Multivalued Consensus: General Adversaries Require More Communication

Abstract

We study n-party fault-tolerant consensus against general (non-threshold) adversaries, which are characterized by adversary structures that enumerate every party set Z such that the adversary can corrupt every party in Z. An adversary structure 𝒵 satisfies the 𝒬^d condition if the complete party set [n] is not the union of d or fewer sets in 𝒵. Adversaries characterized by 𝒬^d-satisfying adversary structures generalize threshold adversaries which can corrupt at most t < n/d parties.
For every d ≥ 1, we describe an infinite family 𝒵_proj^{n,d} of 𝒬^d-satisfying n-party adversary structures based on finite projective geometry such that the byzantine adversaries characterized by this family cause error-free R-round protocols for interactive consistency on L-bit inputs (for agreement on every party’s L-bit input) to require Ω(Ln^{2+1/d}) bits of expected communication, if L = Ω(Rn^{-1/d} + 1). Likewise, 𝒵_proj^{n,d} causes byzantine agreement and broadcast to cost Ω(Ln^{1+1/d}) bits, if L = Ω(Rn^{1-1/d}). In every case, the lower bound is Ω(L_{out} ⋅ n^{1+1/d}) bits, where L_{out} is the length of the output. This is in contrast to the case of threshold adversaries, for which the baseline Ω(L_{out} ⋅ n) "every party must learn the output" lower bound is tight for all large L_{out} if the adversary can corrupt Θ(n) parties.
The adversary structure 𝒵_proj^{n,d} also makes Ω(Ln^{1+1/d}) bits of communication required for reliable broadcast and byzantine agreement in asynchronous networks, when L = Ω(n^{1-1/d}). Similarly, there is a family 𝒵_2-proj^{n,d} of 𝒬^d-satisfying adversary structures that cause asynchronous core set agreement to cost Ω(Ln^{2+1/d}) bits. These asynchronous complexity bounds hold against send-omission adversaries, even if the protocol uses cryptography. Their basis is that if a quorum of non-faulty parties agree on an output and terminate, then the messages they sent before terminating must suffice for the parties outside the quorum to also terminate with the same output. Surprisingly, if we do not require the parties to terminate (stop sending messages) after they output, then these lower bounds no longer hold. We show this by designing a non-terminating reliable broadcast protocol for general-omission adversaries that can for any parameter δ > 1 be tuned to cost (1 + 1/(δ-1))Ln + O(δ n²log(δ n)) bits, which is of independent interest. Lastly, we show how to obtain termination with O(L_out ⋅ n^{1+1/d} + n²log n) bits (assuming the 𝒬^d condition), and thus prove our asynchronous lower bounds tight for large L_out.