1. Randomized Algorithms for Reliable Broadcast (IBM T.J. Watson) Vinod Vaikuntanathan Michael Ben-OrShafi GoldwasserElan Pavlov

2. Reliable Broadcast Channel S  Useful: Multiparty protocols  Unavailable: P1P1 P2P2 P3P3 P4P4 Guarantee: “All players receive the same message” m Sender [BL’85, GMW’87, BGW’88, RB’89, GGL’91, RZ’98, F’99, GVZ’01] Physical Device P3P3 P1P1 P2P2 P4P4 S Point-to-point Networks The Internet S x y

3. Reliable Broadcast Channel S  Useful: Multiparty protocols  Unavailable: P1P1 P2P2 P3P3 P4P4 Guarantee: “All players receive the same message” m Sender [BL’85, GMW’87, BGW’88, RB’89, GGL’91, RZ’98, F’99, GVZ’01] Physical Device Point-to-point Networks Wireless/Radio Networks m m m S P Q ?? M

4. “Simulate a reliable broadcast channel over traditional networks” S P1P1 P2P2 P3P3 P4P4 m Sender P3P3 P1P1 P2P2 P4P4 S ≡ IN THIS WORK: Point-to-point network [PSL’80] Reliable Broadcast Problem

5. Validity (completeness): Agreement (soundness): If S is honest, all players receive m. All players receive the same message (even if S is dishonest) S P1P1 P2P2 P3P3 P4P4 m Sender P3P3 P1P1 P2P2 P4P4 S ≡ [PSL’80] Reliable Broadcast = Byzantine Agreement

6. The Model The Network Completely connected Reliable and authenticated links P3P3 S P2P2 P4P4 Synchronous (“rounds”) The Adversary Corrupts t players (t = constant fraction of n) Computationally unbounded Full-information P3P3

7. Previous Work DETERMINISTIC: Best Known: t+1 rounds Best Possible: t+1 rounds Best Known: Expected O(t/log n) rounds + Private Channels: O(1) rounds [PSL’80, DFFLS’82, DRS’86, BDDS’87, BGP’89, CW’90, BG’91, GM’93] [PSL’80, GM’93] [FL’82] RANDOMIZED (probabilistic termination): [CC’85] [B’83, R’83, CC’85, DSS’86] [FM’88]

8. Why Private Channels? “Is privacy necessary for reliability”? P3P3 P1P1 P2P2 P4P4 Leaks Nothing Perfectly private physical devices the message sent Implemented using “strong encryption” [FM’88]

9. Our Results Theorem: There exists a reliable broadcast protocol in the full-information model: Remarks: tolerates t 0). runs in O(log n/ε 2 ) rounds, in expectation. Near-best fault-tolerance [PSL’80, KY’86] Near-best communication complexity n 2 ·log O(1) (n) Optimal: t < n/3 [KKKSS’08] Best known: O(n 2 )

10. Classical Approach [B’83,R’83] δ-Leader Election: Collectively elect a player P such that Pr[P is honest] ≥ δ Lemma [B’83, R’83] : Reduction from reliable broadcast protocol to leader election δ-leader election r rounds fault-tolerance t Reliable broadcast expected O(r/δ) rounds fault-tolerance t

11. Our Approach (c,δ)-Committee Election: Collectively elect a set of players S such that Lemma: Reduction from reliable broadcast protocol to committee election (c,δ)-committee election r rounds fault-tolerance t Reliable broadcast expected O((r+c)/δ) rounds fault-tolerance t S has at most c players Pr[S has at least one honest player] ≥δ

12. Lemma [Russell and Zuckerman’01] : Committee- election protocol among n players with (1-ε)n faults Our Work: Committee-election protocol without built-in reliable broadcast! runs in 1 round! elects a committee of size O(log n/ε 2 ) RZ Committee-Election (assuming built-in reliable broadcast channels!)

13. RZ Committee-Election IDEA: “Election by Elimination” NOTBUT

14. P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P9P9 P5P5 P6P6 C4C4 P8P8 P4P4 P2P2 CmCm P7P7 … (a) m = poly(n) committees (b) each committee is “small” (c) number of bad committees is “very very small” P7P7 P6P6 P5P5 P5P5 P6P6 P7P7 C3C3 C4C4 RZ Committee-Election Step 1:Fix a collection of prospective committees such that:

15. (a) m = n 2 +1 committees (b) each committee has O(log n) players (c) number of bad committees is at most 3n Lemma: There is a collection of committees s.t. P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P9P9 P5P5 P6P6 C4C4 P8P8 P4P4 P2P2 CmCm P7P7 … Proof: Probabilistic method (existential), or Extractors (explicit) [TZS’01] Step 1:Fix a collection of prospective committees such that: RZ Committee-Election

