Exact Byzantine Consensus on Undirected Graphs under Local Broadcast Model

TL;DR

This paper establishes necessary and sufficient conditions for Byzantine consensus in undirected graphs under the local broadcast model, showing reduced network requirements compared to the classical point-to-point model, and extends results to hybrid models with equivocation.

Contribution

It provides a new characterization of network conditions for Byzantine consensus under local broadcast, lowering connectivity and degree requirements, and introduces a hybrid model for equivocation.

Findings

Consensus requires vertex connectivity ≥ ⌊3f/2⌋ + 1 and minimum degree ≥ 2f under local broadcast.

Local broadcast reduces network requirements compared to point-to-point communication.

Hybrid model characterizes the trade-off between equivocation and network robustness.

Abstract

This paper considers the Byzantine consensus problem for nodes with binary inputs. The nodes are interconnected by a network represented as an undirected graph, and the system is assumed to be synchronous. Under the classical point-to-point communication model, it is well-known [7] that the following two conditions are both necessary and sufficient to achieve Byzantine consensus among $n$ nodes in the presence of up to $f$ Byzantine faulty nodes: $n \ge 3f+1$ and vertex connectivity at least $2f+1$. In the classical point-to-point communication model, it is possible for a faulty node to equivocate, i.e., transmit conflicting information to different neighbors. Such equivocation is possible because messages sent by a node to one of its neighbors are not overheard by other neighbors. This paper considers the local broadcast model. In contrast to the point-to-point communication model, in the local broadcast model, messages sent by a node are received identically by all of its neighbors. Thus, under the local broadcast model, attempts by a node to send conflicting information can be detected by its neighbors. Under this model, we show that the following two conditions are both necessary and sufficient for Byzantine consensus: vertex connectivity at least $\lfloor 3f/2 \rfloor + 1$ and minimum node degree at least $2f$. Observe that the local broadcast model results in a lower requirement for connectivity and the number of nodes $n$, as compared to the point-to-point communication model. We extend the above results to a hybrid model that allows some of the Byzantine faulty nodes to equivocate. The hybrid model bridges the gap between the point-to-point and local broadcast models, and helps to precisely characterize the trade-off between equivocation and network requirements.

Tables

Table 1. Table 1 : This table illustrates which nodes in execution ℰ ℰ \mathcal{E} on network 𝒢 𝒢 \mathcal{G} (Figure 2 ) model the corresponding nodes in the three executions E 1 subscript 𝐸 1 E_{1} , E 2 subscript 𝐸 2 E_{2} , and E 3 subscript 𝐸 3 E_{3} on graph G 𝐺 G for proof of Lemma A.1 . The entries in red indicate faulty nodes in E 1 subscript 𝐸 1 E_{1} , E 2 subscript 𝐸 2 E_{2} , and E 3 subscript 𝐸 3 E_{3} .

		(Sets of) nodes in network $𝒢$
		$z$	$F^1$	$F^2$	$W$
Executions on graph $G$	$E_1$	$z$	$F^1$	$F^2$	$W_0$
	$E_2$	$z$	$F^1$	$F^2$	$W_1$
	$E_3$	$z$	$F^1$	$F^2$	$W_1$

Equations

$$Z_v$$

$$N_v$$

$$\left|N_v\cap F\right|$$

$$\le f-\lfloor f/2\rfloor -1$$

$$\le \lfloor f/2\rfloor .$$

$$Z_v$$

$$N_v$$

$$\phi =f-\left|T\right|.$$

$$\lfloor \frac{3(f-t)}{2}\rfloor +2t+1-\left|T\right|-\lfloor \frac{\phi }{2}\rfloor$$

$$=1+t+\lfloor \frac{f-t}{2}\rfloor +f-\left|T\right|-\lfloor \frac{f-\left|T\right|}{2}\rfloor$$

$$=1+t+\lfloor \frac{f-t}{2}\rfloor +\lceil \frac{f-\left|T\right|}{2}\rceil$$

$$\ge 1+t+\lfloor \frac{f-t}{2}\rfloor +\lceil \frac{f-t}{2}\rceil$$

$$=f-t+t+1$$

$$=f+1.$$

$$\left|N_v\cap F\right|$$

$$\le \phi -\lfloor \phi /2\rfloor -1$$

$$\le \lfloor \phi /2\rfloor .$$

Full text

This paper considers the local broadcast model. In contrast to the point-to-point communication model, in the local broadcast model, messages sent by a node are received identically by all of its neighbors. Thus, under the local broadcast model, attempts by a node to send conflicting information can be detected by its neighbors. Under this model, we show that the following two conditions are both necessary and sufficient for Byzantine consensus: vertex connectivity at least $\lfloor 3f/2\rfloor+1$ and minimum node degree at least $2f$. Observe that the local broadcast model results in a lower requirement for connectivity and the number of nodes $n$, as compared to the point-to-point communication model.

We extend the above results to a hybrid model that allows some of the Byzantine faulty nodes to equivocate. The hybrid model bridges the gap between the point-to-point and local broadcast models, and helps to precisely characterize the trade-off between equivocation and network requirements.

1 Introduction

This paper considers Byzantine consensus for nodes with binary inputs. The nodes are interconnected by a communication network represented as an undirected graph, and the system is assumed to be synchronous. Under the classical point-to-point communication model, it is well-known [7] that the following two conditions are both necessary and sufficient to achieve Byzantine consensus among $n$ nodes in the presence of up to $f$ Byzantine faulty nodes: $n\geq 3f+1$ and vertex connectivity at least $2f+1$. In the classical point-to-point communication model, it is possible for a faulty node to equivocate [4], i.e., transmit conflicting information to different neighbors. Such equivocation is possible because messages sent by a node to one of its neighbors are not overheard by other neighbors.

In contrast, in the local broadcast model [3, 14] considered in this paper, a message sent by any node is received identically by all of its neighbors in the communication network. Thus, under the local broadcast model, attempts by a node to equivocate (i.e., send conflicting information to its neighbors) can be detected by its neighbors.

This paper obtains tight necessary and sufficient conditions on the underlying communication network to be able to achieve Byzantine consensus under the local broadcast model. As summarized in Section 2, although there has been significant work [1, 3, 5, 6, 9, 10, 11, 12, 14, 15, 18, 22, 24, 25, 26, 28, 32] that uses either the local broadcast model or other models that restrict equivocation, tight necessary and sufficient conditions for Byzantine consensus under the local broadcast model have not been obtained previously. In particular, this paper makes the following contributions, some of which have been documented elsewhere [13, 20, 21] as well:

Necessary and sufficient condition: In Sections 4 and 5, we establish that, under the local broadcast model, to achieve Byzantine consensus, it is necessary and sufficient for the communication graph to have vertex connectivity at least $\left\lfloor{3f/2}\right\rfloor+1$ and minimum degree at least $2f$. Observe that the local broadcast model results in a lower connectivity requirement as compared to the ($2f+1$)-connectivity required under the point-to-point communication model. 2. 2)

Efficient algorithm: We constructively prove the sufficiency of the tight condition stated above by presenting an algorithm that achieves Byzantine consensus. This algorithm, however, is not efficient. For the case when vertex connectivity is at least $2f$, we have a more efficient algorithm, which is presented in the appendices. In Section 5.3, we present a tool used in the algorithm which exploits the $2f$-connectivity. Note that for $f=1,2$, the tight condition presented above implies vertex connectivity of 2 and 4, respectively (i.e., connectivity equal to $2f$ when $f=1,2$). 3. 3)

Hybrid model: In Section 6, we extend the above necessary and sufficient condition to a hybrid model wherein at most $t\leq f$ faulty nodes may have the ability to equivocate to their neighbors (i.e., the ability to send messages to each neighbor without being overheard by the other neighbors), while the remaining faulty nodes are restricted to local broadcast (i.e., their messages will be received identically by all the neighbors). The point-to-point communication model and the local broadcast model are both obtained as special cases of the hybrid model when $t=f$ and $t=0$, respectively. Thus, the hybrid model provides a bridge between those two models and helps to precisely characterize the trade-off between equivocation and network requirements.

2 Related Work

There is a large body of work on Byzantine fault-tolerant algorithms [2, 7, 16, 19, 23]. Here we focus primarily on related work that imposes constraints on a faulty node’s ability to equivocate.

Rabin and Ben-Or [25] considered a global broadcast model and showed that $n\geq 2f+1$ is both sufficient and necessary for consensus in a synchronous system. The local broadcast model considered in our work reduces to the global broadcast model when the network is a complete graph. The necessary and sufficient conditions obtained in this paper are (not surprisingly) equivalent to $n\geq 2f+1$ when the network is a complete graph. Clement et. al. [5] also considered non-equivocation in a complete graph under asynchronous communication. Our work obtains results for arbitrary incomplete graphs with synchronous communication.

The goal of a Byzantine broadcast algorithm is to allow a single source node to deliver its message reliably to all the other nodes. Prior work has explored such algorithms under the local broadcast model [3, 14, 15]. However, the results for Byzantine broadcast do not provide insights into the network requirements for Byzantine consensus problem considered in this paper.

There has been significant work on other similar models, sometimes called “partial broadcast”. To motivate these models, consider a network consisting of several Ethernet channels, with a subset of nodes $S_{i}$ being connected to channel $i$. Then, transmission by any node in $S_{i}$ on channel $i$ will be received by all the nodes in channel $i$. Each node may be connected to several different such channels. An Ethernet channel to which $h$ nodes are connected may be viewed as a $h$-hyperedge in a communication network represented by a hypergraph. Fitzi and Maurer [9] considered a network in which every subset of three nodes form a hyperedge, in addition to every subset of two nodes also forming a hyperedge (i.e., a complete (2,3)-uniform hypergraph). Ravikant et. al. [26] also considered a (2,3)-uniform hypergraph, but with only a subset of 3-hyperedges being present. Jaffe et. al. [12] gave asymptotically tight bounds for the number of $3$-hyperedges required in such graphs. Amitanand et. al. [1] considered a complete network wherein, for each faulty node $k$, the remaining nodes are partitioned such that transmission by the faulty node $k$ to any node is received identically by all the nodes in its partition. One key difference from our work is that we consider incomplete networks, whereas [1] assumes that each node can communicate directly with all the other nodes. Amitanand et. al. [1] considered an adversary structure that characterizes the set of nodes that may be simultaneously faulty, instead of using a threshold on the number of faults. Other work [6, 10, 11, 32] has explored the trade-off between reliability and privacy on partial broadcast networks.

