Scalable Byzantine agreement with a random beacon

15 Pages·2012·0.76 MB·English

Scalable Byzantine agreement with a random beacon
OlumuyiwaOluwasanmiandJaredSaia
{muyiwa,saia}@cs.unm.edu;DepartmentofComputerScience,UniversityofNewMexico,
Albuquerque,NM87131-1386.ThisresearchwaspartiallysupportedbyNSFCAREERAward
0644058,NSFCCR-0313160,andanAFOSRMURIgrant.
Abstract. WepresenttwoMonteCarloalgorithmsforefficientlycomputingByzan-
tineagreementinthepartiallysynchronouscommunicationmodel.Thealgorithms
assumetheexistenceofarandombeacon,whichisastreamofrandombitsknown
toallprocessors.BothalgorithmsterminateinO(1)expectedtime.Thefirstalgo-
rithmsendsO(B+nlogn)messagesintotal,whereBisthemaximumnumber
ofmessagessentbythebadprocessorsinanyroundandnisthenumberofpro-
cessors. It ensures all processors reach agreement. The second algorithm sends
O˜(1)messagesperprocessor,andisthusload-balanced,andensuresallbutao(1)
fraction of the processors reach agreement. Both algorithms succeed with prob-
ability 1−O(1/nk), even against an adaptive adversary that takes over up to a
1/3−(cid:15)fractionoftheprocessors,foranyfixedpositivevalues(cid:15)andk.Weprove
the correctness of both algorithms and provide empirical evidence that they re-
quiresignificantlylessbandwidththanstateoftheartfornetworksofsizegreater
than4,000processors.Ouralgorithmsworkinthefull-informationmodelandthus
makenocryptographicassumptions.
1 Introduction
Peer-to-peernetworksarenotafad.Theideaofadecentralizednetwork,inwhicheach
processorplaystheroleofbothaclientandaserver,isnowanimportanttechniqueinour
toolkitfordesigningInternet-scaleapplications.Thepeer-to-peerapproachcontinuesto
beusedinestablishedandthrivingapplicationssuchasBittorrent[24]andSkype[25],
andthepeer-to-peerapproachevennowstillfindsnewusesinapplicationssuchasBit-
coin[23].
Peer-to-peer networks offer the promise of improved reliability when compared to
traditionalclient-servernetworks.However,suchpromisewillneverbeachievedunless
wecandesignanetworkthatismorereliablethananyofitsindividualcomponents.Un-
fortunately,mostpeer-to-peeralgorithmsareeasilydefeatedbyanadversarythatcontrols
evenasingleprocessor.
In this paper, we address this problem by designing scalable algorithms that solve
Byzantineagreement.IntheByzantineagreementproblem,therearenprocessorssome
of which are bad, in that they are controlled by an adversary that can cause them to
deviate in an arbitrary way. The remaining processors are good in that they follow the
protocol.Thegoalistoensureallgoodprocessorsoutputthesamebit,andthatthisbit
equals the input bit of some good processor. Intuitively, a solution to Byzantine agree-
mentallowsustobuildareliablesystemfromunreliablecomponents.
2
We take a step towards creating Byzantine agreement algorithms that scale to large
networks,likepeer-to-peernetworks.Ouralgorithmsarescalableinthesensethatthey
do not require all-to-all communication. Critical to our approach is the utilization of a
randombeacon.Arandombeaconisarandomstreamofbitsavailabletoalltheproces-
sors.ItwasfirstdefinedbyRabinin[21]whereitwasusedtobuildacontractsigning
protocol. Maurer et al. in [19,5,2,8] describe a computation model called the Memory
LimitedorLimitedStoragespaceModel,whichusestheexistenceofarandombeacon,
tobuildasecurecommunicationsystembasedonprivatekeys.
