Error-free Multi-valued Broadcast and Byzantine Agreement with Optimal Communication Complexity

Transcription

1 Error-free Muti-vaued Broadcast and Byzantine Agreement with Optima Communication Compexity Arpita Patra Department of Computer Science Aarhus University, Denmark. Abstract In this paper we present first ever error-free, asynchronous broadcast (caed as A-cast) and Byzantine Agreement (caed as ABA) protocos with optima communication compexity and faut toerance. Our protocos are muti-vaued, meaning that they dea with bit input and achieve communication compexity of O(n) bits for arge enough for a set of n 3 parties in which at most t can be Byzantine corrupted. In synchronous settings, Fitzi and Hirt (PODC 06) proposed probabiisticay correct muti-vaued broadcast (BC) and Byzantine Agreement (BA) protocos with optima compexity of O(n) bits. Recenty, Liang and Vaidya (PODC 11) achieved the same deterministicay, i.e. without error probabiity. In asynchronous settings, Patra and Rangan (Latincrypt 10, ICITS 11) reported simiar protocos with error probabiity. Here we achieve optima compexity of O(n) bits for asynchronous error-free case. Foowing a the previous works on muti-vaued protocos, we too foow reduction-based approach for our protocos, meaning that our muti-vaued protocos are designed given existing A-cast and ABA protocos for sma message (possiby for singe bit). However compared to existing reductions, our reductions are simpe and eegant. More importanty, our reductions run in constant expected time, in contrast to O(n) of Patra and Rangan (ICITS 11). Furthermore our reductions invoke ess or equa number of instances of protocos for singe bit in comparison to the reductions of Patra and Rangan. In synchronous settings, whie the reduction of Fitzi and Hirt is constant-round and invokes O(n(n+ κ)) (κ is the error parameter) instances of protocos for singe bit, the reduction of Liang and Vaidya cas for round compexity and number instances that are in fact function of the message size, O( + n 2 ) and O(n 2 + n 4 ), respectivey where = Ω(n 6 ). By adapting our techniques from asynchronous settings, we present new error-free reduction in synchronous word that is constant-round and cas for ony O(n 2 ) instances of protocos for singe bit which is at east as good as Fitzi and Hirt. Keywords: Asynchronous, Muti-vaued, A-cast, Byzantine Agreement, Communication Compexity 1 Introduction The probem of Broadcast (BC) and Byzantine Agreement (BA) (aso popuary known as consensus) were introduced in [PSL80] and since then they have been considered as the most fundamenta probems in distributed computing. In brief, a BC protoco aows a specia party among a set of parties, caed sender, to send some message identicay to a other parties. The chaenge ies in achieving the above task despite the presence of some fauty parties (possiby incuding the sender), who may deviate from the protoco arbitrariy. The BA primitive is sighty different from BC. A BA protoco aows a set of parties, each hoding some input bit, to agree on a common bit, even though some of the parties may act maiciousy in order to make the honest parties disagree. The BC and BA primitives have been used as buiding bocks in severa important secure distributed computing tasks such as Secure Mutiparty Computation (MPC) [BOGW88, BKR94, RBO89], Verifiabe Secret Sharing (VSS) [CGMA85, BOGW88, RBO89] etc. 1

2 An important, practicay motivated variant of BC and BA probem are asynchronous broadcast (known as A-cast) and asynchronous BA (known as ABA) that study the conventiona BC and BA probems in asynchronous network settings. It is we-known that asynchronous network setting is considered to be more reaistic than synchronous network setting. The works of [BO83, Rab83, Bra84, FM88, CR93, Can95, ADH08, PW92, PR11] have reported different A-cast and ABA protocos. In this paper, we focus on the communication compexity of error-free A-cast and ABA protocos and present first ever optima protocos. The Mode. We foow the standard network mode of [PSL80, CR93, Can95]. Specificay, our A-cast, ABA, BC and BA protocos are carried out among a set of n parties, say P = {P 1,..., P n }, where every two parties are directy connected by an authenticated and secure communication channe and t out of the n parties can be under the infuence of a computationay unbounded Byzantine (active) adversary, denoted as A t. We assume that n = 3t + 1 which is the minimum number of parties required to design error-free A-cast, ABA, BC and BA protocos [Lyn96, PSL80]. The adversary A t, competey dictates the parties under its contro and can force them to deviate from the protoco in any arbitrary manner. The parties not under the infuence of A t are caed honest or uncorrupted. Since synchronous network is extremey we-studied in the iterature, in the foowing we ony reca the important features of an asynchronous network. In asynchronous network, the communication channes between the parties have arbitrary, yet finite deay (i.e. the messages are guaranteed to reach eventuay). To mode this, we assume that A t contros the network and may deay messages between any two honest parties. However, it cannot read or modify these messages as the inks are private and authenticated, and it aso has to eventuay deiver a the messages by honest parties. In asynchronous network, the inherent difficuty in designing a protoco comes from the fact that a party can not distinguish between a sow party (whose message is simpy deayed in the network) and a corrupted party (who did not send the message at a). So an honest party can not wait for the vaues from a the parties, as it woud potentiay mean that the party is waiting for the vaues from corrupted parties who may never send any vaue at a. Therefore, it woud make the honest party wait indefinitey. As a resut, an honest party in asynchronous network shoud start computation upon receiving vaues from n t parties at any particuar step. However, this may risk ignoring the vaues of up to t potentiay honest parties at every step. The above reason makes it difficut to design protocos in asynchronous settings. For comprehensive introduction to asynchronous protocos, see [Can95]. We do not make any cryptographic assumptions