Sublinear Message Bounds of Authenticated Implicit Byzantine Agreement

This paper studies the message complexity of authenticated Byzantine agreement (BA) in synchronous, fully-connected distributed networks under an honest majority. We focus on the so-called implicit Byzantine agreement problem where each node starts with an input value and at the end a non-empty subset of the honest nodes should agree on a common input value by satisfying the BA properties (i.e., there can be undecided nodes)1. We show that a sublinear (in n, number of nodes) message complexity BA protocol under honest majority is possible in the standard PKI model when the nodes have access to an unbiased global coin and hash function. In particular, we present a randomized Byzantine agreement algorithm which, with high probability achieves implicit agreement, uses <Formula format="inline"><TexMath><?TeX $\tilde{O}(\sqrt {n})$?></TexMath><AltText>Math 1</AltText><File name="icdcn24-17-inline1" type="svg"/></Formula> messages, and runs in <Formula format="inline"><TexMath><?TeX $\tilde{O}(1)$?></TexMath><AltText>Math 2</AltText><File name="icdcn24-17-inline2" type="svg"/></Formula> rounds while tolerating (1/2 − ϵ)n Byzantine nodes for any fixed ϵ > 0, the notation <Formula format="inline"><TexMath><?TeX $\tilde{O}$?></TexMath><AltText>Math 3</AltText><File name="icdcn24-17-inline3" type="svg"/></Formula> hides a <Formula format="inline"><TexMath><?TeX $O(\operatorname{polylog}{n})$?></TexMath><AltText>Math 4</AltText><File name="icdcn24-17-inline4" type="svg"/></Formula> factor2. The algorithm requires standard cryptographic setup PKI and hash function with a static Byzantine adversary. The algorithm works in the CONGEST model and each node does not need to know the identity of its neighbors, i.e., works in the KT0 model. The message complexity (and also the time complexity) of our algorithm is optimal up to a <Formula format="inline"><TexMath><?TeX $\operatorname{polylog}n$?></TexMath><AltText>Math 5</AltText><File name="icdcn24-17-inline5" type="svg"/></Formula> factor, as we show a <Formula format="inline"><TexMath><?TeX $\Omega (\sqrt {n})$?></TexMath><AltText>Math 6</AltText><File name="icdcn24-17-inline6" type="svg"/></Formula> lower bound on the message complexity. We further extend the result to Byzantine subset agreement, where a non-empty subset of nodes should agree on a common value. We analyze several relevant results which follow from the construction of the main result.

To the best of our knowledge, this is the first sublinear message complexity result of Byzantine agreement. A quadratic message lower bound is known for any deterministic BA protocol (due to Dolev-Reischuk [JACM 1985]). The existing randomized BA protocols have at least quadratic message complexity in the honest majority setting. Our result shows the power of a global coin in achieving significant improvement over the existing results. It can be viewed as a step towards understanding the message complexity of randomized Byzantine agreement in distributed networks with PKI.