1.1 Model
Our algorithms assume that n processors can communicate directly via point-to-point
messagepassing,andthattheID’sofallprocessorsaregloballyknown.Ourcommuni-
cationmodelispartiallysynchronous.Inparticular,weassumeaknownupperboundon
the time it takes to receive a message. However, we do not assume that processors run
inlock-step,andwecantoleratearushingadversarythatgetstoreadallthemessages
fromgoodprocessorsbeforesendingthemessagesfrombadprocessorsinaround.
We assume the full-information model, meaning that all messages sent are public
andcanbeseenbythebadprocessors;wethusmakenocryptographicassumptions.We
assumetprocessorsarecontrolledbyanadaptiveadversarywheret ≤ (1/3−(cid:15))nfor
somefixed(cid:15)>0.Theadversaryisadaptiveinthesensethatitcantakeoverprocessorsat
anypointintheprotocoluptotakingovertprocessorsandonceprocessorsarecorrupted,
theystaycorrupted[18].Wealsoassumethatthebitsfromtherandombeaconareonly
availableatthebeginningofaround.
1.2 OurResults
Thispaperdescribestwoalgorithms,RBQUERYandRBSAMPLERthatcansolveByzan-
tineagreementwithoutall-to-allcommunication.Tothebestofourknowledge,thispaper
presentsthefirstpracticalalgorithmswiththisproperty.DolevandReischuk[7]showed
thatanyalgorithmmustsendΩ(n2)messagestoensureByzantineagreementwithprob-
ability 1. This lower bound still holds even with the assumption of a random beacon.
Thus, our algorithms are necessarily Monte Carlo, in the sense that they succeed with
probability1−O(1/nk),foranyfixedk.
Ourmainresultsaregiveninthefollowingtwotheorems.Forthefirsttheorem,we
let B be an upper bound on the total number of messages sent in a round by the bad
processors.WenotethatB isatmostθ(n2),butmaybemuchlower,dependingonthe
resources available to the adversary.1 RBQUERY is described in Section 2.1, and the
proofofTheorem1isgiveninSection3.1.
Theorem1. Foranypositivek,thereexistsettingsofparametersC and(cid:15) ,inthealgo-
0
rithm,toensurethefollowingwithprobabilityatleast1−1/nk.RBQUERYiscorrect,in
thateachgoodprocessorterminateswiththesamevalueandthisvalueequalstheinput
bitofsomegoodprocessor,andmoreover:
1Weassumethatthebadprocessorscancommunicateamongstthemselvesforfree,soBcounts
onlymessagesthatbadprocessorssendtogoodprocessors.
3
– AllgoodprocessorsterminateinO(logn)rounds;and
– AllgoodprocessorsterminateinO(1)roundsinexpectation;and
– ThetotalnumberofbitssentbyallgoodprocessorsisO(B+nlogn)inexpectation.
Our next algorithm is called RBSAMPLER. This algorithm make use of a sampler
in determining the communication graph among the processors. RBSAMPLER is thus
non-uniforminthesensethatthereisadifferentversionofthealgorithmforeachvalue
ofn.Also,unliketheRBQUERY,RBSAMPLERonlyachievesagreementthatisalmost-
everywhere in the sense that all but a o(1) fraction of the processors reach agreement.
RBSAMPLERisdescribedformallyinSection2.2andtheproofofthefollowingtheorem
ispresentedinSection3.2.
Theorem2. For any positive k and d, there exist settings of parameters C and (cid:15) , in
0
thealgorithm,toensurethefollowingwithprobabilityatleast1−1/nk,for almostall
processorsi.e.allbutO(logd−1n).RBSAMPLERiscorrect,inthatalmostallprocessors
terminatewiththesamevalueandthisvalueequalstheinputbitofsomegoodprocessor;
andmoreover:
– AlmostallprocessorsterminateinO(logn)rounds;and
– AlmostallprocessorsterminateinO(1)roundsinexpectation;and
– Almostallprocessorssendpolylog(n)bits.