such as pubic key infrastructure (PKI) etc for designing our protocos. Definitions. We now define A-cast and ABA formay. Definition 1.1 (A-cast [Can95]) Let Π be an asynchronous protoco executed among the set of parties P and initiated by a specia party caed sender S P, having input m (the message to be sent). Π is an A-cast protoco toerating A t if the foowing hod, for every behavior of A t and every input m: Termination: If S is honest, then a honest parties in P wi eventuay terminate Π. If any honest party terminates Π, then a honest parties wi eventuay terminate Π. Correctness: If the honest parties terminate Π, then they do so with a common output m. Furthermore, if the sender S is honest then m = m. Definition 1.2 (ABA [CR93]) Let Π be an asynchronous protoco executed among the set of parties P, with each party having a private binary input. We say that Π is an ABA protoco toerating A t if the foowing hod, for every possibe behavior of A t and every possibe input: Termination: A honest parties eventuay terminate the protoco. Correctness: A honest parties who have terminated the protoco hod identica outputs. Furthermore, if a honest parties had same input, say ρ, then a honest parties output ρ. The ceebrated resut of Fischer, Lynch, and Paterson [FLP85] shows that any ABA protoco that never reaches disagreement (i.e., has no executions where two honest parties output different vaues) must have some nonterminating executions, where some honest party does not output a vaue. For a protoco that never reaches disagreement, the best we can hope for is that the set of nonterminating executions has probabiity zero. Such protocos are termed as amost-surey terminating by Abraham et a. [ADH08]. In this work, we construct ABA protoco that is amost-surey terminating and has no error in correctness. The important compexity measures of A-cast and ABA protoco are: 2

3 Communication Compexity: It is the tota number of bits communicated by the honest parties in the protoco; Running Time: The current definition is taken from [CR93, Can95]. Consider a virtua goba cock measuring time in the network. Note that the parties cannot read this cock. Let the deay of a message be the time eapsed from its sending to its receipt. Let the period of a finite execution of a protoco be the ongest deay of a message in the execution. The duration of a finite execution is the tota time measured by the goba cock divided by the period of the execution. The expected running time of a protoco is the maximum over a inputs and appicabe adversaries, of the average over the random inputs of the parties, of the duration of executions of the protoco. Whie the basic definitions of A-cast and ABA consider message of singe bit, muti-vaued protocos aow message to be ong string of bits and expoit the fact that the task is to be attained for the entire string and not bit by bit. This fact generay aows a muti-vaued protoco to be consideraby more efficient than many parae executions of protoco for singe bit. Brief Literature. Error-free BC and BA protoco in synchronous network are possibe if and ony if n 3t + 1 [PSL80, Lyn96]. The same bound hods for A-cast and ABA both with and without error probabiity [Lyn96]. The semina resut of [DR85] shows that any error-free BA or BC must communicate Ω(n 2 ) bits (which again carry over for the case of A-cast and ABA). Since the message must be at east singe bit, the ower bound on the communication compexity for singe bit is Ω(n 2 ) bits. However, communication compexity of O(n) bits can be achieved for arge enough vaue of (at east n bits) as shown in [FH06]. Requiring arge vaue for is practicay motivated in many distributed computing appications, ike reaching agreement on a arge fie in faut-toerant distributed storage system, distributed voting where baots containing gigabytes of data is to be handed, MPC where many broadcasts and agreements are invoked which can be combined into fewer executions of muti-vaued protocos. Foowing the approach of Turpin and Coan [TC84], a the subsequent muti-vaued protocos appy reductionbased approach [FH06, LV11, PR11, PR10], meaning that they are constructed based on access to protocos for sma message or singe bit message. The reductions presented in [FH06, LV11, PR11, PR10] achieve optima communication compexity of O(n) bits. In synchronous settings, whie the reduction presented in [FH06] invoves error probabiity, the reduction of [LV11] is error-free. However, the reduction of [FH06] is constant-round, as opposed to the reduction of [LV11] which has a round compexity of O( + n 2 ), where = Ω(n 6 ). Furthermore, the reduction of [FH06] invokes O(n(n + κ)) (κ is the error parameter of their protoco) instances of protoco for singe bit, whie the reduction of [LV11] invokes O(n 2 + n 4 ) instances of protoco for singe bit. In asynchronous settings, [PR11, PR10] reported muti-vaued protocos with error probabiity. Our Contribution. In this work, we achieve optima compexity of O(n) bits for error-free A-cast and ABA with optima faut-toerance. We too foow reduction-based approach of [TC84]. Both the reductions run in constant time. Our reduction for A-cast cas for O(n 2 og n) instances of A-cast for singe bit which is exacty same as the reduction of [PR10]. However interestingy, our reduction for ABA runs in constant expected time and invokes ony O(n) instances of ABA for singe bit, whereas the reduction of [PR11] runs in O(t) expected time and invokes O(n 3 ) instances of ABA for singe bit. Therefore our reductions are better than existing muti-vaued asynchronous protocos in a the foowing aspects: (a) error-free, (b) constant time and (c) ess (or equa) number of invocations to protocos for singe bit. The comparison is summarized beow: Ref. Type Faut CC in Running Time No. Invocations Toerance bits to singe-bit protoco [PR10], A-cast Probabiistic t < n/3 O(n) constant O(n 2 og n) A-cast [PR11], ABA Probabiistic t < n/3 O(n) O(n) O(n 3 ) ABA This paper, A-cast Error-free t < n/3 O(n) constant O(n 2 og n) A-cast This paper, ABA Error-free t < n/3 O(n) constant O(n) ABA Technicay, our reductions are simpe and are based on inear error correcting code (e.g. Reed-Soomon Code) and a graph theoretic agorithm for finding some specia structure (caed (n, t)-star; defined in Section 2) in undirected graph [CR93, Can95]. Whie the existing reductions for muti-vaued protocos [PR11, LV11] are constructed in payer-eimination [HMP00] or dispute contro [BTH06] framework, our reductions do not require them and therefore 3

