Paper 2017/063

Optimal Extension Protocols for Byzantine Broadcast and Agreement

Chaya Ganesh and Arpita Patra

Abstract

The problems of Byzantine Broadcast (BB) and Byzantine Agreement (BA) are of interest to both distributed computing and cryptography community. Extension protocols for these primitives have been introduced to handle long messages efficiently at the cost of small number of single-bit broadcasts, referred to as seed broadcasts. While the communication optimality has remained the most sought-after property of an extension protocol in the literature, we prioritize both communication and round optimality in this work. In a setting with $$ parties and an adversary controlling at most $$ parties in Byzantine fashion, we present BB and BA extension protocols with $$, $$ and $$ that are simultaneously optimal in terms of communication and round complexity. The best communication that an extension protocol can achieve in any setting is $$ bits for a message of length $$ bits. The best achievable round complexity is $$ for the setting $$ and $$ in the other two settings $$ and $$. The existing constructions are either optimal only in terms of communication complexity, or require more rounds than our protocols, or achieve optimal round complexity at the cost of sub-optimal communication. Specifically, we construct communication-optimal protocols in the three corruption scenarios with the following round complexities: 1. $$: $$ rounds, improving over $$ 2. $$: $$ rounds, improving over $$ 3. $$: $$ rounds, improving over $$ A concrete protocol from an extension protocol is obtained by replacing the seed broadcasts with a BB protocol for a single bit. Our extension protocols minimize the seed-round complexity and seed-communication complexity. The former refers to the number of rounds in an extension protocol in which seed broadcasts are invoked and impacts the round complexity of a concrete protocol due to a number of sequential calls to bit broadcast. The latter refers to the number of bits communicated through the seed broadcasts and impacts the round and communication complexity due to parallel instances of single-bit broadcast. In the settings of $$, $$ and $$, our protocols improve the seed-round complexity from $$ to $$, from $$ to $$ and from $$ to $$ respectively. Our protocols keep the seed-communication complexity independent of the message length $$ and, either improve or keep the complexity almost in the same order compared to the existing protocols.

Note: Minor fix to t<n/2 BA protocol. Earlier version allowed the adversary to make the honest parties communicate more than $$ bits.