16. Step 1: P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P9P9 P5P5 P6P6 C4C4 P8P8 P4P4 P2P2 CmCm P7P7 … Step 2: Vote out n committees “at random” Fix a collection of prospective committees P1P1 P2P2 PnPn … n Step 3: Output (any) committee that is not voted out. RZ Committee-Election Broadcast the identity of these committees

17. Step 1:Fix a collection of prospective committees (a) Each bad committee is voted out by a good player Lemma [RZ’01]: With probability 1-1/n (over the coin-tosses of the honest players), “Intuition:” The number of bad committees is “very very small”(b) At least one committee is not voted out Proof: Total number of committees voted out ≤ n·n < n 2 +1 = m RZ Committee-Election Step 2: Step 3: Output (any) committee that is not voted out. Vote out n committees “at random” Broadcast the identity of these committees

18. P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P’s View P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q’s View BAD NEWS:No Agreement! GOOD NEWS: Pf: (Each bad committee voted out by a good player) Both P and Q eliminate all bad committees. RZ with no broadcast?

19. P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P’s View AN OLD IDEA“Limit cheating” “Detect disagreement” “Self-destruct” [ FM’88 ] Our Solution TWO NEW IDEAS Use graded broadcast P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q’s View

20. Graded Broadcast Motivating Example: Radio Networks [FM’88] m m m S P Q ?? Limit Cheating: P and Q do not get different messages

21. Graded Broadcast Motivating Example: Radio Networks [FM’88] m m S P Q ?? Graded Broadcast: Each player P gets a pair (m, grade) grade=2: “P accepts m, and knows that everyone else has seen m” grade=1: “P sees m, and knows that noone else sees m’ ≠ m” grade=0: “P sees nothing”

22. Graded Broadcast Motivating Example: Radio Networks [FM’88] m m S P Q ?? Graded Broadcast: Each player P gets a pair (m, grade) Completeness: If S is honest, everyone gets (m,2) Soundness: (a) If an honest player P gets (m,2), everyone gets (m,≥1) (b) If P gets (m,≥1) and Q gets (m’,≥1), m=m’

23. Graded Broadcast Motivating Example: Radio Networks [FM’88] Lemma [FM’88] : Deterministic graded broadcast among n players tolerating t < n/3 faults. runs in 3 rounds m m S P Q ??

24. Our Committee-Election Protocol grade=2 grade ≥ 1 P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q Step 1:Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcast the identity of these committees Step 3:Each committee runs disagreement detection

25. P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P Our Committee-Election Protocol P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q Step 1:Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcast the identity of these committees C 1 -Disagreement Detection and Self-Destruct: Participants: All players in C 1 Goal: Decide if the honest players disagree about C 1

26. Our Committee-Election Protocol P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q Step 1:Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcast the identity of these committees (1) Local detection: If a player in C 1 sees C 1 voted out with grade ≥ 1, set C 1 -self-destruct = true C 1 -Disagreement Detection and Self-Destruct: (2) Consensus in C 1 : Agree on the majority decision about C 1 -self-destruct Each player reliable-broadcasts C 1 -self-destruct to all players in C 1 Each player computes majority of received values. (3) Self-destruct: If majority decide to self-destruct, send “C 1 -self-destruct” msg to all players in the network

27. Our Committee-Election Protocol P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q Step 1:Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcast the identity of these committees Step 3:Each committee runs disagreement detection Step 4:Eliminate C if (a) C is voted out with grade = 2 OR (b) C self-destructs

28. Our Committee-Election Protocol P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q Step 1:Fix a collection of prospective committees Step 2: Vote out n committees “at random” Graded-broadcast the identity of these committees Step 3:Each committee runs disagreement detection Step 4:Eliminate C if (a) C is voted out with grade ≥ 2 OR (b) C self-destructs

29. The RZ Protocol Step 1: Step 2: Each player graded broadcasts n random committees Fix a collection of prospective committees P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player P P1P1 P2P2 P4P4 C1C1 P 10 P1P1 P3P3 P5P5 C2C2 P8P8 P6P6 P3P3 P7P7 C3C3 P9P9 P1P1 Honest Player Q Step 3: Correct potential disagreement. Step 4: Eliminate C i if C i C i is bad: All players see C i Agreement (“win-win” argument) C i is good: Say an honest player P sets C i Because C i self-destructed: All other honest players get the self-destruct notification Because P sees C i after graded broadcast: All honest players in C i decide to self-destruct C i

30. Extensions and Open Questions Fault-tolerance ≈ 1/3 (optimal)TODAY: THESIS:With PKI and one-way functions, fault-tolerance ≈ 1/2 Complete NetworkTODAY: THESIS:Simulate complete network over an incomplete network (overhead ≈ diameter) OPEN:Asynchronous Networks [FLP’85] Best known: quasi-polynomial rounds [KKKSS’08]

31. Thank you!