4 they are more eegant. We reca that in payer-eimination or dispute contro framework, the executions are carried out in non-robust manner, in the sense that if a the parties incuding the corrupted parties behave according to the protoco then the execution successfuy achieves its task; otherwise the execution may fai in which case a sma subset of parties wi be outputted such that at east one of them is guaranteed to be corrupted. Depending on the framework, either that subset of parties wi be eiminated (in payer-eimination framework) and the execution wi be repeated with the remaining parties or the execution wi be repeated again with the guarantee that the subset of the parties can never cause to fai the execution anymore (in dispute contro framework). Finay, we note that the muti-vaued A-cast protoco of [PR10] aso empoy the agorithm for finding (n, t)-star [CR93, Can95]. However, we mark an important and crucia observation about the outcome of the agorithm in our context that aows to achieve our goa. We now compare our resuts with the current best error-free A-cast and ABA for singe bit. The ony error-free A-cast is due to [Bra84] that communicates O(n 2 ) bits and runs in constant time. Simiary, the ony error-free ABA is due to [ADH08] that runs in O(n 2 ) time and requires communication of O(n 8 og n) bits and A-cast of same number of bits. Our protocos in this paper show cear improvement over executions of these protocos. Finay, we discuss our resuts in synchronous settings. In synchronous settings, the reduction of [FH06] is constant-round and it invokes O(n(n + κ)) (κ is the error parameter) instances of protocos for singe bit. However the reduction of [LV11] cas for round compexity and number instances that are function of the message size, i.e. O( + n 2 ) and O(n 2 + n 4 ), respectivey where = Ω(n 6 ). By adapting our techniques from asynchronous settings, we present new error-free reduction in synchronous word that is constant-round and cas for ony O(n 2 ) instances of protocos for singe bit which is at east as good as [FH06]. The summary is presented beow: Ref. Type Faut Communication Round Compexity No. Invocations Toerance Compexity (CC) in bits to singe-bit protoco [FH06] Probabiistic t < n/2 O(n) constant O(n(n + κ)) [LV11] Error-free t < n/3 O(n) O( + n 2 ) O(n 2 + n 4 ) This paper Error-free t < n/3 O(n) constant O(n 2 ) Road-map. In section 2 and 3, we present our construction for A-cast and ABA respectivey. We present our BA and BC protocos in Section 4 and then concude in Section 5. 2 Error-free A-cast with Optima Communication Compexity Here we present our A-cast protoco. We start with brief presentation of the toos that we use for the protoco: (a) The existing A-cast protoco of Bracha [Bra84]; (b) An agorithm for finding a graphica structure caed (n, t)-star in an undirected graph; (c) Linear Error Correcting Code. We discuss them one by one. Bracha s A-cast. The first ever protoco for A-cast is due to Bracha [Bra84]. The protoco is error-free, runs with n 3 in constant time and communicates O(n 2 ) bits for a singe bit message. The description of Bracha s A-cast protoco is avaiabe in [Can95]. For the sake of competeness, the protoco is provided in Appendix A. Notation 2.1 By saying that P i A-casts M, we mean that P i as a sender, initiates Bracha s A-cast protoco with M as the message. Simiary P j receives M from the A-cast of P i wi mean that P j terminates the A-cast protoco initiated by P i and outputs M. By the property of A-cast, if some honest party P j terminates the A-cast protoco of some sender P i with M as the output, then every other honest party wi eventuay do so, irrespective of the behavior of the sender P i. Finding (n, t)-star in an Undirected Graph. We now describe an existing soution for a graph theoretic probem, caed finding (n, t)-star in an undirected graph G = (V, E). Definition 2.1 ((n, t)-star [Can95, BOCG93]:) Let G be an undirected graph with the n parties in P as its vertex set. We say that a pair (C, D) of sets with C D P is an (n, t)-star in G, if: (i) C n 2t; (ii) D n t; (iii) for every P j C and every P k D the edge (P j, P k ) exists in G. 4

5 Foowing an idea of [GJ79], Ben-Or et a. [BOCG93] have presented an eegant and efficient agorithm for finding an (n, t)-star in a graph of n nodes, provided that the graph contains a cique of size n t. The agorithm, caed Find-STAR outputs either an (n, t)-star or the message star-not-found. Whenever, the input graph contains a cique of size n t, Find-STAR wi aways output an (n, t)-star in the graph. Actuay, agorithm Find-STAR takes the compementary graph G of G as input and tries to find (n, t)-star in G, where (n, t)-star is a pair (C, D) of sets with C D P, satisfying the foowing conditions: (a) C n 2t; (b) D n t; (c) There are no edges between the nodes in C and nodes in C D in G. Ceary, a pair (C, D) representing an (n, t)-star in G, is an (n, t)-star in G. Recasting the task of Find-STAR in terms of compementary graph G, we say that Find-STAR outputs either an (n, t)-star, or a message star-not-found. Whenever, the input graph G contains an independent set of size n t, Find-STAR aways outputs an (n, t)-star. For simpe notation, we denote G by H. The agorithm Find-STAR is presented in Figure 1. It is easy to see that the agorithm requires poynomia computation. Figure 1: Agorithm for Finding (n, t)-star. Agorithm Find-STAR(H) 1. Find a maximum matching M in H. Let N be the set of matched nodes (namey, the endpoints of the edges in M), and et N = P N. 2. Compute output as foows (which coud be either (n, t)-star or a message star-not-found): (a) Let T = {P i N P j, P k s.t (P j, P k ) M and (P i, P j ), (P i, P k ) E}. T is caed the set of triangeheads. (b) Let C = N T. (c) Let B be the set of matched nodes that have neighbors in C. So B = {P j N P i C s. t. (P i, P j) E}. (d) Let D = P B. If C n 2t and D n t, output (C, D). Otherwise, output star-not-found. Linear Error