From consensus to atomic broadcast Time-free byzantine-resistant protocols without signatur.pdf

From Consensus to Atomic Broadcast: Time-Free Byzantine-Resistant Protocols without Signatures Miguel Correia, Nuno Ferreira Neves, Paulo Ver??ssimo DI–FCUL TR–04–5 June 2004 Departamento de Informa?tica Faculdade de Cie?ncias da Universidade de Lisboa Campo Grande, 1749–016 Lisboa Portugal Technical reports are available at http://www.di.fc.ul.pt/tech-reports. The files are stored in PDF, with the report number as filename. Alternatively, reports are available by post from the above address. From Consensus to Atomic Broadcast: Time-Free Byzantine-Resistant Protocols without Signatures ? Miguel Correia Nuno Ferreira Neves Paulo Ver??ssimo Faculdade de Cie?ncias da Universidade de Lisboa Bloco C6, Piso 3, Campo Grande, 1749-016 Lisboa - Portugal {mpc,nuno,pjv}@di.fc.ul.pt Keywords: consensus, atomic broadcast, asynchronous systems, Byzantine faults, intrusion tolerance, randomization Abstract This paper proposes a hierarchy of three Byzantine-resistant protocols aimed to be used in practical distributed systems: multi-valued consensus, vector consensus and atomic broadcast. These protocols are designed as successive transformations from one to another. The first protocol, multi-valued consensus, is implemented on top of a randomized binary consensus. The protocols share a set of important structural properties. Firstly, they do not use signatures obtained with public-key cryptography, a well-known per- formance bottleneck in this kind of protocols. Secondly, they are time-free, i.e., they make no synchrony assumptions, since these assumptions are often vulnerable to subtle but effective attacks. Thirdly, they have no leaders, thus avoiding the cost of detecting corrupt processes. Fourthly, they have optimal resilience, i.e., they tolerate f = bn?13 c out of a total of n processes. The multi-valued consensus protocol terminates in a constant expected number of rounds, while the vector consensus and atomic broadcast protocols have time complexities O(f). 1 Introduction