1.3 OurApproach
OuralgorithmsbuildonrecentworkbyKingandSaia[12]thatdescribeByzantineagree-
mentalgorithmsthathaveθ(logn)latencyandrequireeachprocessortosendO˜(n3/2)
messages. In contrast to [12], our algorithms assume the existence of a random bea-
con.However,ouralgorithmsimproveonthispreviousworkinthefollowingways:1)
weachieveanexpectedlatencyofO(1);2)wetolerateanadaptiveadversary,whilethe
workin[12]toleratesonlyanon-adaptiveadversary;3)ouralgorithmssendsignificantly
fewermessagesinpractice;and4)ouralgorithmsaresignificantlysimpler:thealgorithm
in[12]isseveralpagesofdetailedpseudocode,whileouralgorithmsareeachdescribed
inhalfapage.
Like many Byzantine agreement algorithms, our algorithms follow the basic struc-
ture of Rabin’s algorithm [21]: each processor starts with an individual vote; votes are
exchangedwithotherprocessorsineachround;andfinallyeachprocessorupdatestheir
voteforthenextroundbasedonmessagesreceived.However,toachievereducedcom-
municationcosts,theprocessorsinouralgorithmareonlyabletotalktoasmallsample
of all the processors in the network. The challenging problem is achieving Byzantine
agreement,whileusingonlytheinformationcontainedinthesesmallsamples.
The technically challenging part of this paper is the design of the algorithm RB-
QUERY,andtheproofofTheorem1,whichdirectlyaddresseshowtoachieveagreement
while talking only to small samples of processors. Once we have established this al-
gorithm and theorem, it is relatively straightforward to design RBSAMPLER and prove
Theorem2.Inparticular,Theorem2essentiallyfollowsbycombiningTheorem1witha
resultonsamplersfrom[13].
4
1.4 Relatedwork
The Byzantine agreement problem was first proposed by Lamport et al. [16] as a way
tomodelbasicfault-tolerantdistributedcomputing.Lamport,ShostakandPeaseproved
in[16]thatByzantineagreementisonlypossiblewhenlessthann/3oftheprocessors
arebad.Fischer,LynchandPatersonin[11]alsoprovedthatasingleByzantinefaultin
theasynchronousmodelofcommunicationrendersByzantineagreementimpossiblefor
adeterministicalgorithm.
Byzantineagreementisusedinpeer-to-peersystemssuchasFarsite[1]andOceanstore[15,22].
Itisalsoacriticalpartofproposedsystemsformanylargewirelessandmobilenetworks.
See [14] for a comprehensive discussion of why Byzantine agreement is important for
large-scalepeer-to-peernetworks.
Rabinin[20]solvedarandomizedversionoftheByzantineagreementproblemusing
thenotionofacommoncoin(thisiswhatwerefertoasarandombeacon).Acommon
coinisavaluethatisonlyavailabletoalltheprocessorsatthebeginningofeachroundof
computation.Itis0withprobability1/2and1withprobability1/2.Rabin’salgorithm
[20]takesO(1)expectedroundsandrequiresΘ(n2)messages.Rabin’salgorithmworks
intheasynchronous,fullinformationmodelandiscorrectwithprobability1.
In the empirical section of this paper, we compare the resource costs of our algo-
rithmwithapopularByzantineagreementalgorithmproposedbyCachin,Kursaweand
Shoup[4],whichwerefertoastheCKSalgorithm.TheCKSalgorithmtoleratesupto
n/3badprocessors,runsinconstantexpectedtime,andsendsΘ(n2)messages.Itdoes
not assume a random beacon. However, unlike our algorithms, CKS does require the
establishmentofapublickeyinfrastructure.
WechooseCKSasapointofcomparison,because,inpractice,thenumberofmes-
sagesitrequiresprocessorstosendisthesmallestamongpriorByzantineagreement.In
particular,inourexperiments,CKSgenerallyrequiredonlyabout4n2 messages,which
isbetterthanotheralgorithmsofwhichweareaware.
