Subject: Schedule update (and today's notes) NOTE schedule changes (``Plan C''): 1. Raise more HW4 issues ASAP, via email. 2. Class meetings on remaining Chapter 5 and HW4 issues, and on review: Wednesday, March 6, 11 a.m.-12:15 p.m. Thursday, March 7, usual time 3. HW4 due: Friday, March 8, 5 p.m. 4. Midterm: Tuesday, March 19, usual time 5. 284 exam decision or arrangement still pending ------------------------ Agenda: Bivalence proof of the rounds lower bound *Algorithms* for Byzantine agreement (keep 5.13, 5.14 in mind!) ------------------------ Aguilera-Toueg bivalence proof of need for f+1 rounds: Setting: Synchronous, 2 possible candidate values, f-resilient *Define* valences in terms of legal continuations with at most one crash per round Theorem: If n > f+1, then f rounds are not enough. Proof: Suppose otherwise. Wlog, assume f > 0. Lemma 1: There is a bivalent initial configuration. Lemma 2: Every bivalent configuration with fewer than f-1 already dead has a bivalent immediate successor. (Conclusion: f-1 rounds can lead to a bivalent configuration.) Lemma 3: Cannot go from bivalence to consensus in just the last round. Proof of Lemma 1: All 0's: 0-valent; all 1's: 1-valent. Therefore enough: For input configurations, changing a single input cannot lead to disjoint valence. Reason is common successor: Crash changed processor at very start of round 1. Proof of Lemma 2: Consider the no-crash immediate successor. If bivalent, then done. Otherwise, there is a 1-crash immediate successor with the *opposite* valence. Therefore enough: Changing a crash by a single delivery cannot lead to disjoint (i.e., opposite) valence. Reason is common ``grand''successor: Crash delivery recipient at very start of following round (if not already dead). Proof of Lemma 3: Much like proof of Lemma 2: Consider the no-crash successor. There is 1-crash successor with *opposite* consensus. Therefore enough: Changing a crash by a single delivery leads to the same consensus. Reason is that *some* live processor doesn't hear about the change (our one use of the hypothesis n > f+1). ------------------------ EIG tree: depth 0: 1st-hand info (own input value) depth 1: 2nd-hand info (direct claims by others about theirs) depth 2: 3rd-hand info ... depth f: (f+1)st-hand info depth f+1: (f+2)nd-hand info Take f+1 rounds to collect all this, straightforwardly, postponing all ``interpretation''. Arrange in tree according to previous handlers. (Top edge indicates originator; bottom edge indicates who told you.) Omit cycles of handling (redundant/reduced reliability). Degrees: n, then n-1, ..., then n-f, then 0 Interpretation/evaluation/resolution: Majority rule, starting from leaves (Garbage or no majority ==> use prearranged default v0.) (So only values at leaves are needed from the gathering.) Each settle on resolved value at root. ------------------------ Analysis: Recall that everyone builds EIG tree level by level, as he hears about it. Recall that each edge corresponds to a transmitting process. Call an edge *reliable* if its corresponding process is reliable. Lemma 1: Edge reliable ==> raw value at its bottom is ``common'' (same for all reliable processors). (Duh.) Lemma 2: Edge reliable ==> *resolved* value at its bottom is common and same a raw one. Proof: Induction (deepest first). Base case (deepest (i.e., to leaf)): Clear from Lemma 1, by protocol. Induction case (picture helps): Majority of edges just *below* are reliable (since n - f - f > f), hence covered by induction hypothesis. Therefore, the majority of the children get (via honest sources) and keep (by induction hypothesis) the parent's common raw value. Therefore, the parent keeps its common raw value on resolution. Corollary: If the ``initial suggestion'' is common, then so is the final resolved value. Proof: Reliable processor sees at least n-f copies of it-- enough to win. Remark: This holds even if we use *fewer* rounds than f+1. The real worry is that the initial suggestion is *not* common. The danger: Some see a majority one way, some another. Possible if the reliable processors are evenly split and the faulty processors exploit the situation. Solution: Common consensus even on the *un*reliable ``suggestions.'' (That must be the whole *reason* to have arbitrated *resolved* values.) Lemma 3: If we use f+1 rounds, then every root-to-leaf path includes a reliable edge. (Duh.) Corollary: *All* the final resolved values at depth 1 are common, and hence so is the one at the root. Proof: Show for root of *every* subtree with a reliable path cover, by induction (i.e., deepest first). ------------------------ 2(f+1)-round protocol, with ``polynomial-size'' messages, n > 4f: For r = 1 to f+1 do: Each broadcast own current preference Each note majority (or default, if none) and its multiplicity Prearranged one-time king (e.g., p_r) broadcast his result New preference: Either own result or king's alleged one, depending on whether own was overwhelming (mult > n/2 + f) Initial preferences: Input values Claimed consensus: Final preferences Lemma 1: Any ``intermediate consensus'' endures. Proof: Each multiplicity is at least n-f > n/2 + f. Lemma 2: Do *get to* such a consensus when king is reliable. Proof: Suppose someone does *not* follow king, due to overwhelming majority. The *everyone* saw same majority he did. This includes the king, so everyone really *does* follow the king, one way or the other. Other worthy pursuits: Fewer ``value-size'' messages. Cut back down on the number of rounds and the relative size of n.