Correcting Code. We use Reed-Soomon (RS) codes in our protocos. We consider an (n, t + 1) RS code in Gaois Fied F = GF (2 c ), where n 2 c. Each eement of F is represented by c bits. An (n, t + 1) RS code encodes t + 1 eements of F into a codeword consisting of n eements from F. We denote the encoding function as ENC() and the corresponding decoding function as DEC(). Let m 0, m 1,..., m t be the input to ENC, then ENC computes a codeword of ength n, (s 1,..., s n ), as foows: It constructs a poynomia of degree-t, f(x) = m 0 + m 1 x m t x t. It then computes s i = f(i). We use the foowing syntax for ENC: (s 1, s 2,..., s n ) = ENC(m 0, m 1,..., m t ). Each eement of the codeword is computed as a inear combination of the t + 1 input data eements, such that every subset of (t + 1) eements from the codeword uniquey determine the input data eements. Simiary, knowedge of any t + 1 eements from the codeword suffices to determine the remaining eements of the codeword. The decoding function DEC can be appied as ong as t + 1 eements from a codeword are avaiabe. A RS code is capabe of error correction and detection. The task of error correction is to find the error ocations and error vaues in a received vector. On the other hand, error detection means an indication that errors have occurred, without attempting to correct them. We reca the foowing we known resut from coding theory. DEC can correct up to c Byzantine error and simutaneousy detect up to additiona d Byzantine errors in a vector of ength N (where N n) if and ony if N t 1 2c + d. In our protocos, we may invoke DEC on a vector of ength N n with specific vaue of c and d. If c, d and N satisfy the above reation, then DEC returns back the correct data eements corresponding to the vector; otherwise DEC returns faiure. 2.1 Muti-vaued A-cast Protoco With the above toos, we are now ready to present our muti-vaued A-cast protoco, caed Muti-Vaued-Acast. We assume that the sender S has a message m containing bits that he woud ike to communicate to a the parties in P identicay. Our protoco is structured into two phases, (a) S-dependent Phase and (b) S-independent Phase. In the 5

6 S-dependent phase, S proves that it has communicated the same message to at east a set of 2 parties, say CORE. The S-dependent phase, as the name suggests, demands S to perform some specia roes. For an honest S, this phase wi aways be competed successfuy. However, a corrupted S may choose not to perform his actions and therefore this phase may not be terminated for a corrupted S. The second phase, caed S-independent phase is initiated upon competion of the first phase. If S successfuy proves the existence of some CORE in the first phase, then the parties in CORE propagates their common message to the remaining parties without any hep from S. In the first phase, S communicates his message m to every party over private channe. Upon receiving a message from S, a party appies ENC on the message to get a codeword and communicates eements of the codeword to different party. Intuitivey, the parties here check if they received the same message from S. They A-cast [Bra84] their responses. Based on the response of the parties, a consistency graph is constructed by the parties individuay. S now finds a specia structure in the graph which essentiay proves that there is a set of at east 2t + 1 parties, CORE, to whom he indeed communicated same message. On finding such a structure, S A-casts the same and a other parties can verify if indeed such structure exists in their individua graph. In this process, a the (honest) parties agree on CORE and proceed to second phase. The agorithm for finding (n, t)-star and an important observation are combined inteigiby in order to find the specia structure in a graph. Very abstracty, the observation is that if S is honest then eventuay, the set C of an (n, t)-star wi contain at east t + 1 honest parties. A forma proof in support of this observation wi appear in Lemma 2.3. In the second phase, the parties uses error correction and detection property of RS code to compute and agree on the common message of the parties in CORE. We now present the protoco in Figure 2 and subsequenty prove its properties. Lemma 2.2 The honest parties in CORE hod same message of ength. If S is honest then the message is S s message. Proof: Reca that CORE is the E component of a quadrupe (C, D, F, E) such that (C, D) is an (n, t)-star and every party in F has at east t + 1 neighbors in C and every party in E has at east 2t + 1 neighbors in F. We now argue that these conditions impy that the parties in E and therefore CORE hod same message of ength. First we prove that the honest parties in C hod the same message of ength. We start with recaing that D contains at east t + 1 honest parties and every P i C is neighbor of every party in D. Let {P i1,..., P iα } be the set of α honest parties in D, where α t + 1. Then for every P i in C, s iik is same as s ik i k of a k = [1, α]. Therefore the codewords corresponding to the messages of the honest parties in C are same at east at t + 1 ocations corresponding to the identities of the honest parties in D. Since the codewords beong to (n, t + 1) RS code, the messages of the honest parties in C are same. Let the common message be m, m =. Let (s 1,..., s n ) = ENC(m 0, m 1,..., m t ), where m = m 0 m 1..., m t. Now we show that every honest party P i F hods s i. Reca that P i has at east t + 1 neighbors in C in which at east one is honest, say P j. This impies s ii of P i is same as s ji of P j. However, s ji = s i, since P j hods m. Hence s ii = s i. Therefore every honest P i in F hods s i which is same as s ii. Finay, we show that every honest P i E hods m. Reca that P i has at east 2t + 1 neighbors in F in which at east t + 1 are honest. Let {P i1,..., P iα } be the set of α honest parties in F, where α t + 1. Then s iik of P i is same as s ik i k of every honest P ik for k = [1, α]. Now s ik i k of P ik is same as s ik. Therefore the codeword corresponding to the message of P i E matches with (s 1,..., s n ) at east at t + 1 ocations corresponding to the identities of the honest parties in F. This impies the codeword of P i is identica to (s 1,..., s n ), since they beong to (n, t + 