1.4.1 RELATEDWORK:RANDOMBEACON
Lee,Clarketal.showedin[17,6]howtobuildarandombeaconusingpubliclyavailable
informationontheInternet,specificallyusinginformationfromtheDowJonesIndustrial
Average (DJIA) or from other financial data. Eastlake in [9,10] also describes how to
buildaselectionprotocoloutofarandombeacon.
Aconcernistheactualamountofrandomnesspresentinimplementationsofaran-
dombeaconfrompubliclyavailableinformation,thiscouldbeaproblemifthepublicly
availabledatacouldbemanipulatedinsomewayandhenceintroducingsomebiasinto
therandombeaconbits.Inparticular,ClarkandHengartnerin[6]determinedviaexper-
imentstheentropyofthestockcomponentsoftheDowJonesIndustrialAverage(DJIA)
andshowthattheShannonentropyforasinglestockintheDJIAperdayisbetween6.83
and9.45.TheycreatearandombeaconfromtheDJIAandshowaShannonentropyof
218bitsfortheirrandombeacon.
Wefurthernotethathardwareimplementationsofarandombeaconhavebeenpro-
posed[21].Thesemayinclude:asatellitebroadcastingrandombits,oratrustednodein
amassivelyparallelcomputerorwirelessnetwork.
5
1.5 PaperLayout
The rest of this paper is organized as follows. In Section 2, we formally describe our
algorithms:RBQUERYindescribedinSection2.1,andRBSAMPLERinSection2.2.In
Section 3, we analyze our algorithms: the proof of Theorem 1 is given in Section 3.1,
and the proof of Theorem 2 is given in Section 3.2. In Section 4, we empirically test
ouralgorithmsviasimulationsfornetworkscontaininguptoamillionnodes.Finally,in
Section5,weconcludeandgivedirectionsforfuturework.
2 AlgorithmsandtheirDescription
2.1 RBQUERY
Our first algorithm RBQUERY is presented as Algorithm 2.1 (RBQUERY). This algo-
rithm has two parameters: C and (cid:15) . Both of these values depend on k and (cid:15) as is de-
0
scribed formally in the proof of Lemma 1.2 In our experiments, we set C = 40 and
(cid:15) =1/8.
0
We now describe RBQUERY at a high level. In each round, each processor has a
votewhichisthebitheldbythatprocessoratthestartoftheround.Alsoineachround,
a processor selects Θ(lnn) processors uniformly at random with replacement to query
for their votes. Each processor sends its vote to the processors that queried it, while it
receivesvotesfromtheprocessorsthatitqueried.Aftereachround,thefractionofvotes
receivedthatareforthemajoritybitiscomputed.
Ifthefractionofprocessorsthatvoteforthemajoritybitisatleast(1−(cid:15) )(2/3+(cid:15)/2),
0
thentheprocessorsetsitsvotetothemajoritybit.Otherwisetheprocessorsetsitsbitto
the value from the random beacon. A processor terminates after it has 1) computed a
fractionvalueatleast(1−(cid:15) )(2/3+(cid:15)/2)withamajoritybitvalueb;and2)theglobal
0
coinvalueequalsbtwice.
Notethatifallprocessorssimplycommittotherandombeacon,thenwewouldnot
beabletosolveByzantineagreement,asthebitfromtherandombeaconmaynotbethe
input bit of any good processor. Such a scenario violates the conditions for Byzantine
agreement.
WeanalyzethecorrectnessofRBQUERYinSection3.1.
2.2 RBSAMPLER
We now describe the algorithm RBSAMPLER. The main difference in this algorithm,
comparedtoRBQUERY,isthatitmakesuseofasamplerindeterminingthecommuni-
cationgraphamongtheprocessors. RBSAMPLER isthusnon-uniforminthesensethat
there is a different version of the algorithm for each value of n. Also, the neighbors of
eachprocessorarefixedanddonotchangebetweenrounds,unlikeRBQUERY.Finally,
unliketheRBQUERY,RBSAMPLERonlyachievesalmost-everywhereagreement.
