BFT Protocol Forensics
BFT Protocol Forensics
复制标题
DOI：
10.1145/3460120.3484566
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Peiyao Sheng;Gerui Wang;Kartik Nayak;Sreeram Kannan;P. Viswanath
中科院分区：
文献类型：
--
作者：
Peiyao Sheng;Gerui Wang;Kartik Nayak;Sreeram Kannan;P. Viswanath
拜占庭容错（BFT）协议允许一组副本达成共识，即使某些副本存在拜占庭故障。在不同的网络设置下，存在多种BFT协议来安全地容忍最优数量的故障t。然而，如果故障数量f超过t，安全性可能会被破坏。在本文中，我们从数学上对BFT协议的取证支持研究进行了形式化：我们的目标是以密码完整性尽可能多地识别恶意副本，并尽可能以分布式的方式进行。我们的主要结果是，BFT协议的取证支持在很大程度上取决于不影响协议安全性或复杂性的微小实现细节。着眼于流行的BFT协议（实用拜占庭容错协议PBFT、HotStuff、Algorand），我们准确地描述了它们的取证支持，表明每个协议都存在一些微小的变体，其取证支持差异很大。我们展示了LibraBFT（Diem加密货币的共识协议）强大的取证支持能力；我们在Diem客户端上实现的轻量级取证模块是开源的，并且正在积极考虑在Diem中部署。最后，我们表明，所有为在同步网络上通信的2t + 1个副本设计的安全BFT协议，其取证支持本质上是不存在的；这个不可能性结果适用于所有BFT协议，即使可以访问所有副本（包括拜占庭副本）的状态。
Byzantine fault-tolerant (BFT) protocols allow a group of replicas to come to consensus even when some of the replicas are Byzantine faulty. There exist multiple BFT protocols to securely tolerate an optimal number of faults t under different network settings. However, if the number of faults f exceeds t then security could be violated. In this paper we mathematically formalize the study of forensic support of BFT protocols: we aim to identify (with cryptographic integrity) as many of the malicious replicas as possible and in as distributed manner as possible. Our main result is that forensic support of BFT protocols depends heavily on minor implementation details that do not affect the protocol's security or complexity. Focusing on popular BFT protocols (PBFT, HotStuff, Algorand) we exactly characterize their forensic support, showing that there exist minor variants of each protocol for which the forensic supports vary widely. We show strong forensic support capability of LibraBFT, the consensus protocol of Diem cryptocurrency; our lightweight forensic module implemented on a Diem client is open-sourced and is under active consideration for deployment in Diem. Finally, we show that all secure BFT protocols designed for 2t+1 replicas communicating over a synchronous network forensic support is inherently nonexistent; this impossibility result holds for all BFT protocols and even if one has access to the states of all replicas (including Byzantine ones).