Some prior work has explored a restricted class of iterative algorithms that achieve approximate Byzantine consensus under the local broadcast model [17, 34]. In particular, this class of algorithms is iterative in nature, with a state variable at each node being updated in each iteration as a linear interpolation of the states of selected neighbors. Due to the restriction on the algorithm behavior, the network requirements exceed the necessary and sufficient conditions shown in this paper. Additionally, these restricted algorithm structures yield only approximate consensus in finite time. Li et. al. [18] extended this line of work to a network consisting of 3-hyperedges and 2-hyperedges. Vaidya et. al. [27, 30, 31] have investigated the iterative algorithm structure in the point-to-point communication model.

3 System Model and Notation

We consider a synchronous system. The communication network interconnecting $n$ nodes is represented by an undirected graph $G=(V,E)$. Every node in the system knows graph $G$. Each node $u$ is represented by vertex $u\in V$. We will use the terms node and vertex interchangeably. Two nodes $u$ and $v$ are neighbors if and only if $uv\in E$ is an edge of $G$. For a set $S\subseteq V$, node $u$ is said to be a neighbor of set $S$ if $u\not\in S$ and there exists $v\in S$ such that $uv\in E$.

Each edge $uv$ represents a FIFO link between the two nodes $u$ and $v$. When a message $m$ sent by node $u$ is received by node $v$, node $v$ knows that $m$ was sent by node $u$. In Sections 4 and 5, we assume the local broadcast model wherein a message sent by a node $u$ is received identically and correctly by each node $v$ such that $uv\in E$ (i.e., by each neighbor of $u$). A hybrid model is considered later in Section 6.

A Byzantine faulty node may exhibit arbitrary behavior. We consider the Byzantine consensus problem assuming that each node has a binary input. The goal is for each node to output a binary value, satisfying the following conditions, in the presence of at most $f<n$ Byzantine faulty nodes.

Agreement: All non-faulty nodes must output the same value. 2. 2)

Validity: The output of each non-faulty node must be the input of some non-faulty node. 3. 3)

Termination: All non-faulty nodes must decide on their output in finite time.

• Paths in graph $G$:

A path is a sequence of nodes such that any two adjacent nodes in the sequence are neighbors in the graph.

• •

For $u,v\in V$, a $uv$-path $P_{uv}$ is a path between nodes $u$ and $v$. $u$ and $v$ are endpoints of path $P_{uv}$. Any node in path $P_{uv}$ that is not an endpoint is said to be an internal node of $P_{uv}$. All $uv$-paths have $u$ and $v$ as endpoints, by definition. Two $uv$-paths are node-disjoint if they do not have any internal nodes in common.

• •

For $U\subset V$ and a node $v\not\in U$, a $Uv$-path is a $uv$-path for some node $u\in U$. All $Uv$-paths have $v$ as one endpoint. Two $Uv$-paths are node-disjoint if they do not have any nodes in common except endpoint $v$. In particular, although two node-disjoint $Uv$-paths have endpoint $v$ in common, the other endpoints are distinct for the two paths.

• Fault-free paths:

A path is said to exclude a set of nodes $X\subset V$ if no internal node of the path belongs to $X$; however, its endpoints may potentially belong to $X$. A path is said to be fault-free if none of its internal nodes are faulty. In other words, a path is fault-free if it excludes the set of faulty nodes. Note that a fault-free path may have a faulty node as an endpoint.

• Degree and Connectivity:

The degree of a node $u$ is the number of $u$’s neighbors (i.e., the number of edges incident to $u$). Minimum degree of $G$ is the minimum over the degree of all the vertices in $G$. A graph $G$ is $k$-connected if $n>k$ and removal of less than $k$ nodes does not disconnect $G$. By Menger’s Theorem [33] a graph $G$ is $k$-connected if and only if for any two nodes $u,v\in V$ there exist $k$ node disjoint $uv$-paths. Another standard result [33] for $k$-connected graphs is that if $G$ is $k$-connected, then for any node $v$ and a set of at least $k$ nodes $U$ there exist $k$ node-disjoint $Uv$-paths.

4 Necessary Conditions under Local Broadcast

Theorem 4.1 below states the necessary conditions for Byzantine consensus under the local broadcast model. Section 5 presents a Byzantine consensus algorithm and constructively proves that the necessary conditions are also sufficient.

Theorem 4.1**.**

*If there exists a Byzantine consensus algorithm under the local broadcast model on graph $G$ tolerating at most $f$ Byzantine faulty nodes, then both the following conditions must be true:

(i) $G$has minimum degree at least $2f$, and

(ii) $G$is $(\left\lfloor{3f/2}\right\rfloor+1)$-connected.

Appendix A presents a proof of Theorem 4.1. Necessity of conditions (i) and (ii) in the theorem is proved separately in Lemmas A.1 and A.2, respectively. We use a state machine based approach [2, 7, 8] to prove Lemmas A.1 and A.2.

It should be easy to see that a complete graph consisting of $2f+1$ nodes satisfies the necessary conditions in Theorem 4.1 for any $f$. Figure 1 presents other examples of graphs that satisfy the necessary conditions. Figure 1(a) shows a cycle consisting of 5 nodes. For this graph, the minimum degree is 2, and the graph is 2-connected. Thus, the cycle satisfies the conditions in Theorem 4.1 for $f=1$. The graph in Figure 1(b) satisfies the necessary conditions when $f=2$.

Section 5 below proves that the above necessary conditions are also sufficient. Before proceeding to Section 5, let us consider the 5-node cycle in Figure 1(a) to build some intuition on why these conditions may be sufficient. Since $f=1$, we do not have $2f+1$ node-disjoint paths between every pair of nodes in the cycle in Figure 1(a). Despite lower connectivity, we can show a useful property. In particular, suppose that node 1 attempts to send a message $M$ to node 4, by transmitting it along two node-disjoint paths 1-2-3-4 and 1-5-4, respectively. That is, node 1 will send the message to nodes 2 and 5 (its neighbors) in a single transmission – local broadcast model allows node 1 to send its message to all its neighbors simultaneously. The neighbors 2 and 5 will then forward the message and subsequently, node 3 will forward the message received from node 2. Due to the local broadcast model, all neighbors of each node will receive its transmissions. Consider two cases:

• •

Case (i): The internal nodes (namely, 2, 3 and 5) on the two paths behave correctly: In this case, node 4 receives identical copies of the message along the two disjoint paths. Because $f=1$, node 4 can be certain that it has correctly received the message that was transmitted by node 1 (when $f=1$, internal nodes on at most one disjoint path may be faulty).

• •

Case (ii): Node 3 is faulty, and tampers the message received from node 2 before forwarding it to node 4: In this case, node 4 will not receive two identical message copies along the two disjoint paths. Therefore, node 4 cannot determine the message sent by node 1. However, in this case, node 2 is non-faulty. Node 2 correctly forwards message $M$ received from node 1 to node 3, and then observes that node 3 is forwarding a tampered message to node 4, not the correct message $M$. Node 2 can observe the faulty behavior of node 3 due to the local broadcast property – when node 3 sends the tampered message to node 4, node 2 receives it too, because node 2 is a neighbor of node 3.

Node 2 can now notify node 1 that node 3 is faulty. Of course, on receiving this notification, node 1 cannot be certain whether node 3 is indeed faulty, or node 2 is faulty and it is incorrectly accusing node 3 of misbehavior. However, node 1 can be certain that one of nodes 2 and 3 must be faulty. Because $f=1$, node 1 can then infer that the path 4-5-1 is fault-free. Thus, any messages received by node 1 from node 4 along the path 4-5-1 could not be tampered by the internal node on this path, namely, node 5. This allows node 1 to now receive messages transmitted by node 4 reliably.

The example above can be generalized to derive a similar capability for reliable communication in at least one direction between each pair of nodes. Although the algorithm presented next does not seem to explicitly utilize this property, it implicitly relies on such a behavior.

5 Byzantine Consensus Algorithm under Local Broadcast

Theorem 5.1 below states that the necessary conditions in Theorem 4.1 are also sufficient.

Theorem 5.1**.**

*Under the local broadcast model, Byzantine consensus tolerating at most $f$ Byzantine faulty nodes is achievable on graph $G$ if both the following conditions are true:

(i) $G$has minimum degree at least $2f$, and

(ii) $G$is $(\left\lfloor{3f/2}\right\rfloor+1)$-connected.

We prove correctness of Theorem 5.1 constructively by providing a Byzantine consensus algorithm (in Section 5.1) and showing its correctness (in Section 5.2).

5.1 Proposed Algorithm

Assume that graph $G$ satisfies the properties stated in Theorem 5.1. That is, $G$ has minimum degree at least $2f$ and is $(\left\lfloor{3f/2}\right\rfloor+1)$-connected. Pseudo-code for the proposed algorithm is presented below. To understand the description presented next, it will help the reader to read the corresponding steps in Algorithm 1 below.

• Initialization:

Each node $v\in V$ maintains a local state variable named $\gamma_{v}$, which is initialized to equal node $v$’s binary input.

• Phases of the algorithm:

Recall that we assume a synchronous system. The execution of the algorithm is divided into many phases, each phase corresponding to a distinct subset of nodes $F$, such that $F$ contains at most $f$ nodes. Each iteration of the For loop in Algorithm 1 corresponds to one phase of the algorithm. The set $F$ chosen in each phase is a candidate for the actual set of faults; however, set $F$ in only one of the phases will exactly equal the actual set of faulty nodes in the given execution. This is similar to the Byzantine consensus algorithm for directed graphs under the point-to-point communication model by Tseng and Vaidya [29]. However, the rest of the algorithm proceeds differently since we consider the local broadcast model.