WeanalyzethecorrectnessofRBSAMPLERinSection3.2.
2Recall1/nkistheprobabilityoffailureandthefractionofbadnodesisnomorethan1/3−(cid:15).
6
Initialize:
1. vote←b
i
2. Match←FALSE
Repeatuntiltermination:
1. Select Clnn processors uniformly at random with replacement. Set InNeighbors to these
processors.SendrequestmessagestoallprocessorsinInNeighbors
2. Receiveallrequestmessages.SetOutNeighbors toallprocessorsfromwhichrequestmes-
sageswerereceived
3. SendvotetoallprocessorsinOutNeighbors
4. CollectallvotesreceivedfromprocessorsinInNeighbors
5. coin←nextoutputofrandombeacon
6. IfMatchthen
(a) Ifcoin=votethencommittovaluevoteandterminate
7. Else
(a) maj ←majorityvoteamongInNeighbors
(b) fraction←fractionofvotesreceivedformaj
(c) Iffraction≥(1−(cid:15) )(2/3+(cid:15)/2)then
0
i. vote←maj
ii. Ifcoin=votethenMatch←TRUE
(d) else
i. vote←coin
Algorithm2.1:RBQUERY
3 Analysisandproofs
In this section, we show the correctness of RBQUERY and RBSAMPLER by proving
Theorem1andTheorem2.
3.1 AnalysisandproofsforRBQUERY
We begin with a proof of correctness for RBQUERY. For a fixed round, let b ∈ {0,1}
bethebitthatthemajorityofgoodprocessorsvoteforinthatround(breakingtiesarbi-
trarily).LetM bethesetofgoodprocessorsthatwillvoteforb,andletf =|M|/n.Let
0 ≤ (cid:15) ≤ 1beafixedconstanttobedeterminedlater.Wecallaprocessorinformedfor
0
theroundifthefractionvalueforthatprocessorobeysthefollowinginequalities:
(1−(cid:15) )f ≤fraction≤(1+(cid:15) )(f +1/3−(cid:15))
0 0
Lemma1. ForanypositiveintegersC(cid:48) and(cid:96),thereexistssettingofparametersC and
(cid:15)0inAlgorithm2.1(RBQUERY),suchthatthefollowingholds.Let(cid:96)(cid:48)betheminimumof
(cid:96)andr,wherer isthefirstroundinwhichagoodprocessorterminates.Thenallgood
processorsareinformedforthefirst(cid:96)(cid:48)roundswithprobabilityatleast1−2(cid:96)(cid:48)/nC(cid:48).
Proof. Fix a round r(cid:48) ≤ min((cid:96),r). Let G be a bipartite multigraph induced by the
InNeighbors and OutNeighbors selection process defined in RBQUERY for round r(cid:48).
7
Initialize:
1. vote←b
i
2. Match←FALSE
3. SetInNeighbors(resp.OutNeighbors)toallprocessorsthathavein-edges(resp.out-edges)
tothisprocessorinthesampler.
Repeatuntiltermination:
1. SendvotetoallprocessorsinOutNeighbors
2. CollectvotesfromallprocessorsinInNeighbors
3. coin←nextoutputofrandombeacon
4. IfMatchthen
(a) Ifcoin=votethencommittovaluevoteandterminate
5. Else
(a) maj ←majoritybitamongInNeighbors
(b) fraction←fractionofvotesreceivedformaj
(c) Iffraction≥(1−(cid:15) )(2/3+(cid:15)/2)then
0
i. vote←maj
ii. Ifcoin=votethenMatch←TRUE
(d) else
i. vote←coin
Algorithm2.2:RBSAMPLER
G is constructed as follows. There are n nodes on the left hand side and copies of all
these nodes on the right hand side. The adversary chooses a subset of 1/3−(cid:15) of the
nodesontheleftthatarebad.Edgesarecreatedasfollows:eachgoodnodeontheright
choosesClognneighborsontheleftuniformlyatrandomwithreplacement,andforms
edgeswiththesenodes.