1) RS code. Hence P i E hods m. This competes the proof for the first part of the emma. The second part of the emma is easy to prove. To prove the emma beow, we wi show that when S is honest then eventuay an (n, t)-star can be found such that the set C wi contain at east t + 1 honest parties. This observation is very crucia and is at the heart of our protoco. Lemma 2.3 If S is honest, then a the parties terminate S-dependent Phase, after agreeing on CORE. Proof: If S is honest, then he sends same message m to a the parties. Therefore, a honest parties generate same codeword, (s 1,..., s n ) = ENC(m 0,..., m t ), such that m = m 0 m 1... m t. Therefore eventuay there wi be an edge between every pair of honest parties. This impies that there wi be a cique of size at east 2t + 1 eventuay. This guarantees that S wi eventuay find at east one (n, t)-star in G S. Now we show that S wi eventuay find a quadrupe (C, D, F, E) such that (C, D) is an (n, t)-star and every party in F has at east t + 1 neighbors in C and 6

7 Figure 2: Error-free Muti-vaued A-cast with Optima Communication Compexity. S-dependent Phase: Code for S. 1. S sends his message m to every P i. Code for every P i incuding S. Code for S. Protoco Muti-Vaued-Acast(S,m) 1. On receiving message m i, divide the bit message m i into t + 1 bocks, m i0,..., m it, each containing (assume this to be an integer for simpicity) bits. Compute (s i1,..., s in ) = ENC(m i0,..., m it ). 2. Send s ii to every party. Send s ij to P j for j = [1, n]. 3. On receiving s jj and s ji from P j, A-cast OK(P i, P j ) if s jj = s ij and s ji = s ii. 4. Construct a graph G i with the parties in P as the vertices. Add an edge (P j, P k ) in G i if OK(P j, P k ) and OK(P k, P j ) are received from the A-cast of P j and P k respectivey. 1. Upon every new receipt of some OK(, ), update G S. If a new edge is added to G S, then execute Find- STAR(G S ). Let there are α 0 distinct (n, t)-stars that are found in the past from different executions of Find-STAR(G S). Code for P i incuding S. (a) Now if an (n, t)-star is found from the current execution of Find-STAR(G S) that is distinct from a the α (n, t)-star obtained before, do the foowing: i. Ca the new (n, t)-star as (C α+1, D α+1 ). ii. Create a ist F α+1 as foows: Add P j to F α+1 if P j has at east t + 1 neighbors in C α+1 in G S. iii. Create a ist E α+1 as foows: Add P j to E α+1 if P j has at east 2t + 1 neighbors in F α+1 in G S. iv. For every γ, with γ = 1,..., α update F γ and E γ : A. Add P j to F γ, if P j F γ and P j has at east t + 1 neighbors in C γ in G S. B. Add P j to E γ, if P j E γ and P j has at east 2t + 1 neighbors in F γ in G S. (b) If no (n, t)-star is found or an (n, t)-star that has been aready found in the past is obtained, then execute step (a).iv(a-b) to update existing F γ s and E γ s. (c) Now et β be the first index among aready generated {(E 1, F 1 ),..., (E δ, F δ )} such that both E β and F β contains at east 2t + 1 parties (Note that if step (a) is executed, then δ = α + 1; ese δ = α). Assign CORE = E β and A-cast (C β, D β, E β, F β ). 1. Assign CORE = E β, when a the foowing events occur: (a) (C β, D β, E β, F β ) is received from the A-cast of S; (b) (C β, D β ) becomes a vaid (n, t)-star in G i; (c) every party P j F β has at east t + 1 neighbors in C β in G i ; and (d) every party P j E β has at east 2t + 1 neighbors in F β in G i. S-independent Phase: Code for P i incuding S. 1. If CORE is constructed and P i CORE, then assign s i = s ii. 2. If CORE is constructed and P i CORE, then assign s i to be the vaue s ji that is received from at east P j s in CORE. 3. Send s i to a the parties. 4. On receiving 2t r, r 0, s j s appy DEC with c = r and d = t r, if DEC return faiure, then wait for more vaues. If DEC returns data eements m 0,..., m t, then output m = m 0 m 1... m t, where denotes concatenation. 7

8 every party in E has at east 2t + 1 neighbors in F. To prove this we start with proving that an honest S wi eventuay find an (n, t)-star such that the set C wi contain at east t + 1 honest parties. For an honest S, eventuay the edges between each pair of honest parties wi vanish from the compementary graph G S. So the edges in G S wi be either (a) between an honest and a corrupted party OR (b) between two corrupted parties. Let β be the first index, such that (n, t)-star (C β, D β ) is generated in G S, when G S contains edges of above two types ony. Now, by construction of C β (see Agorithm Find-STAR), it excudes the parties in N (set of parties that are endpoints of the edges of maximum matching M) and T (set of parties that are triange-heads). An honest P i beonging to N impies that (P i, P j ) M for some P j and hence P j is corrupted (as the current G S does not have edge between two honest parties). Simiary, an honest party P i beonging to T impies that there is some (P j, P k ) M such that (P i, P j ) and (P j, P k ) are edges in G S. This ceary impies that both P j and P k are surey corrupted. So for every honest P i not in C β, at east one (if P i beongs to N, then one; if P i beongs to T, then two) corrupted party aso remains outside C β. As there are at most t corrupted parties, C β may excude at most t honest parties. Sti C β is bound to contain at east t + 1 honest parties. Now a honest parties wi be neighbors of the t + 1 honest parties in C β in G S. Therefore F β wi eventuay contain a the honest parties. Finay since a honest parties are neighbors of each other, E β wi contain a honest parties eventuay and therefore it is guaranteed to contain at east 2t + 1 parties. Hence we proved that S can find a quadrupe (C, D, F, E) eventuay such that (C, D) is an (n, t)-star and every party in F has at east t + 1 neighbors in C and every party in E has at east 2t + 1 neighbors in F. S now A-casts the quadrupe. We now argue that every honest party wi find (C, D, F, E) in their graphs and agree on the same. Though the graphs are constructed and maintained by parties individuay in their oca memory, it is aways guaranteed that if an edge appears in the graph of an honest party, then the edge wi eventuay appear in the graphs of the other honest parties. This is ensured since the graphs are updated based on the responses of the