 𝑠𝑖 at view 𝑣 𝑗 >> 𝑣𝑖 . Process ∩ +𝑧 | | ≤ − [ + + − ] 𝑖’s decision implies preparation of 𝑠𝑖 by a quorum 𝑄𝑖 at view 𝑣𝑖 . In a later view numbered 𝑣𝑧 , a set 𝜙 of processes send a set 𝑁𝑉 ��𝑧 −1 of new-view messages to the leader ℓ𝑣 of this view. A set 𝐵 = 𝜙 𝑄𝑖 of at least 𝑡0 1 guilty processes did not propagate their preparation of 𝑠𝑖 and provoked the disagreement. The view 𝑣𝑧 is the first link of a chain of successive views 𝜒 = 𝑣𝑧, 𝑣𝑧 1, . . . , 𝑣𝑧 𝑘 1 where the leaders of views 𝜒 are in 𝑃 , 𝑃 𝑡0 1. At view ≥ + + 𝑣𝑧 𝑘, process 𝑗 prepares 𝑠 𝑗 and eventually decides 𝑠 𝑗 at view 𝑣 𝑗 𝑣𝑧 𝑘. When 𝑖 and 𝑗 detect the disagreement, they can neither distinguish 𝑒1 from 𝑒2 nor identify the senders 𝜙 of 𝑁𝑉 𝑣𝑧 −1. Process 𝑗 cannot wait without deciding because we can construct an execution 𝑒0 indistinguishable by 𝑗 from 𝑒1 with less than 𝑡0 Byzantine processes, where the leaders 𝑃 (and 𝑖) of the chain 𝜒 appear mute to 𝑗 and where 𝑗 must decide. Leaders of 𝑃 prepare 𝑠 𝑗 as 𝑗 ignores the decision 𝑠𝑖 . After the disagreement, 𝑃 does not reveal 𝑁𝑉 𝑣𝑧 −1 that is necessary to detect the guilty processes. This argument holds as long as 𝑘 < 𝑡0. The full proof is deferred to Appendix F. This result (Theorem 4.3) simply shows that piggybacking · 𝑡0-bounded justifications is insufficient to make PBFT-like algorithms accountable, however, it does not mean that they cannot be transformed into an accountable algorithm. First, one could probably make PBFT-like algorithms accountable with a longer justification, exchanging Ω(𝜅 𝑛2) more bits, where 𝜅 is the security parameter of the signature scheme. Second, transforming any of these algorithms into Polyp- graph (Section 5) is a way of obtaining accountability with a lower complexity than the previous extension. Such a trans- formation would however be non-trivial because Polygraph relies on DBFT that differs from PBFT-like algorithms in var- ious ways: every process participating in DBFT can propose a value, DBFT is signature-free and there is no view change in DBFT as there is no need to recover from a failed leader.

Intuition of the proof. For the proof we consider two executions 𝑒1 and 𝑒2, in which process 𝑖 decides 𝑠𝑖 at view 𝑣𝑖 while process 𝑗 decides 𝑠 𝑗 ≠ 𝑠𝑖 at view 𝑣 𝑗 >> 𝑣𝑖 . Process 𝑧 𝑖’s decision implies preparation of 𝑠𝑖 by a quorum 𝑄𝑖 at view 𝑣𝑖 . In a later view numbered 𝑣𝑧 , a set 𝜙 of processes send a set 𝑁𝑉 ��𝑧 −1 of new-view messages to the leader ℓ𝑣 of this view. A set 𝐵 = 𝜙 ∩ 𝑄𝑖 of at least 𝑡0 + 1 guilty Third, we define a practical extension of PBFT-like consen- sus algorithms that piggybacks messages. By ‘practical’ we processes did not propagate their preparation of provoked the disagreement. The view 𝑠𝑖 and mean that piggybacked messages have a bounded staleness to prevent the justification communication to be superlinear a chain of successive views where the leaders of views 𝑣𝑧 is the first link of | | ≤ − 𝜒 = [𝑣𝑧, 𝑣𝑧 + 1, . . . , 𝑣𝑧 + 𝑘 − 1] (e.g., quadratic) in 𝑛. Finally, we prove that there exist execu- tions leading to disagreement with different sets of Byzantine processes that correct processes cannot distinguish. L L

Intuition of the proof. For the proof we consider two executions 𝑒1 and 𝑒2, in which process 𝑖 decides 𝑠𝑖 at view 𝑣𝑖 while process 𝑗 decides 𝑠 𝑗 ≠ 𝑠𝑖 at view 𝑣 𝑗 >> 𝑣𝑖 . Process 𝑖’s decision implies preparation of 𝑠𝑖 by a quorum 𝑄𝑖 at view 𝑣𝑖 . In a later view numbered 𝑣𝑧, a set 𝜙 of processes send a set 𝑁𝑉 𝑣𝑧 −1 of new-view messages to the leader ℓ𝑣𝑧 of this view. A set 𝐵 = 𝜙 ∩ 𝑄𝑖 of at least 𝑡0 + 1 guilty processes did not propagate their preparation of 𝑠𝑖 and provoked the disagreement. The view 𝑣𝑧 is the first link of a chain of successive views 𝜒 = [𝑣𝑧, 𝑣𝑧 + 1, . . . , 𝑣𝑧 + 𝑘 − 1] where the leaders of views 𝜒 are in 𝑃 , |𝑃 | ≤ 𝑡0 − 1. At view 𝑣𝑧 + 𝑘, process 𝑗 prepares 𝑠 𝑗 and eventually decides 𝑠 𝑗 at view 𝑣 𝑗 ≥ 𝑣𝑧 + 𝑘. When 𝑖 and 𝑗 detect the disagreement, they can neither distinguish 𝑒1 from 𝑒2 nor identify the senders 𝜙 of 𝑁𝑉 𝑣𝑧 −1. Process 𝑗 cannot wait without deciding because we can construct an execution 𝑒0 indistinguishable by 𝑗 from 𝑒1 with less than 𝑡0 Byzantine processes, where the leaders 𝑃 (and 𝑖) of the chain 𝜒 appear mute to 𝑗 and Xxxxxx Xxxxx, Xxxx Xxxxxxx, and Xxxxxxx Xxxxxxx where 𝑗 must decide. Leaders of 𝑃 prepare 𝑠 𝑗 as 𝑗 ignores the decision 𝑠𝑖 . After the disagreement, 𝑃 does not reveal 𝑁𝑉 𝑣𝑧 −1 that is necessary to detect the guilty processes. This argument holds as long as 𝑘 < 𝑡0. The full proof is deferred to Appendix F. This result (Theorem 4.3) simply shows that piggybacking 𝑡0-bounded justifications is insufficient to make PBFT-like algorithms accountable, however, it does not mean that they cannot be transformed into an accountable algorithm. First, one could probably make PBFT-like algorithms accountable with a longer justification, exchanging Ω(𝜅 · 𝑛2) more bits, where 𝜅 is the security parameter of the signature scheme. Second, transforming any of these algorithms into Polyp- graph (Section 5) is a way of obtaining accountability with a lower complexity than the previous extension. Such a trans- formation would however be non-trivial because Polygraph relies on DBFT that differs from PBFT-like algorithms in var- ious ways: every process participating in DBFT can propose a value, DBFT is signature-free and there is no view change in DBFT as there is no need to recover from a failed leader.