• Step (a):

At the beginning of each phase, each node $v$ attempts to communicate its current value of $\gamma_{v}$ via “flooding”, as described soon. Any message transmitted during flooding has the form $(b,\Pi)$, where $b\in\mathinner{\left\{0,1\right\}}$ and $\Pi$ is a path. Flooding proceeds in synchronous rounds, with each node possibly forwarding messages received in the previous round, following the rules presented below. Flooding will end after $n$ rounds, as should be clear from the following description.

To initiate flooding of its $\gamma_{v}$ value, node $v$ transmits message $(\gamma_{v},\bot)$ to its neighbors, where $\bot$ represents an empty path. Each node in the network similarly initiates flooding of its own $\gamma$ value in step (a). If $v$ is faulty and does not initiate flooding, then non-faulty neighbors of $v$ replace the missing message with the default message of $(1,\bot)$. Therefore, we can assume that a value is indeed flooded by each node, even if it is faulty. When node $v$ receives from a neighbor $u$ a message $(b,\Pi)$, where $b\in\{0,1\}$ and $\Pi$ is a path, it takes the following steps sequentially. In the following note that $\Pi\operatorname{-}u$ denotes a path obtained by concatenating identifier $u$ to path $\Pi$.

1. (i)

If path $\Pi\operatorname{-}u$ does not exist in graph $G$, then node $v$ discards the message $(b,\Pi)$. Recall that each node knows graph $G$, and the message $(b,\Pi)$ was received by node $v$ from node $u$. 2. (ii)

Else if, in the current phase, node $v$ has previously received from $u$ another message containing path $\Pi$ (i.e., a message of the form $(b^{\prime},\Pi)$), then node $v$ discards the message $(b,\Pi)$. 3. (iii)

Else if path $\Pi$ already includes node $v$’s identifier, node $v$ discards the message $(b,\Pi)$. 4. (iv)

Else node $v$ is said to have received value $b$ along path $\Pi\operatorname{-}u$ and node $v$ forwards message $(b,\Pi\operatorname{-}u)$ to its neighbors. Recall that $v$ received message $(b,\Pi)$ from neighbor $u$.

Rules (i) and (ii) above are designed to prevent a faulty node from sending spurious messages. Recall that under the local broadcast model, all neighbors of any node receive all its transmissions. Thus, rule (ii) above essentially prevents a faulty node from successfully delivering mismatching messages to its neighbors (i.e., this prevents equivocation). Rule (iii) ensures that flooding will terminate after $n$ rounds.

Rule (ii) above crucially also ensures the following useful property due to the local broadcast model: even if node $u$ is Byzantine faulty, but paths $P_{uv}$ and $P_{uw}$ are fault-free, then nodes $v$ and $w$ will receive identical value in the message from $u$ forwarded along paths $P_{uv}$ and $P_{uw}$, respectively. Recall that a path is fault-free if none of the internal nodes on the path are faulty.

• Step (b):

Recall that a path is said to exclude set $F$ if none of its internal nodes are in $F$. For each $u\in V$, node $v$ chooses an arbitrary $uv$-path $P_{uv}$ that excludes $F$. It can be shown (Lemma 5.4) that such a path always exists under the conditions in Theorem 5.1. For the purpose of step (b), node $v$ is deemed to have received its own $\gamma_{v}$ along path $P_{vv}$ (containing only node $v$). Node $v$ computes sets $Z_{v}$ and $N_{v}=V-Z_{v}$, as shown in the pseudo-code.

• Step (c):

This step specifies the rules for updating value $\gamma_{v}$. $\gamma_{v}$ is not necessarily updated in each phase.

• Output:

After all the phases (i.e., all iterations of the For loop) are completed, the value of $\gamma_{v}$ is chosen as the output of node $v$.

The proof of correctness of Algorithm 1 is presented in Section 5.2. As we discussed earlier when describing the flooding mechanism, the faulty nodes are effectively limited to delivering a unique value on all fault-free paths (i.e., paths that do not have faulty nodes as internal nodes). If this unique value corresponding to a faulty node is [math], we will say that the faulty node flooded value [math]; else we will say that the node flooded value 1.

Let $Z$ be the set of nodes that flooded [math] in step (a) and let $N=V-Z$ be the set of the remaining nodes that flooded $1$. Recall from the description of flooding above, that even a faulty node effectively floods one value, and one value only, in step (a) of each phase. Note that either $Z$ or $N$ may possibly be empty, but not both. In step (b), each non-faulty node $v$ obtains its own estimates $Z_{v}$ and $N_{v}$ of $Z$ and $V$, respectively. If the set $F$ in the current phase does not contain all the faulty nodes, then these estimates can be incorrect. However, at least in one phase, $F$ will contain all the faulty nodes and, in that phase, as shown later, it is guaranteed that $Z=Z_{v}$ and $N=N_{v}$. This observation is important for the correctness of the algorithm, as seen later.

As shown later, step (c) is designed to ensure that the fault-free nodes will reach consensus in a phase in which $F$ contains all the faulty nodes. In each phase, step (c) also ensures the invariant that $\gamma_{v}$, at any non-faulty node $v$, at the end of the phase is equal to $\gamma_{u}$, for some non-faulty node $u$, at the start of that phase.

5.2 Proof of Correctness of Algorithm 1

In this section, we assume that graph $G$ satisfies the conditions stated in Theorem 5.1, even if this is not always stated explicitly below. Appendix B presents the proofs of the lemmas in this section.

The proof of correctness relies on two key lemmas, Lemma 5.2 and 5.3. We will present additional results and discuss the intuition behind the proof of these lemmas subsequently. Formal proofs are presented in Appendix B. Recall that the algorithm execution is divided into phases, each phase corresponding to a different choice of $F$, where $|F|\leq f$. For convenience of presentation, we will refer to $\gamma_{v}$ as the “state of node $v$”. Recall that state $\gamma_{v}$ of node $v$ may possibly be modified in step (c) in each phase.

Lemma 5.2**.**

For a non-faulty node $v$, its state $\gamma_{v}$ at the end of any given phase equals the state of some non-faulty node at the start of that phase.

Lemma 5.3**.**

Consider a phase of Algorithm 1 wherein all the faulty nodes are contained in set $F$ corresponding to that phase. At the end of this phase, every pair of non-faulty nodes $u,v\in V$ have identical state, i.e., $\gamma_{u}=\gamma_{v}$.

As shown next, these two lemmas imply correctness of Algorithm 1, thus proving Theorem 5.1.

Proof of Theorem 5.1:   Algorithm 1 terminates in finite time because the number of phases is finite, and flooding in each phase completes in finite time. Thus, the algorithm satisfies the termination condition.

Since there are at most $f$ faulty nodes in any given execution, there exists at least one phase in which set $F$ will contain all the faulty nodes. Then, from Lemma 5.3, we have that all non-faulty nodes have the same state at the end of this phase. Lemma 5.2 implies that the state of the non-faulty nodes will remain unchanged after any subsequent phases. Therefore, all non-faulty nodes will have the same state at the end of the algorithm and their output will be identical. This proves that the algorithm satisfies the agreement condition.

At the start of phase 1, the state of each non-faulty node equals its own input. Now, applying Lemma 5.2 inductively implies that the state of a non-faulty node always equals the input of some non-faulty node. This, in turn, implies that the algorithm satisfies the validity condition. Thus, we have proved correctness of Algorithm 1 under the conditions stated in Theorem 5.1. $\Box$

The proofs of Lemmas 5.2 and 5.3, stated above, rely on two other lemmas, presented next. The reader may skip the rest of this section without a loss of continuity. Lemma 5.4 below implies that path $P_{uv}$ used in step (b) of the algorithm indeed exists.

Lemma 5.4**.**

For any choice of set $F$ in the algorithm, and any two nodes $u,v\in V$, there exists a $uv$-path that excludes $F$.

Proof:   Recall that a path is said to exclude $F$ if none of the internal nodes in the path belong to $F$. Since $G$ is $(\left\lfloor{3f/2}\right\rfloor+1)$-connected, by Menger’s Theorem, there are at least $\left\lfloor{3f/2}\right\rfloor+1$ node-disjoint paths between any two nodes $u,v$. For any $f\geq 0$, we have $\left\lfloor{3f/2}\right\rfloor+1\geq f+1$. Thus, there are at least $f+1$ node-disjoint $uv$-paths, of which at least one path must exclude $F$, since $\mathinner{\!\left\lvert F\right\rvert}\leq f$.

$\Box$

The next lemma states that the choice of sets $A_{v}$ and $B_{v}$ in step (c) ensures that the node-disjoint paths used in that step indeed exist.

Lemma 5.5**.**

For any non-faulty node $v$, and any given phase with the corresponding set $F$, in step (c), if $v\in B_{v}$, then there exist $f+1$ node-disjoint $A_{v}v$-paths that exclude $F$.

The formal proof of the above lemma is presented in Appendix B. Observe that there are four distinct cases in step (c) for determining sets $A_{v}$ and $B_{v}$. The proof of the above claim in cases 1 and 3 in step (c) follows from $(\left\lfloor{3f/2}\right\rfloor+1)$-connectivity of graph $G$, while the proof in cases 2 and 4 follows from the fact that the minimum degree of $G$ is at least $2f$.

In step (c), observe that if node $v$ modifies its state $\gamma_{v}$, then it must have received identical value along $f+1$ node-disjoint $A_{v}v$ paths. So, at least one of these path must not only be fault-free, but also have non-faulty endpoints. The proof of Lemma 5.2 in Appendix B relies on this observation.