parties that are A-casted. The termination and correctness of A-cast guarantee that if the A-cast is terminated by some honest party with some output then eventuay every honest party wi terminate with the same output. The above argument aso shows that if some honest party agree on CORE, then eventuay a honest parties wi aso agree on the same. So we proved that a the honest parties wi terminate S-dependent Phase, after agreeing on CORE = E. Lemma 2.4 If the honest parties initiate S-independent Phase, then they wi terminate the phase with the common message of the parties in CORE as the output. Proof: An honest party initiates S-independent Phase, if he agrees on CORE. By Lemma 2.2, a the honest parties in CORE hod common message, say m of ength and therefore same codeword (s 1,..., s n ) = ENC(m 0, m 1,..., m t ), where m = m 0 m 1..., m t. Then every honest P i in CORE aready hods s i, the ith eement in the codeword. Every party P i not in CORE woud receive s i from the t + 1 honest parties of CORE. Therefore every honest P i wi eventuay hod the ith component of the codeword. Now every P i send his s i to every other party. Now on receiving at east 2t r, 0 r t s j s, party P i appies DEC with c = r and d = t r. Note that c + d = t, where t is the maximum number of corruption. Therefore if there are more than r wrong vaues (sent by Byzantine corrupted parties), DEC wi return faiure. However for at east one vaue of r, 0 r t, there wi be at most r errors in the received vector and then the message can be reconstructed back successfuy. This technique has been previousy used in [CR93, Can95]. They ca it as Onine Error Correction. Theorem 2.2 Muti-Vaued-Acast is an A-cast protoco satisfying Definition 1.1. Proof: We first consider the case of an honest S. By Lemma 2.3, for an honest S a the parties terminate S-dependent Phase, after agreeing on CORE. By Lemma 2.2, the honest parties in CORE hod the message of S, i.e. m. By Lemma 2.4, a honest parties wi terminate with the common message of CORE as the output, which is m. For a corrupted S, a we need to show is that if some honest party terminates with message m, then every other honest party do the same. Let P i be the first honest party to terminate the protoco with m as output. Then P i must have agreed on CORE and the parties in CORE hods m. Then every other honest party wi agree on the same CORE and eventuay terminate with m as the output (by Lemma 2.4). Theorem 2.3 Muti-Vaued-Acast communicates O(n) bits and invokes O(n 2 og n) A-cast protoco for singe bit. 8

9 Proof: S communicates his message m, m = to a the parties. This requires n bits of communication. Every party P i sends two vaues s ii and s ij to every other party P j. The vaues are bits ong each. Therefore in tota there are O(n2 ) = O(n) bits of communication. S A-casts (C, D, F, E). Each set in the quadrupe can be represented by an n ength bit vector. Therefore 4n invocations to A-cast protoco for singe bit are required. Finay every party may A-cast OK signa for every other party. Each OK signa incudes identities of two parties that can be represented by 2 og n bits. Therefore O(n 2 og n) invocations to A-cast protoco for singe bit are required. We note that for an (n, t + 1) RS code, the fied F = GF (2 c ) in which the code is defined shoud satisfy n 2 c or og n c. In our case c = (reca that m is divided into t + 1 parts each containing bits). Therefore og n (t + 1) og n. Finay using Bracha s A-cast [Bra84], the communication compexity of our protoco turns out to be O(n + n 4 og n). So for a n 3 og n, our protoco achieves optima communication bound of Ω(n) bits. 3 Error-free ABA with Optima Communication Compexity In this section, we present our ABA protoco. We use our muti-vaued A-cast protoco Muti-Vaued-Acast from the previous section as one of the sub-protocos. Simiar to Muti-Vaued-Acast that uses A-cast protoco for singe bit, our new ABA uses existing error-free ABA for singe bit as another sub-protoco. In fact we use a very we-known asynchronous primitive caed Agreement on Common Subset (ACS) introduced by [BKR94] that uses ABA for singe bit as back box. We reca that the ony error-free ABA is due to [ADH08]. We wi use the foowing notation for invoking Muti-Vaued-Acast. Notation 3.1 By saying that P i Muti-casts M, we mean that P i as a sender, initiates Muti-Vaued-Acast protoco with M as the message. Simiary P j receives M from the Muti-cast of P i wi mean that P j terminates the execution of Muti-Vaued-Acast protoco initiated by P i and outputs M. By the property of Muti-Vaued-Acast, if some honest party P j terminates the Muti-Vaued-Acast protoco of some sender P i with M as the output, then every other honest party wi eventuay do so, irrespective of the behavior of the sender P i. Agreement on a Common Subset (ACS). Consider the foowing scenario. The parties in P are asked to A- cast (or Muti-cast) some vaue. Whie the honest parties in P wi eventuay execute the A-cast (Muti-cast), the corrupted parties may or may not do the same. So the (honest) parties in P want to agree on a common set T P, with T = 2, such that A-cast (Muti-cast) of each party in T wi be eventuay terminated by the (honest) parties in P. For this, the parties use ACS primitive presented in [BKR94]. The ACS protoco uses n instances of ABA for singe bit. For the sake of competeness, the protoco is provided in Appendix A. 3.1 Muti-vaued ABA Protoco Given the above sub-protocos, our ABA is very simpe. Every party P i on having a message m i of ength, computes an n ength codeword (s i1,..., s in ) = ENC(m i0,..., m it ) where m i0... m it. P i Muti-casts s ii. Using ACS, the parties then agree on some subset of 2 parties, say X whose Muti-casts wi be terminated eventuay. Every party then verifies if the vaues Muti-casted by the parties in X match with their corresponding eements of the codeword and then A-cast their response. The parties again agree on some subset of 2t + 1 parties using ACS, say Y. Based on the responses of the parties in Y and the vaues Muti-casted by the parties in X, the agreement is reached. Note that we use Muti-cast for the eements of the codewords (i.e. s ii s) and A-cast for the responses. The reason is that s ii s are message dependent and therefore can be arbitrariy arge. Therefore by appropriatey setting the vaue of, we can impement Muti-casting of s ii vaues in O(n) overa compexity. However, we wi see from the protoco given beow, the response vector wi be aways n ength bit vector. Therefore, using Muti-cast for this case wi worsen the compexity, as compared to the case when A-cast of Bracha is used for the same purpose. The protoco is now presented in Figure 3 and its properties are proved subsequenty. Theorem 3.1 Protoco Muti-Vaued-ABA is an ABA protoco. 9

