All You Need is DAG

Abstract

We present DAG-Rider, the first asynchronous Byzantine Atomic Broadcast protocol that achieves optimal resilience, optimal amortized communication complexity, and optimal time complexity. DAG-Rider is post-quantum safe and ensures that all messages proposed by correct processes eventually get decided. We construct DAG-Rider in two layers: In the first layer, processes reliably broadcast their proposals and build a structured Directed Acyclic Graph (DAG) of the communication among them. In the second layer, processes locally observe their DAGs and totally order all proposals with no extra communication. INTRODUCTIONThe amplified need in scalable geo-replicated Byzantine fault-tolerant reliability systems has motivated an enormous amount of study on the Byzantine State Machine Replication (SMR) problem [17,31]. Many variants of the problem were defined in recent years [28,32,43] to capture the needs of blockchain systems. To address the fairness issues that naturally arise in interorganizational deployments, we focus on the classic long-lived Byzantine Atomic Broadcast (BAB) problem [13,19], which in addition to total order, progress, and validity, guarantees eventual fairness. That is, all proposals by correct processes are eventually included.Up until recently, asynchronous protocols for the Byzantine consensus problem [13,16,26] have been considered too costly or complicated to be used in practical SMR solutions. However, two recent single-shot Byzantine consensus papers, VABA [1] and later Dumbo [35], presented asynchronous solutions with (1) optimal resilience, (2) expected constant time complexity, and (3) optimal quadratic communication and optimal amortized linear communication complexity (for the latter). In this paper, we follow this recent line of work and present DAG-Rider: the first asynchronous BAB protocol with optimal resilience, optimal round complexity, and optimal amortized communication complexity. In addition, given a perfect shared coin abstraction, our protocol does not use signatures and does not rely on asymmetric cryptographic assumptions. Therefore, when using a deterministic threshold-based coin implementation with an information theoretical agreement guarantee [14,34], the safety properties of our BAB protocol are post-quantum secure.Overview. We construct DAG-Rider in two layers: a communication layer and a zero-overhead ordering layer. In the communication layer, processes reliably broadcast their proposals with some meta-data that help them form a Directed Acyclic Graph (DAG) of the messages they deliver. That is, the DAG consists of rounds s.t. every process broadcasts at most one message in every round and every message has 𝑂 (𝑛) references to messages in previous rounds, where 𝑛 is the total number of processes. The ordering layer does not require any extra communication. Instead, processes observe their local DAGs and with the help of a little randomization (one coin flip per 𝑂 (𝑛) decisions on values proposed by different processes) locally order all the delivered messages in th...

Efficient Asynchronous Byzantine Agreement without Private Setups

“…2. Cipher broadcast (Line 7-10, [16][17][18][19][20][21][22][23][24][25][26]. In this phase, the dealer broadcasts its actual input encrypted by the key shared in the earlier phase, i.e., A(0).…”

“…-Committing phase-Seed aggregation (Line 1-4, [20][21][22][23][24].In this phase, each party invokes Deal to create a pvss script and send this script to the leader P L . When the leader receives pvss j from P j , it verifies the pvss using ek and checks if the weights of pvss j are all zeros but one at the j th position.…”

“…Recently, following the unprecedented demand of deploying BFT protocols on the Internet for robust and highly available decentralized applications, renewed attentions are gathered to implement more efficient asynchronous Byzantine agreements [3,24,29,21,28]. Nevertheless, asynchronous protocols have to rely on randomized executions to circumvent the seminal FLP "impossibility" result [20].…”

“…Nevertheless, asynchronous protocols have to rely on randomized executions to circumvent the seminal FLP "impossibility" result [20]. In particular, to quickly decide the output in expected constant time, many asynchronous protocols [15,30,29,13,12,3,28,21,24,17,9] essentially need common randomness, given which for free, one can construct optimally resilient asynchronous Byzantine agreements that are at least as efficient as using expected O(n 2 ) messages and constant running time [3,28,30,13].…”

“…For example, initialed by M. Rabin [32], it can directly assume that a trusted dealer uses a secret sharing scheme to distribute a large number of secrets among the participating parties before the protocol execution, which later can be collectively reconstructed by the parties to generate a sequence of random bits. Later, Cachin et al [13] presented how to construct a non-interactive threshold pseudorandom function (tPRF) assuming that a trusted dealer can faithfully share a short tPRF key, which now is widely used by most practical asynchronous BFT protocols including [3,24,29,28].…”