Now consider Lemma 5.3. The correctness of this lemma relies on the local broadcast property and rule (ii) used in flooding. Suppose that set $F$ in a certain phase contains all the faulty nodes. Since the paths used in step (b) of the algorithm exclude set $F$, these paths are fault-free (i.e., none of their internal nodes are faulty). Then, the earlier discussion of flooding implies that any two non-faulty nodes $u,v$ will obtain $Z_{u}=Z_{v}$ and $N_{u}=N_{v}$ in step (b) of this phase. By a similar argument, all the paths used in step (c) of this phase are also fault-free, and any two non-faulty nodes will end step (c) of this phase with an identical state. A complete proof of Lemma 5.3 is presented in Appendix B.

5.3 An Efficient Algorithm

The number of phases in Algorithm 1 is exponential in $f$, since there exists one phase corresponding to each choice of set $F$ such that $|F|\leq f$. When the communication graph $G$ is $2f$-connected, we have developed an efficient algorithm that requires $O(n)$ time. Although in general $2f$-connectivity is a stronger requirement on graph $G$ as compared to the requirement in Theorem 5.1, observe that when $f=1,2$ these two requirements are equivalent.

Theorem 5.6**.**

Under the local broadcast model, if $G$ is $2f$-connected, then Byzantine consensus tolerating at most $f$ Byzantine faults is achievable on graph $G$ in $O(n)$ synchronous rounds.

We prove Theorem 5.6 constructively by giving an efficient algorithm, which we present in Appendix C. Using the example in Figure 1(a), we now illustrate a tool used in that algorithm, which exploits the $2f$-connectivity. The graph in Figure 1(a) is $2$-connected, i.e., $2f$-connected for $f=1$. Similar to our algorithm in the previous section, suppose that node 1 floods value $b$, which is propagated to node 4 along path 1-2-3-4. When node 2 forwards the value to node 3, all of node 2’s neighbors hear the forwarded message. Similarly, when node 3 forwards the message to node 4, all of node 3’s neighbors hear the forwarded message.

Suppose now that we ask each node to additionally “report” on its neighbors by flooding any messages heard/received in the above propagation from node 1 to node 5. Then the message forwarded by node 4, as overheard by node 3, will be flooded by node 3. Since the graph $G$ is $2f$-connected, node 4 has at least $2f$ neighbors, each of which will take similar steps. Now consider two cases:

• •

Node 3 is faulty: Since node 3 is faulty, there are at most $f-1$ other faulty nodes. In this case, $2f$-connectivity implies that there are at least $f+1$ node-disjoint fault-free paths from neighbors of node 3 to node 1. Thus, node 1 can receive $f+1$ identical and correct reports of all messages transmitted by node 3. Therefore, node 1 can correctly determine the message forwarded by node 3. In general, each node can correctly learn messages transmitted by any faulty node, when the connectivity is $2f$.

• •

Node 3 is non-faulty: In this case, it is possible that node 1 does not receive identical reports about node 3’s messages on $f+1$ node-disjoint paths. This inability to receive $f+1$ identical reports, however, allows node 1 to infer that node 3 must be non-faulty.

In summary, as illustrated above, each node can observe all messages sent by any faulty node. Also, each node can either observe all messages sent by another non-faulty node, or learn that it is non-faulty. In some instances, these observations help non-faulty nodes identify the faulty nodes accurately. Our algorithm in Appendix C relies on this property to improve the time complexity.

6 Hybrid Model

In this section we consider a hybrid model. The hybrid model is designed to help explore the gap between the network requirements for Byzantine consensus under the point-to-point communication model and the local broadcast model. Under the hybrid model, up to $f<n$ nodes may be Byzantine faulty. The faulty nodes are of two types:

• •

Equivocating faulty nodes: At most $t\leq f$ of the faulty nodes may equivocate, that is, they are not restricted to perform local broadcast. If $u$ is an equivocating faulty node and has neighbors $v$ and $w$, then node $u$ may send message $M_{v}$ to node $v$ without node $w$ receiving $M_{v}$, and similarly send message $M_{w}$ to node $w$ without node $v$ receiving $M_{w}$. Thus, equivocating faulty nodes can behave similar to the faulty nodes under the point-to-point communication model.

• •

Non-equivocating faulty nodes: Any faulty node that is not an equivocating faulty node is said to be a non-equivocating faulty node. A non-equivocating faulty node conforms to the local broadcast model. Thus, if node $u$ is a non-equivocating faulty node, and has neighbors $v$ and $w$, then any message $M$ transmitted by node $u$ will be received identically by $v$ and $w$ both.

Observe that when $t=0$, the hybrid model reduces to the local broadcast model, since all the faulty nodes are restricted to perform local broadcast. On the other hand, when $t=f$, the hybrid model reduces to the classical point-to-point communication model because all the faulty nodes can equivocate. The following theorem extends results from Sections 4 and 5 to the hybrid model.

Theorem 6.1**.**

Under the hybrid model, Byzantine consensus tolerating at most $f$ Byzantine faulty nodes, of which at most $t$ are equivocating faulty nodes, is achievable on graph $G$ if and only if all the following conditions are true:

1. (i)

$G$* is $(\left\lfloor{3(f-t)/2}\right\rfloor+2t+1)$-connected,* 2. (ii)

if $t=0$, then $G$ has minimum degree at least $2f$, and 3. (iii)

if $t>0$, then every set of nodes $S$, such that $0<|S|\leq t$, has at least $2f+1$ neighbors.

Observe that when $t=0$, condition (ii) lower bounds the number of neighbor of each vertex. On the other hand, when $t>0$, condition (iii) lower bounds the number of neighbors of each subset of nodes of size at most $t$. Recall that neighbors of $S$ are nodes outside of $S$ that have an edge to some node in $S$. Theorem 6.1 is proved in Appendix D. Consider three cases:

• •

When $t=0$, as noted earlier, the hybrid model reduces to the local broadcast model. In this case, condition (iii) imposes no restrictions, and conditions (i) and (ii) reduce to the graph requirements in Theorems 4.1 and 5.1.

• •

When $t=f$, the hybrid model reduces to the point-to-point communication model. In this case, condition (ii) imposes no restrictions, condition (i) requires $G$ to be $(2f+1)$-connected, and condition (iii) implies $n\geq 3f+1$.

• •

When $0<t<f$, the above theorem provides insights into the trade-off between equivocation and network requirements.

The necessity and sufficiency of the conditions in Theorem 6.1 is proved using similar techniques as the proofs of Theorems 4.1 and 5.1, respectively. The proof of Theorem 6.1 appears in Appendix D. To prove sufficiency, Algorithm 1 is modified to obtain an algorithm for the hybrid model – the modified algorithm is presented in Appendix D.2.

7 Summary

In this work, we investigated Byzantine Consensus under the local broadcast model. We showed that $(\left\lfloor{3f/2}\right\rfloor+1)$-connectivity and minimum degree at least $2f$ are together necessary and sufficient conditions to achieve Byzantine consensus in the presence of at most $f$ Byzantine faults under the local broadcast model. The sufficiency proof is constructive. However, the algorithm presented requires exponential synchronous rounds. For a stronger network condition of $2f$-connectivity, an efficient algorithm that achieves consensus in linear number of rounds is presented in Appendix C. We leave finding an efficient algorithm for the tight condition for future work.

We also considered a hybrid model where some faulty nodes may equivocate but other faulty nodes are restricted to local broadcast. We presented necessary and sufficient conditions for this model, which provide insights into the trade-off between equivocation and network requirements.

Appendix A Proofs of Section 4

In the appendices, with a slight abuse of terminology, we allow a partition of a set to have empty parts. That is, $(Z_{1},\dots,Z_{k})$ is a partition of a set $Y$ if $\bigcup_{i=1}^{k}Z_{i}=Y$ and $Z_{i}\cap Z_{j}=\emptyset$ for all $i\neq j$, but some $Z_{i}$’s can be possibly empty.

A Byzantine Consensus algorithm $\mathcal{A}$ outlines a procedure $\mathcal{A}_{u}$ for each node $u\in V$ that describes state transitions of $u$. In each synchronous round, each node optionally sends messages to its neighbors, receives messages from the neighbors, and then updates its state. The new state of $u$ depends entirely on $u$’s previous state and the messages received by $u$ from its neighbors. The state of $u$ determines the messages sent by $u$.

Lemma A.1**.**

If there exists a Byzantine consensus algorithm under the local broadcast model on a graph $G$ tolerating at most $f$ Byzantine faulty nodes, then $G$ has minimum degree at least $2f$.

Proof:   When $f=0$, the lemma does not impose any restrictions on $G$. So we assume that $f>0$. It is easy to show that, when $n>1$, each node must have at least one neighbor to be able to achieve consensus. So in the rest of the proof we assume that the degree of each node in $G$ is at least $1$. Suppose for the sake of contradiction that there exists a node $z$ in $G$ of degree less than $2f$ and there exists an algorithm $\mathcal{A}$ that solves Byzantine consensus under the local broadcast model on $G$. Then there exists a partition $(F^{1},F^{2})$ of the neighborhood of $z$ such that $\mathinner{\!\left\lvert F^{1}\right\rvert}<f$ and $\mathinner{\!\left\lvert F^{2}\right\rvert}\leq f$. Let $W=V-(F^{1}\cup F^{2}\cup\mathinner{\left\{z\right\}})$ be the set of remaining nodes. Note that some of these sets can be possibly empty. However, since $n>f>0$ and $z$ has degree at least $1$, we select these sets so that $F^{2}$ is necessarily non-empty. Recall that $\mathcal{A}$ outlines a procedure $\mathcal{A}_{u}$ for each node $u$ that describes $u$’s state transitions in each round.