10 Figure 3: Error-free Muti-vaued ABA with Optima Communication Compexity. Code for P i. Protoco Muti-Vaued-ABA() 1. On having message m i, divide the bit message m i into t + 1 bocks, m i0,..., m it, each containing (assume this to be an integer) bits. Compute (s i1,..., s in ) = ENC(m i0,..., m it ). 2. Muti-cast s ii. 3. Participate in an instance of ACS to agree on a common subset of 2t + 1 parties, X whose Muti-cast wi be eventuay terminated by a honest parties. 4. Construct a binary vector V i of ength n. Assign V i [j] = 1, if P j X and s ij = s jj where s jj received from the Muti-cast of P j. Otherwise assign V i[j] = A-cast V i. 6. Participate in an instance of ACS to agree on a common subset of 2t + 1 parties, Y whose A-cast wi be eventuay terminated by a honest parties. 7. Check if there are at east t + 1 parties in Y, whose vectors are identica and have at east t s. Let {i 1,..., i i+1} X be the t + 1 minimum indices where they a have 1 s. If there is no such set of t + 1 parties in Y, then {i 1,..., i i+1 } be the t + 1 minimum indices in X. Then appy DEC on s i1,i 1,..., s i i and et m 0, m 1,..., m t be the data returned by DEC. Then output m = m 0... m t. Proof: The termination is guaranteed due to the termination properties of Muti-Vaued-Acast, A-cast protoco of Bracha [Bra84] and ACS (whose termination is guaranteed due to the termination of the underying ABA for singe bit). More specificay, since Muti-Vaued-Acast initiated by the honest parties wi aways eventuay terminate, the set X wi be agreed among the parties by the termination of ACS. Simiary, since A-cast (of Bracha) initiated by the honest parties wi aways eventuay terminate, the set Y wi be agreed among the parties by the termination of ACS. Once X and Y are agreed, the rest is oca computation. Therefore termination of Muti-Vaued-ABA is guaranteed. We now argue about the correctness of Muti-Vaued-ABA. First we show that a the honest parties wi agree on the same message. This foows from the fact that a the honest parties agree on {i 1,..., i } X in the ast step of the protoco. Furthermore, by the correctness property of Muti-Vaued-Acast, a the honest parties aso agree on the vaues Muti-casted by the parties in {P i1,..., P i }. Our caim now foows triviay. We now consider the case when a the honest parties start with same input message m of ength and argue that a honest parties wi agree on m eventuay. If a the honest parties start with m, then they generate (s 1,..., s n ) = ENC(m 0,..., m t ) ocay, where m = m 0... m t. Every honest party P i then Muti-casts s i. By the property of Muti-Vaued-Acast, a the parties wi receive the same vaue Muti-casted by the parties in X. Therefore the honest parties in Y wi have identica V i vectors. Furthermore the V i vectors wi have 1 s at east at t + 1 ocations corresponding to the parties in X who Muti-casted correct vaue from the codeword (s 1,..., s n ). So {i 1,..., i } X in the ast step of the above protoco denotes t + 1 identities of the parties in X (having t + 1 minimum indices) who Muti-casted correct vaue from the codeword (s 1,..., s n ). Therefore DEC when appied on the vaues Muti-casted by the parties {P i1,..., P i } wi return m 0, m 1,..., m t such that m = m 0... m t. Theorem 3.2 Protoco Muti-Vaued-ABA communicates O(n) bits, invokes O(n 3 og n) instances of A-cast for singe bit and invokes 2n instances of ABA for singe bit. Proof: Every party Muti-casts bits. This requires a tota communication of O(n) bits and O(n3 og n) invocations to A-cast for singe bit. Later every party A-casts an n ength binary vector. Therefore in tota n 2 invocations to A-cast for singe bit is required. Finay two invocations to ACS cas for 2n instances of ABA for singe bit. To make the underying protoco Muti-Vaued-Acast work correcty, we require (t + 1) og n. Reca that when the input message size for Muti-Vaued-Acast is, then we require that () og n. In our ABA protoco, the input to Muti-vaued-Acast is. Therefore we have (t + 1) og n (t + 1)2 og n for our ABA. 10

11 4 Error-free BA and BC with Optima Communication Compexity Here we present our new muti-vaued BA and BC protoco. We first present a BA protoco. A BC protoco with same compexity of the BA protoco can be achieve by etting the sender send the message to a the parties and then BA can be run to reach agreement. This is the standard reduction in synchronous settings from BA to BC [Lyn96]. In our BA protoco, we use the inear error correcting code and the agorithm for (n, t)-star presented in Section 2. We aso use existing BC protoco for singe bit with optima compexity of O(n 2 ) bits [BGP09, CW92]. Our BA protoco foows the idea of Muti-Vaued-Acast. We now present the protoco in Figure 4 and subsequenty prove the properties. Figure 4: Error-free Muti-vaued BA with Optima Communication Compexity. Code for P i. Protoco Muti-Vaued-BA() 1. On having message m i, divide the bit message m i into t + 1 bocks, m i0,..., m it, each containing (assume this to be an integer) bits. Compute (s i1,..., s in) = ENC(m i0,..., m it). 2. Send s ii to every party. Send s ij to P j for j = [1, n]. 