Optimal Extension Protocols for Byzantine Broadcast and Agreement

The problem of Byzantine Broadcast (BB) and Byzantine Agreement (BA) are of interest to both distributed computing and cryptography community. Often, these primitives require prohibitive communication and round complexity. The extension protocols have been introduced to handle long messages at the cost of small number of broadcasts for bit. The latter are referred to as seed broadcasts and the number of rounds in which seed broadcasts are invoked in an extension protocol denotes the seed round complexity of the protocol. In a setting with n parties and an adversary controlling at most t parties in Byzantine fashion, we present BB and BA extension protocols with and without trusted set-up assumption that are simultaneously optimal in multiple complexity measures. The best communication that an extension protocol can achieve in any setting is O(`n) bits for a message of length ` bits. The best achievable seed round complexity is one. The best achievable round complexity is O(n) for the setting t < n and constant otherwise. We now summarize our results below: – Without set-up assumption: In this setting t < n/3 is necessary. We present the first extension protocol that is simultaneously communication, round and seed round optimal. Both the round complexity and seed round complexity of the best known communication optimal extension protocol in this setting is Ω(n) that is neither round optimal nor seed round optimal. – With set-up assumption: With t < n/2, we present the first extension protocol that is simultaneously communication, round and seed round optimal. The round complexity and the seed round complexity of the best known protocol in this setting, though constant, are more than that of our protocol. In the most challenging setting of t < n, we present the first extension protocol that is simultaneously communication and round optimal. The best known protocol in this setting is only communication optimal. ∗The results of this paper appeared in preliminary form in [GP16] and [Pat11].