We first create a network $\mathcal{G}$ to model behavior of nodes in $G$ in three different executions $E_{1}$, $E_{2}$, and $E_{3}$, which we will describe later. Figure 2 depicts $\mathcal{G}$. The network $\mathcal{G}$ has some directed edges, the behavior of which will be explained later. We denote a directed edge from $u$ to $v$ as $\overrightarrow{uv}$. $\mathcal{G}$ consists of two copies of each node in $W$ and a single copy of the remaining nodes. We denote the two sets of copies of $W$ as $W_{0}$ and $W_{1}$. For each node $u\in W$, we denote by $u_{0}$ and $u_{1}$ the two copies of $u$ in $W_{0}$ and $W_{1}$ respectively. For each edge $uv\in E(G)$, we create edges in $\mathcal{G}$ as follows:

If $u,v\in W$, then there are two edges $u_{0}v_{0}$ and $u_{1}v_{1}$ in $\mathcal{G}$. These edges are not shown in Figure 2. 2. 2)

If $u,v\in V-W$, then there is a single edge $uv$ in $\mathcal{G}$. Some of these edges are also not shown in Figure 2. 3. 3)

If $u\in F^{1}$ and $v\in W$, then there are two edges $uv_{0}$ and $\overrightarrow{uv_{1}}$ in $\mathcal{G}$. In Figure 2, these edges are illustrated by a single undirected edge between sets $F^{1}$ and $W_{0}$, and a single directed edge from $F^{1}$ to $W_{1}$. 4. 4)

If $u\in F^{2}$ and $v\in W$, then there are two edges $\overrightarrow{uv_{0}}$ and $uv_{1}$ in $\mathcal{G}$. In Figure 2, these edges are illustrated by a single directed edge from $F^{2}$ to $W_{1}$, and a single undirected edge between sets $F^{2}$ and $W_{0}$.

Note that there are no edges between $W_{0}$ and $W_{1}$. In Figure 2, this is emphasized by drawing a cross on a dotted line between $W_{0}$ and $W_{1}$.

All message transmissions in $\mathcal{G}$ are via local broadcast, as follows. When a node $u$ in $\mathcal{G}$ transmits a message, the following nodes receive this message identically: each node with whom $u$ has an undirected edge and each node to whom there is an edge directed away from $u$. Note that a directed edge $e=\overrightarrow{uv}$ behaves differently for $u$ and $v$. All messages sent by $u$ are received by $v$. No message sent by $v$ is received by $u$. Observe that with this behavior of directed edges, the structure of $\mathcal{G}$ ensures the following property. For each edge $uv$ in the original graph $G$, each copy of $u$ receives messages from exactly one copy of $v$ in $\mathcal{G}$. This allows us to create an algorithm for $\mathcal{G}$ corresponding to $\mathcal{A}$ as follows. For each node $u\in G$, if $\mathcal{G}$ has one copy of $u$, then $u$ runs $\mathcal{A}_{u}$. Otherwise there are two copies $u_{0}$ and $u_{1}$ of $u$. Both $u_{0}$ and $u_{1}$ run $\mathcal{A}_{u}$.

Consider an execution $\mathcal{E}$ of the above algorithm on $\mathcal{G}$ as follows. Each node in $W_{0}\cup F^{1}\cup\mathinner{\left\{z\right\}}$ has input [math] and the remaining nodes have input $1$. Observe that it is not guaranteed that nodes in $\mathcal{G}$ will decide on the same value or that the algorithm will terminate. We will show that the algorithm does indeed terminate but nodes do not reach agreement in $\mathcal{G}$, which will be useful in deriving the desired contradiction. We use $\mathcal{E}$ to describe three executions $E_{1}$, $E_{2}$, and $E_{3}$ of $\mathcal{A}$ on the original graph $G$ as follows (see also Table 1).

1. $E_{1}$:

$F^{2}$ is the set of faulty nodes. In each round, a faulty node broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. All non-faulty nodes have input [math]. Note that the behavior of non-faulty nodes in $F^{1}\cup\mathinner{\left\{z\right\}}$ and $W$ is modelled by the corresponding (copies of) nodes in $F^{1}\cup\mathinner{\left\{z\right\}}$ and $W_{0}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $W\cup F^{1}\cup\mathinner{\left\{z\right\}}$ decide on output [math] (by validity) in finite time. 2. $E_{2}$:

$F^{1}$ is the set of faulty nodes. In each round, a faulty node broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. $z$ has input [math] and all the remaining non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $F^{2}\cup\mathinner{\left\{z\right\}}$ and $W$ is modelled by the corresponding (copies of) nodes in $F^{2}\cup\mathinner{\left\{z\right\}}$ and $W_{1}$, respectively, in $\mathcal{E}$. The output of the non-faulty nodes will be described later. 3. $E_{3}$:

$F^{1}\cup\mathinner{\left\{z\right\}}$ is the set of faulty nodes. In each round, a faulty node broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. All non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $F^{2}$ and $W$ is modelled by the corresponding (copies of) nodes in $F^{2}$ and $W_{1}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $W\cup F^{2}$ decide on output $1$ (by validity) in finite time.

Due to the output of nodes in $W\cup F^{1}\cup\mathinner{\left\{z\right\}}$ in $E_{1}$, the nodes in $W_{0}\cup F^{1}\cup\mathinner{\left\{z\right\}}$ output [math] in $\mathcal{E}$. Similarly, due to the output of nodes in $W\cup F^{2}$ in $E_{3}$, the nodes in $W_{1}\cup F^{2}$ output $1$ in $\mathcal{E}$. It follows that in $E_{2}$, nodes in $W$ and $F^{2}$, as modeled by $W_{1}$ and $F^{2}$ in $\mathcal{E}$, output $1$ while $z$ outputs [math]. Recall that, by construction, $F^{2}$ is non-empty. This violates agreement, a contradiction.

$\Box$

Lemma A.2**.**

If there exists a Byzantine consensus algorithm under the local broadcast model on a graph $G$ tolerating at most $f$ Byzantine faulty nodes, then $G$ is $(\left\lfloor{3f/2}\right\rfloor+1)$-connected.

Proof:   Suppose for the sake of contradiction that $G$ is not $(\left\lfloor{3f/2}\right\rfloor+1)$-connected and there exists an algorithm $\mathcal{A}$ that solves Byzantine consensus under the local broadcast model on $G$. Then there exists a vertex cut $C$ of $G$ of size at most $\left\lfloor{3f/2}\right\rfloor$ with a partition $(A,B,C)$ of $V$ such that $A$ and $B$ (both non-empty) are disconnected in $G-C$ (so there is no edge between a node in $A$ and a node in $B$). Since $\mathinner{\!\left\lvert C\right\rvert}\leq\left\lfloor{3f/2}\right\rfloor$, there exists a partition $(C^{1},C^{2},C^{3})$ of $C$ such that $\mathinner{\!\left\lvert C^{1}\right\rvert},\mathinner{\!\left\lvert C^{2}\right\rvert}\leq\left\lfloor{f/2}\right\rfloor$ and $\mathinner{\!\left\lvert C^{3}\right\rvert}\leq\left\lceil f/2\right\rceil$. Recall that $\mathcal{A}$ outlines a procedure $\mathcal{A}_{u}$ for each node $u$ that describes $u$’s state transitions in each round.

Similar to the proof of Lemma A.1, we first create a network $\mathcal{G}$ to model behavior of nodes in $G$ in three different executions $E_{1}$, $E_{2}$, and $E_{3}$, which we will describe later. $\mathcal{G}$ consists of two copies of each node in $A$ and $B$, and a single copy of the remaining nodes. Figure 3 depicts $\mathcal{G}$. The edges in $\mathcal{G}$ can be deduced from Figure 3 along the lines of the proof of Lemma A.1. However, edges within $C$ are not shown in Figure 3. They are copied exactly from $G$. As in proof of Lemma A.1, the structure of $\mathcal{G}$ ensures that, for each edge $uv$ in the original graph $G$, each copy of $u$ receives messages from exactly one copy of $v$ in $\mathcal{G}$. This allows us to create an algorithm for $\mathcal{G}$ corresponding to $\mathcal{A}$ as follows. For each node $u\in G$, if $\mathcal{G}$ has one copy of $u$ then $u$ runs $\mathcal{A}_{u}$. Otherwise there are two copies $u_{0}$ and $u_{1}$ of $u$. Both $u_{0}$ and $u_{1}$ run $\mathcal{A}_{u}$.

Consider an execution $\mathcal{E}$ of the above algorithm on $\mathcal{G}$ as follows. Each node in $A_{0}$, $B_{0}$, and $C^{1}$ has input [math] and the remaining nodes have input $1$. As in proof of Lemma A.1, we will show that the algorithm does indeed terminate but nodes do not reach agreement in $\mathcal{G}$, which will be useful in deriving the desired contradiction. We use $\mathcal{E}$ to describe three executions $E_{1}$, $E_{2}$, and $E_{3}$ of $\mathcal{A}$ on the original graph $G$ as follows.

1. $E_{1}$:

$C^{2}\cup C^{3}$ is the set of faulty nodes. In each round, a faulty node in $C^{2}\cup C^{3}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. All non-faulty nodes have input [math]. Note that the behavior of non-faulty nodes in $A$, $B$, and $C^{1}$ is modelled by the corresponding (copies of) nodes in $A_{0}$, $B_{0}$, and $C^{1}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $A$, $B$, and $C^{1}$ decide on output [math] (by validity) in finite time. 2. $E_{2}$:

$C^{1}\cup C^{3}$ is the set of faulty nodes. In each round, a faulty node in $C^{1}\cup C^{3}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. $A$ has input [math] and all the remaining non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $A$, $B$, and $C^{2}$ is modelled by the corresponding (copies of) nodes in $A_{0}$, $B_{1}$, and $C^{2}$, respectively, in $\mathcal{E}$. The output of the non-faulty nodes will be described later. 3. $E_{3}$:

$C^{1}\cup C^{2}$ is the set of faulty nodes. In each round, a faulty node in $C^{1}\cup C^{2}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. All non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $A$, $B$, and $C^{3}$ is modelled by the corresponding (copies of) nodes in $A_{1}$, $B_{1}$, and $C^{3}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $A$, $B$, and $C^{3}$ decide on output $1$ (by validity) in finite time.