Letbbethebitthatthemajorityofgoodprocessorsvoteforinroundr(cid:48)andletM be
thesetofgoodprocessorsthatvoteforb.WeknowthatM isofsizeatleast(1/3+(cid:15)/2)n
sinceatleasthalfofthegoodprocessorsmustvoteforthemajoritybit.Letf =|M|/n.
NotethattheedgesinGarechosenindependentlyofthesetM.
Fixagoodnode,p,ontherighthandsideofG.LetX bethenumberofedgesfromp
intothesetM.NotethatE(X)=fClnn.Moreover,eachedgefrompfallsintosome
processorinM independentlywithprobabilityf.Thus,wecanapplyChernoffbounds
tosaythatforanypositive(cid:15) ,
0
Pr(X <(1−(cid:15)0)E[X])<e−E[X](cid:15)20/2 =e−(fC(cid:15)20/4)lnn.
Similarly,wecanuseChernoffboundstosaythat
Pr(X >(1+(cid:15)0)E[X])<e−E[X](cid:15)20/3 =e−(fC(cid:15)20/6)lnn.
Hence the probability that either of these bounds is violated is no greater than the sum
ofthesetwoprobabilities,orlessthan2e−(fC(cid:15)20/6)lnn.Clearlyifbothofthesebounds
hold,thenthefixedgoodprocessorisinformedforthisround.
8
Nowletξ betheeventthateitheroftheseboundsisviolatedforsomefixedpro-
p,r(cid:48)
cessorpinsomefixedroundr(cid:48).Furtherletξ betheeventthateitheroftheseboundsis
violatedforanygoodprocessorpinanyofthefirst(cid:96)(cid:48) rounds.Thenbyaunionbound,
wehavethat
(cid:88)
Pr(ξ)= Pr(ξ )
p,r
p,r(cid:48)
≤(n(cid:96)(cid:48))2e−(fC(cid:15)20/6)lnn
≤2(cid:96)(cid:48)/nC(cid:48)
Note that f ≥ 1/3, so the last equation holds provided that C is sufficiently large,
butdependingonlyon(cid:15) andC(cid:48).
0
Lemma2. Assume1)allgoodprocessorshavevotevalueequaltobatthebeginningof
someroundr;2)nogoodprocessorhasterminatedpriortoroundr;and3)allproces-
sorsareinformedinroundr.Thenallgoodprocessorswillhavevotevalueequaltobat
thebeginningofroundr+1.
Proof. If all good processors have vote value equal to b at the beginning of round r, it
meansthatf =|M|/n=2/3+(cid:15).Sinceallprocessorsareinformedinroundr,itmeans
thatforeachprocessor,fraction≥(1−(cid:15) )f ≥(1−(cid:15) )(2/3+(cid:15)).Thus,eachprocessor
0 0
at the end of round r will set its vote to the majority value, which equals b, and hence
willhavevotevalueequaltobatthebeginningofroundr+1.
Lemma3. Letrbeapositiveintegerand(cid:15) <(3/4)(cid:15).Assumethat1)allprocessorsare
0
informedinroundr;and2)thatnogoodprocessorhasterminatedpriortoroundr.Let
S bethesetofgoodprocessorsinroundrthathavefraction≥(1−(cid:15) )(2/3+(cid:15)/2).
h 0
Then,attheendofroundr,allprocessorsinS willhavethesamevotevalue.
h
Proof. Weshowthisbycontradiction.Assumetherearetwoprocessors,xandy,where
fraction (fraction )arethefractionvaluesofx(y,resp.),suchthatbothfraction
x y x
andfraction aregreaterthanorequalto(1−(cid:15) )(2/3+(cid:15)/2).Assumefurtherthatx
y 0
setsitsvoteto0attheendoftheround,whileysetsitsvoteto1.