3. Construct a binary vector V i of ength n. Assign V i[j] = 1, if s ij = s jj and s ii = s ji where s jj and s ji are received from P j. Otherwise assign V i [j] = Broadcast V i using BC protoco for singe bit. 5. Construct graph G i using parties in P as the vertices. Add edge (P j, P k ) if V j [k] = 1 and V k [j] = 1. Execute Find-STAR(G i). If star-not-found is returned, then set b i = 0. Ese et (C i, D i) be the (n, t)- star returned by Find-STAR. Let F i be the set of parties who have at east t + 1 neighbors in C i in graph G i. Let E i be the set of parties who have at east 2t + 1 neighbors in F i in graph G i. If F i 2t + 1 and E i 2t + 1, then set b i = 1, ese set b i = Broadcast ony b i when b i = 0; ese broadcast b i and (C i, D i, F i, E i ) using BC protoco for singe bit. 7. If t + 1 b j s are zero, then agree on some predefined message m of ength. Ese et α be the minimum index of the party where b α = 1 and (C α, D α, F α, E α ) be such that (C α, D α ) is an (n, t)-star in G i, every party in F α has at east t + 1 neighbors in C α and every party in E α has at east 2t + 1 neighbors in F α. Assign CORE = E α. 8. Assign s i to be the vaue s ji received from the majority of the parties in CORE. 9. Send s i to every party. 10. Let (s 1,..., s n ) be the vector where s j is received from P j. Appy DEC on (s 1,..., s n ) with c = t and d = 0. Let m 0, m 1,..., m t be the data returned by DEC. Output m = m 0... m t. Lemma 4.1 The honest parties in CORE hod same message of ength. The proof of the above emma competey foow from the proof of Lemma 2.2. Lemma 4.2 If a honest parties start with same input m, then a the parties wi agree on CORE, CORE 2. Proof Sketch: The proof here foows from the proof of Lemma 2.3. Briefy, when a honest parties start with same input, every pair of honest parties wi have edge between them. In other words, the edges in the compementary graph wi be either (a) between an honest and a corrupted party OR (b) between two corrupted parties. Therefore foowing the argument given in Lemma 2.3, C component of an (n, t)-star wi contain at east t + 1 honest parties, which subsequenty wi ead to the construction of F and E with size at east 2t + 1. Athough it is not guaranteed that a honest parties find same quadrupe (C, D, F, E), but it is ensured that they wi find some quadrupe. So the honest parties never agree on predefined m in this case. Now since a the parties broadcast their quadrupe, it is easy to reach agreement on a vaid quadrupe which the parties do by seecting the one broadcasted by the party with minimum index. Therefore a the parties wi agree on CORE. 11

12 Lemma 4.3 If CORE is agreed, a honest parties output the common message of the parties in CORE. Proof Sketch: By Lemma 4.1, a honest parties in CORE hod same message, say m. The proof now foows from the proof of Lemma 2.4. We sti brief the proof here. Let (s 1,..., s n ) = ENC(m 0,..., m t ), where m = m 0... m t. First note that a honest party in CORE hod m and therefore the codeword (s 1,..., s n ). Now every party P i wi receive s i correcty as majority of the parties in CORE are honest and they wi send s i to P i. Once every honest P i hods correct s i, he sends that to everybody. Therefore a party wi receive n vaues from n parties in which at most t can be wrong (sent by Byzantine corrupted party). However, DEC of (n, t + 1) RS code with n = 3t + 1 aows to correct t errors. Therefore DEC wi return m 0,..., m t such that m = m 0... m t. Theorem 4.1 Muti-Vaued-BA is a BA protoco. Proof: If CORE is agreed, then a honest parties wi output the common message of the parties in CORE (by Lemma 4.3). If CORE is not agreed, then there must be at east t + 1 parties who broadcasted b i = 0. Since b i s are broadcasted, a honest parties wi agree on predefined m of ength. So agreement is aways achieved at the end. Now if a the honest parties start with same input message m, then they wi agree on CORE (by Lemma 4.2) and output m at the end (by Lemma 4.3). Theorem 4.2 Muti-vaued-BA communicates O(n) bits and invokes O(n 2 ) broadcast protoco for singe bit. Proof: Every party P i sends two vaues s ii and s ij to every other party P j. The vaues are bits ong each. Therefore in tota there are O(n2 ) = O(n) bits of communication. Every party P i broadcasts n-ength binary vector V i, a bit b i and quadrupe (C i, D i, F i, E i ). Each set in the quadrupe can be represented by n-ength bit vector. Therefore every party invokes 5n + 1 instances of broadcast for singe bit. This eads to tota O(n 2 ) instances of broadcast for singe bit. We note that for an (n, t + 1) RS code, the fied F = GF (2 c ) in which the code is defined shoud satisfy n 2 c or og n c. In our case c = (reca that m is divided into t + 1 parts each containing bits). Therefore og n (t + 1) og n. Finay using bit optima broadcast protocos of [BGP09, CW92] (they require O(n 2 ) bits of communication), the communication compexity of our protoco turns out to be O(n + n 4 ). So for a n 3, our protoco achieves optima communication bound of Ω(n) bits. 5 Concusion In this paper we present first ever error-free, asynchronous muti-vaued A-cast and ABA protocos with optima communication compexity and faut toerance. Our protocos are reduction-based. Our reductions are constant time and invokes equa or ess number of protocos for singe bit as compared to existing reductions with error probabiity [PR10, PR11]. Using our technique in asynchronous settings, we aso present new reduction for error-free mutivaued BA and BC protocos that are constant-round and cas for ony O(n 2 ) instances of protoco for singe bit. This can be compared with the existing error-free reduction of [LV11] which cas for round compexity of O( +n 2 ) and O(n 2 + n 4 ) invocations to existing protoco for singe bit. In [LV11], the communication optimaity is achieved for = Ω(n 6 ). For our reduction we show that for a = Ω(n 3 ) the reduction achieves optimaity. An important open question is to see whether we can achieve muti-vaued protocos with ess number of invocations to protocos for singe bit in comparison to what we provide in this paper. Aso it is important to improve the compexity of error-free protocos for singe bit. In the case of BA, BC and A-cast, optima communication compexity has been achieved [BGP09, CW92, Bra84]. However the same is not the case for error-free ABA. The ony error-free ABA is due to [ADH08] that runs in O(n 2 ) time and requires communication of O(n 8 og n) bits and A-cast of same number of bits. We observe that the running time of the protoco can be brought down by a factor of n and the communication compexity by a factor of n 2. But as mentioned in [ADH08], it is sti a major open probem to design a constant time protoco with good communication compexity or even to prove whether such protoco exists or not. 12