Due to the output of nodes in $A$, $B$, and $C^{1}$ in $E_{1}$, the nodes in $A_{0}$, $B_{0}$, and $C^{1}$ output [math] in $\mathcal{E}$. Similarly, due to the output of nodes in $A$, $B$, and $C^{3}$ in $E_{3}$, the nodes in $A_{1}$, $B_{1}$, and $C^{3}$ output $1$ in $\mathcal{E}$. It follows that in $E_{2}$, nodes in $A$, as modeled by $A_{0}$ in $\mathcal{E}$, output [math] while nodes in $B$, as modeled by $B_{1}$, output $1$. Recall that, by construction, both $A$ and $B$ are non-empty. This violates agreement, a contradiction.

$\Box$

Proof of Theorem 4.1:   Directly from Lemmas A.1 and A.2. $\Box$

Appendix B Proofs of Section 5

In this section, we assume that the graph $G$ satisfies the conditions in Theorem 5. The following observation follows from the rules used for flooding.

Observation B.1**.**

For any phase of Algorithm 1, in step (a) for any two nodes $u,v\in V$ (possibly faulty), if $v$ receives value $b$ along a fault-free $uv$-path then $u$ broadcast the value $b$ to its neighbors during flooding.

Recall that, if a faulty node does not initiate flooding, then for the purpose of the above observation, its behavior is equivalent to it flooding the value $1$. We now give proofs of Lemmas 5.5, 5.2, and 5.3.

Proof of Lemma 5.5:   Fix a phase of the algorithm and the corresponding set $F$. Consider an arbitrary non-faulty node $v$ such that $v\in B_{v}$ in step (c). There are 4 cases to consider, corresponding to the 4 cases in step (c).

1. Case 1:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}\leq\left\lfloor{f/2}\right\rfloor$ and $\mathinner{\!\left\lvert N_{v}\right\rvert}>f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$. Therefore there exist at least $f+1$ nodes in $A_{v}$. Node $v$ selects $f+1$ nodes $A^{\prime}_{v}$ from $A_{v}$ by choosing all nodes from $A_{v}\cap F$ and the rest arbitrarily from $A_{v}-F$. Define $B^{\prime}_{v}\mathrel{\mathop{\mathchar 58\relax}}=B_{v}\cap(F-v)$. Now, $\mathinner{\!\left\lvert B^{\prime}_{v}\right\rvert}\leq\mathinner{\!\left\lvert B_{v}\cap F\right\rvert}=\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}\leq\left\lfloor{f/2}\right\rfloor$ by assumption of case 1. Since $G$ is $(\left\lfloor{3f/2}\right\rfloor+1)$-connected, $G-B^{\prime}_{v}$ is at least $(f+1)$-connected and there exist $f+1$ node-disjoint $A^{\prime}_{v}v$-paths in $G-B^{\prime}_{v}$. Furthermore, since all the nodes in $A_{v}\cap F$ are endpoints in these paths and $F=(A_{v}\cap F)\cup(B_{v}\cap F)$, we have that these paths exclude $F$111Recall that a path that excludes $X$ does not have nodes from $X$ as internal nodes; however, nodes from $X$ may be the endpoints of the path.. 2. Case 2:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}\leq\left\lfloor{f/2}\right\rfloor$ and $\mathinner{\!\left\lvert N_{v}\right\rvert}\leq f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$. Note that when $f=0$, this case is not possible since $v\in B_{v}$ and so $B_{v}=N_{v}$ must be non-empty. Since the degree of $v$ is at least $2f$ and there are at most $f$ nodes in $B_{v}$ (including $v$), we have that $v$ has at least $f+1$ neighbors in $A_{v}$. There are therefore $f+1$ node-disjoint $A_{v}v$-paths that have no internal nodes and hence exclude $F$. 3. Case 3:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}>\left\lfloor{f/2}\right\rfloor$ and $\mathinner{\!\left\lvert Z_{v}\right\rvert}>f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$. We have that

[TABLE]

So this case is the same as Case 1 with the roles of $Z_{v}$ and $N_{v}$ swapped. 4. Case 4:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}>\left\lfloor{f/2}\right\rfloor$ and $\mathinner{\!\left\lvert Z_{v}\right\rvert}\leq f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$. From the analysis in Case 3, we have that $\mathinner{\!\left\lvert N_{v}\cap F\right\rvert}\leq\left\lfloor{f/2}\right\rfloor$. So this case is the same as Case 2 with the roles of $Z_{v}$ and $N_{v}$ swapped.

In all four cases we have that there do exist $f+1$ node-disjoint $A_{v}v$-paths that exclude $F$. $\Box$

Proof of Lemma 5.2:   Fix a phase of the algorithm and the corresponding set $F$. For any node $u$, we denote the state at the beginning of the phase by $\gamma_{u}^{\operatorname{start}}$ and the state at the end of the phase by $\gamma_{u}^{\operatorname{end}}$. Consider an arbitrary non-faulty node $v$ and the sets $A_{v}$ and $B_{v}$ in step (c). If $\gamma_{v}^{\operatorname{start}}=\gamma_{v}^{\operatorname{end}}$, then the claim is trivially true. So suppose $v\in B_{v}$ and $v$ receives identical value along $f+1$ node-disjoint $A_{v}v$-paths that exclude $F$ in step (a). Since the number of faulty nodes is at most $f$, thus at least one of these paths is both fault-free and has a non-faulty endpoint (other than $v$), say $u$. By Observation B.1, it follows that whatever value is received by $v$ along this path in step (a) is the value flooded by $u$. Therefore, $\gamma_{v}^{\operatorname{end}}=\gamma_{u}^{\operatorname{start}}$, where $u$ is a non-faulty node, as required. $\Box$

Proof of Lemma 5.3:   Fix a phase of the algorithm and the corresponding set $F$ such that all faulty nodes are contained in $F$. Let $Z$ be the set of nodes that flooded [math] in step (a) of the phase and let $N$ be the set of nodes that flooded $1$ in step (a). We first show that for any non-faulty node $v$, $Z_{v}=Z$ and $N_{v}=N$. Consider an arbitrary node $w\in Z$ (resp. $w\in N$) that flooded [math] (resp. $1$) in step (a) of this phase. Observe that $P_{wv}$ identified in step (b) of the phase excludes $F$ and is fault-free. Therefore, by Observation B.1, $v$ receives [math] (resp. $1$) along $P_{wv}$ and correctly puts $w$ in the set $Z_{v}$ (resp. $N_{v}$), as required.

It follows that for any two non-faulty nodes $u$ and $v$, we have that $Z_{u}=Z_{v}=Z$ and $N_{u}=N_{v}=N$. Thus $A_{u}=A_{v}$ and $B_{u}=B_{v}$. Let $A\mathrel{\mathop{\mathchar 58\relax}}=A_{u}$ and $B\mathrel{\mathop{\mathchar 58\relax}}=B_{u}$. First note that $A$ is always non-empty as follows. If $B$ is empty, then $A=V$ is non-empty. If $B$ is non-empty, then let $w\in B$ be a node in $B$. By Lemma 5.5, there exist $f+1$ node-disjoint $Aw$-paths, which implies that $\mathinner{\!\left\lvert A\right\rvert}\geq f+1$. Now all nodes in $A$ flooded identical value in step (a), say $\alpha$. If $u\in A$, then $u$’s state is $\alpha$ at the beginning of the phase and stays unchanged in step (c). Therefore, at the end of the phase $\gamma_{u}=\alpha$. If $u\in B$, then observe that the $f+1$ node-disjoint $Au$-paths identified by $u$ in step (c) are all fault-free. By Observation B.1, it follows that $u$ receives $\alpha$ identically along these $f+1$ paths and so, at the end of the phase, $\gamma_{u}=\alpha$. Similarly for $v$, we have that $\gamma_{v}=\alpha$, as required. $\Box$

Appendix C Efficient Algorithm for $2f$-Connected Graphs

In this section we give an efficient algorithm when $G$ is $2f$-connected to prove Theorem 5.6. We start by defining reliable message transmission.

Definition C.1**.**

For two nodes $u,v\in V$, node $v$ reliably receives a message flooded by node $u$ if

$u=v$, 2. 2.

$v$* is a neighbor of $u$, or* 3. 3.

$v$* receives the message identically on at least $f+1$ node-disjoint $uv$-paths.*

Observe that if a node $u$ broadcasts a message $M$, then any node $v$ cannot reliably receive a message $M^{\prime}\neq M$ from $u$.

We will say that a non-faulty node is a type A node if it knows the identity of all $f$ faulty nodes. Any non-faulty node that is not type A node is said to be a type B node. Initially, all non-faulty nodes are type B nodes. As the algorithm executes, some non-faulty nodes will discover the identity of all the faulty nodes and become type A nodes.

The algorithm proceeds in three phases. In phase 1, each node $v$ floods its input value. As before, it requires $v$ to first locally broadcast its input to its neighbors and then assist other nodes to flood their values by forwarding received messages from its neighbors. Recall that flooding completes in $n$ synchronous rounds.

In phase 2, $v$ floods all the messages it hears from its neighbors in phase 1. Recall that under local broadcast model each node receives all the messages transmitted by its neighbors. After $n$ synchronous time steps, flooding in phase 2 will complete. These messages help identify faulty nodes if they exhibit faulty behavior (i.e. tamper with messages). The details are in the proof of Lemma C.2.

In phase 3, type B nodes reach consensus and inform the type A nodes on the decision. As discussed above, type A nodes can identify fault-free paths to each type B node. If no type B node exists, then type A nodes decide by themselves.

The formal procedure is given in Algorithm 2 and a proof of correctness follows.

The first lemma states that an adversary cannot hide a message broadcast by a faulty node.

Lemma C.2**.**

A message sent by a faulty node is received reliably by every node.

Proof:   Let $u$ be an arbitrary faulty node and let $v$ be an arbitrary node in $G$. If $u=v$ or $v$ is a neighbor of $u$, then the claim is trivially true from Definition C.1. Otherwise, there exist $2f$ node-disjoint paths from $u$ to $v$ as the graph is $2f$-connected. Since $u$ is faulty, only $f-1$ of these paths can have faulty nodes. Any message sent by $u$ is received identically by all its neighbors, and so $v$ will receive it identically along the remaining $f+1$ node-disjoint paths that are fault-free.