Let f be the fraction of good processors that vote for 0 during round r; and let
0
f be the fraction of good processors that vote for 1 during round r. By assumption,
1
fraction ≥ (1−(cid:15) )(2/3+(cid:15)/2). By the definition of informed, we also know that
x 0
fraction ≤(1+(cid:15) )(f +1/3−(cid:15)).Thisimpliesthat
x 0 0
(1−(cid:15) )(2/3+(cid:15)/2)≤(1+(cid:15) )(f +1/3−(cid:15)).
0 0 0
Isolatingf inthisinequality,wegetthat
0
1/3+(3/2)(cid:15)−(cid:15) +(1/2)(cid:15)(cid:15)
f ≥ 0 0.
0 1+(cid:15)
0
Asimilaranalysisforfraction impliesthat
y
1/3+(3/2)(cid:15)−(cid:15) +(1/2)(cid:15)(cid:15)
f ≥ 0 0.
1 1+(cid:15)
0
9
Butthenwehavethat,
2/3+3(cid:15)−2(cid:15) +(cid:15)(cid:15)
f +f ≥ 0 0
0 1 1+(cid:15)
0
>2/3+(cid:15)
wherethelastlineisclearlyacontradiction(holdingif(cid:15) <(3/4)(cid:15)).
0
Lemma4. Assume (cid:15) < (3/4)(cid:15); let r be the first round in which a good processor
0
terminates; and assume all processors are informed in rounds 1 to r. Further, assume
that some good processor commits to value b in round r. Then 1) all good processors
that commit in round r will commit to b; and 2) in round r + 1, all remaining good
processorswillsetvotevalueequaltobandMatchvaluetoTRUE.Hence,allgood
processorswillhavecommittedtobbythenextroundinwhichcoin=b.
Proof. Consideraprocessorpthatcommitstobitvaluebinroundr.Thenprocessorp’s
MatchvaluemustbeequaltoTRUEinroundr.Thismeanstheremusthavebeensome
previousround,r(cid:48),inwhichp’sMatchvaluewasfirstsettoTRUE.Amongprocessors
that commit to values in round r, let p be a processor with the smallest such r(cid:48) value.
Note that at the point that Match was set to TRUE in round r(cid:48), p’s vote value must
havebeenb,sinceaprocessor’svotevaluecannotchangeafteritsMatchvalueissetto
true.
LetS bethesetofgoodprocessorsinroundr(cid:48)thathavefraction≥(1−(cid:15) )(2/3+
h 0
(cid:15)/2).ByLemma3,allprocessorsinS settheirvotevaluetobattheendoftheround.
h
Now since processor p set Match to TRUE in round r(cid:48), it must be the case that the
outcomeoftheglobalcoininthatroundwasequaltob.Thismeansattheendofround
r(cid:48),allgoodprocessorssettheirvotevaluestob.
But then, by then by repeated applications of Lemma 2, for all rounds subsequent
toroundr(cid:48),allprocessorswillhavevotevaluesequaltobandsoiftheycommittoany
value,itwillbethevalueb.Further,notethatforptoterminate,inroundr,itmustbethat
coin=b.Thus,allremaininggoodprocessorswillsettheirMatchvaluestoTRUE at
thebeginningofroundr.
Lemma5. Let(cid:15) <(3/4)(cid:15)andrbeapositiveinteger.Assumethatallgoodprocessors
0
are informed in round r; and that no good processor has terminated prior to round r.
Then,withprobabilityatleast1/2,attheendofroundr,allgoodprocessorswillhave
thesamevotevalue.
Proof. Let S be the set of good processors in round r that have fraction ≥ (1 −
h
(cid:15) )(2/3+(cid:15)/2).ByLemma3,allprocessorsinS willsettheirvotevaluetothesame
0 h
value,callitb,attheendoftheround.Butwithprobability1/2,theglobalcoininround
rwillhavevalueb,andsoalltheremaininggoodprocessorswillalsosettheirvotevalue
tob.