$\Box$

Next, we want to show that all type B nodes know the same set of input values. We need an intermediate lemma to show that.

Lemma C.3**.**

Let $v$ and $w$ be distinct nodes. In phase 1, if $v$ reliably receives an input value of some node $u$ and $w$ does not, then $v$ knows the identity of $f$ faulty nodes after phase $2$.

Proof:   Fix a node $u$ with input $b\in\mathinner{\left\{0,1\right\}}$ such that $v$ reliably received $b$ from $u$ in phase 1 but $w$ did not. Observe that, by Lemma C.2, $u$ is a non-faulty node since $w$ did not reliably receive $b$ from $u$ in phase 1. Let $P_{1},\dots,P_{2f}$ be $2f$ node-disjoint $uw$-paths. Since $w$ did not reliably receive $b$ from $u$ in phase 1, therefore exactly $f$ of these paths have faulty nodes. WLOG let these paths be $P_{1},\dots,P_{f}$. By Lemma C.2, after phase 2, $v$ reliably receives that some nodes on $P_{1}\dots,P_{f}$ forwarded $\bar{b}=1-b$ in phase 1. For each path, $v$ sets the first such node to be faulty.

To see why this assignment of faulty nodes by $v$ is correct, consider an arbitrary path in $P_{1},\dots,P_{f}$. WLOG let this path be $P_{1}$. Let $z$ be the faulty node in $P_{1}$ that tampers the message. Observe that each of $P_{1},\dots,P_{f}$ has exactly one faulty node that tampers the message. In phase 2, by Lemma C.2, $v$ reliably receives that $z$ forwarded $\bar{b}$ in phase 1. Moreover, let $x$ be an arbitrary node in $P_{1}$ before $z$. Then $x$ is non-faulty and forwarded $b$ in phase 1. Therefore, in phase 2, $v$ can not reliably receive that $x$ forwarded $\bar{b}$ in phase 1.

$\Box$

Lemma C.4**.**

All type B nodes reliably receive the same set of input values in phase 1.

Proof:   Suppose, for the sake of contradiction, that two nodes $v$ and $w$ are type B nodes and there exists a node $u$ such that $v$ reliably receives the input of $u$ and $w$ does not. Then, by Lemma C.3, $v$ knows the identity of $f$ faulty nodes after phase 2. Therefore, $v$ must be a type A node, a contradiction.

$\Box$

This next lemma shows that each node knows the input values of at least $2f$ other nodes.

Lemma C.5**.**

Each node reliably receives input values of at least $2f$ other nodes in phase 1.

Proof:   Since the graph is $2f$ connected, therefore each node has at least $2f$ neighbors. By Definition C.1 each node reliably receives input from these $2f$ nodes in phase 1.

$\Box$

We now have all the necessary lemmas to prove Theorem 5.6.

Proof of Theorem 5.6:   Each phase of Algorithm 2 requires at most $n$ synchronous rounds. Since there are only $3$ phases, so the algorithm terminates in $O(n)$ synchronous rounds. For validity and agreement, there are two cases to consider.

There is at least one type B node: For agreement, note that by Lemma C.4 all type B nodes receive the same input values and therefore decide on the same value by taking the majority. A type A node (if one exists) knows the identity of all $f$ faulty nodes and so it can ignore messages on paths with faulty nodes. So we only need one fault-free path between a type A node and any type B node. Since there are at least $f$ node-disjoint fault free-paths between any two nodes, therefore in phase 3 each type A node correctly receives a message from a type B node about the final decision and decides on the same value. For validity, note that by Lemma C.5 each type B node has input values of at least $2f+1$ nodes (including its own). So the decided value is an input of at least $f+1$ nodes. Since there are at most $f$ faulty nodes, therefore the decided value is an input of at least one non-faulty node, as required.

There are no type B nodes: Let $u$ be an arbitrary non-faulty node. Since there are no type B nodes, $u$ is a type A node that does not receive any decision value from any type B node in phase 3. Since $u$ knows the identity of $f$ faulty nodes, $u$ can identify fault-free paths to non-faulty nodes and receive untampered messages from non-faulty nodes in phase 1 and ignore messages from any path that contains a faulty node. Therefore, $u$ knows the input values of all non-faulty nodes. For agreement, observe that all non-faulty nodes are type A and each non-faulty node decides on the same decision value by taking the majority of the input values of non-faulty nodes. For validity, all non-faulty nodes consider the input values of non-faulty nodes. $\Box$

Appendix D Proofs of Section 6

This appendix pertains to the hybrid model.

D.1 Necessity of the conditions in Theorem 6.1

Lemma D.1**.**

If there exists a Byzantine consensus algorithm under the hybrid model on a graph $G$ tolerating at most $f$ Byzantine faulty nodes, of which at most $t$ nodes, $0<t\leq f$, are equivocating faulty nodes, then every set of nodes $S$, such that $0<|S|\leq t$, has at least $2f+1$ neighbors.

Proof:   Consider $t$ such that $0<t\leq f$. Let $\varphi=f-t$. For the sake of contradiction, suppose that there exists a non-empty set of nodes $S$ in $G$ of size at most $t$ that has at most $2f$ neighbors and there exists an algorithm $\mathcal{A}$ that solves Byzantine consensus under the hybrid model on $G$. Recall that neighbors of $S$ are nodes outside of $S$ that have an edge to some node in $S$. It is easy to show that when $n>f\geq t$, each set of cardinality at most $t$ must have at least one neighbor to achieve consensus. So in the rest of the proof we assume that $S$ has at least one neighbor. Let $N$ be the non-empty neighborhood of $S$. Then there exists a partition $(F^{1},F^{2},R,T)$ of $N$ such that $\mathinner{\!\left\lvert F^{1}\right\rvert},\mathinner{\!\left\lvert F^{2}\right\rvert}\leq\varphi$ and $\mathinner{\!\left\lvert R\right\rvert},\mathinner{\!\left\lvert T\right\rvert}\leq t$. Let $W=V-(S\cup N)$ be the set of remaining nodes. Note that some of these sets (other than $S$) can be possibly empty. However, since $n>t$ and $N$ is non-empty, we select these sets so that $R$ is necessarily non-empty. Recall that $\mathcal{A}$ outlines a procedure $\mathcal{A}_{u}$ for each node $u$ that describes $u$’s state transitions in each round.

Similar to the proof of Lemma A.1, we first create a network $\mathcal{G}$ to model behavior of nodes in $G$ in three different executions $E_{1}$, $E_{2}$, and $E_{3}$, which we will describe later. $\mathcal{G}$ consists of two copies of each node in $W$ and $T$, and a single copy of the remaining nodes. Figure 4 depicts $\mathcal{G}$. The edges in $\mathcal{G}$ can be deduced from Figure 4 along the lines of the proof of Lemma A.1. As in proof of Lemma A.1, the structure of $\mathcal{G}$ ensures that, for each edge $uv$ in the original graph $G$, each copy of $u$ receives messages from exactly one copy of $v$ in $\mathcal{G}$. This allows us to create an algorithm for $\mathcal{G}$ corresponding to $\mathcal{A}$ as follows. For each node $u\in G$, if $\mathcal{G}$ has one copy of $u$ then $u$ runs $\mathcal{A}_{u}$. Otherwise there are two copies $u_{0}$ and $u_{1}$ of $u$. Both $u_{0}$ and $u_{1}$ run $\mathcal{A}_{u}$.

Consider an execution $\mathcal{E}$ of the above algorithm on $\mathcal{G}$ as follows. Each node in $W_{0}\cup T_{0}\cup F^{1}\cup S$ has input [math] and the remaining nodes have input $1$. As in proof of Lemma A.1, we will show that the algorithm does indeed terminate but nodes do not reach agreement in $\mathcal{G}$, which will be useful in deriving the desired contradiction. We use $\mathcal{E}$ to describe three executions $E_{1}$, $E_{2}$, and $E_{3}$ of $\mathcal{A}$ on the original graph $G$ as follows.

1. $E_{1}$:

$F^{2}\cup R$ is the set of faulty nodes and they are all non-equivocating faulty nodes. In each round, a faulty node in $F^{2}\cup R$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. All non-faulty nodes have input [math]. Note that the behavior of non-faulty nodes in $S\cup F^{1}$, $T$, and $W$ is modelled by the corresponding (copies of) nodes in $S\cup F^{1}$, $T_{0}$, and $W_{0}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $S\cup F^{1}\cup T\cup W$ decide on output [math] (by validity) in finite time. 2. $E_{2}$:

$F^{1}$ is the set of non-equivocating faulty nodes and $T$ is the set of equivocating faulty nodes. In each round, a non-equivocating faulty node in $F^{1}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. Recall that a equivocating faulty node in $T$ has the capability of point-to-point communication with its neighbors. The communication by equivocating faulty nodes in $T$ to its neighbors in $S$ is the same as that by the corresponding copy in $T_{0}$ and to the remaining non-faulty neighbors is the same as that by the corresponding copy in $T_{1}$ in execution $\mathcal{E}$. $S$ has input [math] and all the remaining non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $S\cup F^{2}$, $R$ and $W$ is modelled by the corresponding (copies of) nodes in $S\cup F^{2}$, $R$, and $W_{1}$, respectively, in $\mathcal{E}$. The output of the non-faulty nodes will be described later. 3. $E_{3}$:

$F^{1}\cup S$ is the set of faulty nodes and they are all non-equivocating faulty nodes. In each round, a faulty node in $F^{1}\cup S$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. All non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $R\cup F^{2}$, $T$, and $W$ is modelled by the corresponding (copies of) nodes in $R\cup F^{2}$, $T_{1}$, and $W_{1}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $F^{2}\cup R\cup T\cup W$ decide on output $1$ (by validity) in finite time.

Due to the output of nodes in $S$ in $E_{1}$, the nodes in $S$ output [math] in $\mathcal{E}$. Similarly, due to the output of nodes in $R$ in $E_{3}$, the nodes in $R$ output $1$ in $\mathcal{E}$. It follows that in $E_{2}$, nodes in $R$ as modeled by $R$ in $\mathcal{E}$ output $1$ while $S$ outputs [math]. Recall that, by construction, both $S$ and $R$ are non-empty. This violates agreement, a contradiction.