WenowproveTheorem1.
Proof. Throughoutthisproof,wewillassumethat(cid:15) issetsuchthat(cid:15) <(3/4)(cid:15).
0 0
10
Wefirstshowthat,withhighprobability3,allgoodprocessorsterminateinO(logn)
rounds;andthatallgoodprocessorsterminateinO(1)roundsinexpectation.Fixacon-
stantC andlet(cid:96) = C logn;letr(cid:48) bethefirstroundinwhichagoodprocessortermi-
1 1
nates; and let (cid:96)(cid:48) = min((cid:96),r(cid:48)). By Lemma 1, for any constants C(cid:48), there exist settings
ofthealgorithmparameterssuchthatallgoodprocessorswillbeinformedfor(cid:96)(cid:48) rounds
withprobabilityatleast1−2C logn/nC(cid:48).ByLemma4,ifr(cid:48)isthefirstroundinwhich
1
agoodprocessorterminatesandcommitstovalueb,theninroundr(cid:48)+1,allprocessor
willsettheirMatchvaluetoTRUEandsowillterminatethenexttimecoin=b.Thus,
thenumberofremainingroundsafterr(cid:48) untilallgoodprocessorsterminateisbounded
byageometricrandomvariablewithsuccessprobability1/2.
Wenowconsiderthedistributionofr(cid:48).ByLemma5,ineachofthefirst(cid:96)(cid:48) informed
rounds,thereisprobabilityatleast1/2thatattheendofthatround,allgoodprocessors
will have the same vote value. Moreover, by Lemma 2, once all good processors have
thesamevotevalueinsomeround,theywillallcontinuetohavethesamevotevalue,as
longas1)theyareallinformed;and2)noneofthemterminate.Thus,threeeventsneed
tooccurforustoreachroundr(cid:48):1)allprocessorsfirstobtainthesamevotevalue,b(this
happens with probability 1/2 in any round); and 2) the value coin equals b two times
(theeventcoin=bhappenswithprobability1/2inanyround).
Thus,thedistributionofr(cid:48) isarandomvariablethatisupperboundedbythesumof
two geometric random variables with success probability 1/2. Hence, the total number
ofroundsuntilallprocessorsterminateisupperboundedbythesumoffourgeometric
randomvariableswithprobability1/2.Clearlytheexpectedvalueofsuchasummation
isO(1)and,withhighprobability,thesumisnomorethanC logn.
1
We now argue correctness. First, by Lemma 2, if all good processors initially have
input values equal to b, then they will all always have vote values b, so they will all
eventually commit to b. Next, Lemma 4 shows that if any good processor commits to
somevalueb,thatallgoodprocessorswilleventuallycommittob.
Finally, we count the expected number of bits sent. In any round, a good processor
sendsoutmessagestoθ(logn)otherprocessorsandthebadprocessorssendoutatotalof
atmostB messages.Thus,thetotalnumberofrequestsreceivedbythegoodprocessors
is θ(B +nlogn). To answer requests thus requires sending a total of θ(B +nlogn)
messages,eachcontainingasinglebit.SincetheexpectednumberofroundsisO(1),the
expectednumberofbitssentintotalisθ(B+nlogn)bylinearityofexpectation.
3.2 AnalysisandproofsforRBSAMPLER
For our new algorithm, we use the same definition as in Section 3.1 to say whether a
processorisinformedinagivenround.Theproofofthefollowinglemmaisequivalent
tothatinKingandSaia[13].
Lemma6 (Graphexistence).Foranypositivekandpositiveconstants(cid:15) andd,there
0
exists a directed multigraph G on k vertices with maximum out-degree no more than
C logdn,whereC dependsonlyon(cid:15) andd,suchthatifthiscommunicationgraphis
3 3 0
3Wewillusetheterm“withhighprobability”tomeanthatthereisprobabilityoferrornomore
than1/nkforaconstantk.