$\Box$

Lemma D.2**.**

If there exists a Byzantine consensus algorithm under the hybrid model on a graph $G$ tolerating at most $f$ Byzantine faulty nodes, of which at most $t$ are equivocating faulty nodes, then $G$ is $(\left\lfloor{3(f-t)/2}\right\rfloor+2t+1)$-connected.

Proof:   Suppose for the sake of contradiction that $G$ is not $(\left\lfloor{3(f-t)/2}\right\rfloor+2t+1)$-connected and there exists an algorithm $\mathcal{A}$ that solves Byzantine consensus under the hybrid model on $G$. Let $\varphi=f-t$. Let $C$ be a vertex cut of $G$ of size at most $\left\lfloor{3\varphi/2}\right\rfloor+2t$ with a partition $(A,B,C)$ of $V$ such that $A$ and $B$ (both non-empty) are disconnected in $G-C$ (so there is no edge between a node in $A$ and a node in $B$). Since $\mathinner{\!\left\lvert C\right\rvert}\leq\left\lfloor{3\varphi/2}\right\rfloor+2t$, there exists a partition $(C^{1},C^{2},C^{3},R,T)$ of $C$ such that $\mathinner{\!\left\lvert C^{1}\right\rvert},\mathinner{\!\left\lvert C^{2}\right\rvert}\leq\left\lfloor{\varphi/2}\right\rfloor$, $\mathinner{\!\left\lvert C^{3}\right\rvert}\leq\left\lceil\varphi/2\right\rceil$, and $\mathinner{\!\left\lvert R\right\rvert},\mathinner{\!\left\lvert T\right\rvert}\leq t$. Recall that $\mathcal{A}$ outlines a procedure $\mathcal{A}_{u}$ for each node $u$ that describes $u$’s state transitions in each round.

Similar to the proof of Lemma A.1, we first create a network $\mathcal{G}$ to model behavior of nodes in $G$ in three different executions $E_{1}$, $E_{2}$, and $E_{3}$, which we will describe later. $\mathcal{G}$ consists of two copies of each node in $A$, $B$, $R$, and $T$, and a single copy of the remaining nodes. Figure 5 depicts $\mathcal{G}$. The edges in $\mathcal{G}$ can be deduced from Figure 5 along the lines of the proof of Lemma A.1. As in proof of Lemma A.1, the structure of $\mathcal{G}$ ensures that, for each edge $uv$ in the original graph $G$, each copy of $u$ receives messages from exactly one copy of $v$ in $\mathcal{G}$. This allows us to create an algorithm for $\mathcal{G}$ corresponding to $\mathcal{A}$ as follows. For each node $u\in G$, if $\mathcal{G}$ has one copy of $u$ then $u$ runs $\mathcal{A}_{u}$. Otherwise there are two copies $u_{0}$ and $u_{1}$ of $u$. Both $u_{0}$ and $u_{1}$ run $\mathcal{A}_{u}$.

Consider an execution $\mathcal{E}$ of the above algorithm on $\mathcal{G}$ as follows. Each node in $A_{0}$, $B_{0}$, $R_{0}$, $T_{0}$, and $C^{1}$ has input [math] and the remaining nodes have input $1$. As in proof of Lemma A.1, we will show that the algorithm does indeed terminate but nodes do not reach agreement in $\mathcal{G}$, which will be useful in deriving the desired contradiction. We use $\mathcal{E}$ to describe three executions $E_{1}$, $E_{2}$, and $E_{3}$ of $\mathcal{A}$ on the original graph $G$ as follows.

1. $E_{1}$:

$C^{2}\cup C^{3}$ is the set of non-equivocating faulty nodes and $T$ is the set of equivocating faulty nodes. In each round, a non-equivocating faulty node in $C^{2}\cup C^{3}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. Recall that a equivocating faulty node in $T$ has the capability of point-to-point communication with its neighbors. The communication by equivocating faulty nodes in $T$ to its neighbors in $A$ is the same as that by the corresponding copy in $T_{1}$ and to the remaining non-faulty neighbors is the same as that by the corresponding copy in $T_{0}$ in execution $\mathcal{E}$. All non-faulty nodes have input [math]. Note that the behavior of non-faulty nodes in $A$, $B$, $R$, and $C^{1}$ is modelled by the corresponding (copies of) nodes in $A_{0}$, $B_{0}$, $R_{0}$, and $C^{1}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $A\cup B\cup R\cup C^{1}$ decide on output [math] (by validity) in finite time. 2. $E_{2}$:

$C^{1}\cup C^{3}$ is the set of non-equivocating faulty nodes and $R$ is the set of equivocating faulty nodes. In each round, a non-equivocating faulty node in $C^{1}\cup C^{3}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. The communication by equivocating faulty nodes in $R$ to its neighbors in $A$ is the same as that by the corresponding copy in $R_{0}$ and to the remaining non-faulty neighbors is the same as that by the corresponding copy in $R_{1}$ in execution $\mathcal{E}$. $A$ has input [math] and all the remaining non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $A$, $B$, $T$, and $C^{2}$ is modelled by the corresponding (copies of) nodes in $A_{0}$, $B_{1}$, $T_{1}$, and $C^{2}$, respectively, in $\mathcal{E}$. The output of the non-faulty nodes will be described later. 3. $E_{3}$:

$C^{1}\cup C^{2}$ is the set of non-equivocating faulty nodes and $T$ is the set of equivocating faulty nodes. In each round, a non-equivocating faulty node in $C^{1}\cup C^{2}$ broadcasts the same messages as the corresponding node in $\mathcal{G}$ in execution $\mathcal{E}$ in the same round. The communication by equivocating faulty nodes in $T$ to its neighbors in $B$ is the same as that by the corresponding copy in $T_{1}$ and to the remaining non-faulty neighbors is the same as that by the corresponding copy in $T_{0}$ in execution $\mathcal{E}$. All non-faulty nodes have input $1$. Note that the behavior of non-faulty nodes in $A$, $B$, $R$, and $C^{3}$ is modelled by the corresponding (copies of) nodes in $A_{1}$, $B_{1}$, $R_{1}$, and $C^{3}$, respectively, in $\mathcal{E}$. Since $\mathcal{A}$ solves Byzantine consensus on $G$, nodes in $A\cup B\cup R\cup C^{3}$ decide on output $1$ (by validity) in finite time.

Due to the output of nodes in $A$ in $E_{1}$, the nodes in $A_{0}$ output [math] in $\mathcal{E}$. Similarly, due to the output of nodes in $B$ in $E_{3}$, the nodes in $B_{1}$ output $1$ in $\mathcal{E}$. It follows that in $E_{2}$, nodes in $A$ as modeled by $A_{0}$ in $\mathcal{E}$ output [math] while nodes in $B$ as modeled by $B_{1}$ output $1$. Recall that, by construction, both $A$ and $B$ are non-empty. This violates agreement, a contradiction.

$\Box$

We now prove the necessity of the conditions in Theorem 6.1. The sufficiency is proved in the next section.

Proof of necessity of the conditions in Theorem 6.1:   Condition (i) follows from Lemma D.2. For $t=0$ condition (ii) follows from Lemma A.1 and for $t>0$ condition (iii) follows from Lemma D.1. $\Box$

D.2 Sufficiency of the conditions in Theorem 6.1

In this section, we assume that the graph $G$ satisfies the conditions in Theorem 6.1. To prove sufficiency of the conditions in Theorem 6.1, we modify Algorithm 1 for the hybrid setting. The formal procedure is given in Algorithm 3.

For correctness, we follow the same ideas as the proof of Theorem 5.1. We assume that $t>0$ in the proof since Algorithm 3 is the same as Algorithm 1 when $t=0$. We follow the same strategy as in Section 5.2. Let $T^{*}$ be the actual equivocating faulty set of size at most $t$ and $F^{*}$ the actual non-equivocating faulty set of size at most $f-\mathinner{\!\left\lvert T^{*}\right\rvert}$.

Similar to Observation B.1, the following follows from the rules used for flooding.

Observation D.3**.**

For any phase of Algorithm 3, in step (a) for any two nodes $u,v\in V-T^{*}$ (possibly non-equivocating faulty), if $v$ receives value $b$ along a fault-free $uv$-path then $u$ broadcast the value $b$ to its neighbors during flooding.

The next two lemmas state that the paths identified in steps (b) and (c), respectively, do indeed exist.

Lemma D.4**.**

For any choice of sets $F$ and $T$ in Algorithm 3, and any two nodes $u,v$, there exists a $uv$-path that excludes $F\cup T$.

Proof:   Recall that a path is said to exclude $F\cup T$ if none of the internal nodes in the path belong to $F\cup T$. Since $G$ is $(\left\lfloor{3(f-t)/2}\right\rfloor+2t+1)$-connected, by Menger’s Theorem, there are at least $(\left\lfloor{3(f-t)/2}\right\rfloor+2t+1)$ node-disjoint paths between any two nodes $u,v$. For any $f,t$ such that $0\leq t\leq f$, we have that $\left\lfloor{3(f-t)/2}\right\rfloor+2t+1\geq(f-t)+t+1=f+1$. Thus, there are at least $f+1$ node-disjoint $uv$-paths, of which at least one path must exclude $F\cup T$, since $\mathinner{\!\left\lvert F\cup T\right\rvert}\leq f$.

$\Box$

Lemma D.5**.**

For any non-faulty node $v$ and any given phase of Algorithm 3 with the corresponding sets $F$ and $T$, in step (c), if $v\in B_{v}$, then there exist $f+1$ node-disjoint $A_{v}v$-paths that exclude $F\cup T$.

Proof:   Fix a phase in the algorithm and the corresponding sets $F$ and $T$. Let $\varphi=f-\mathinner{\!\left\lvert T\right\rvert}$ as in the algorithm. Consider an arbitrary non-faulty node $v$ such that $v\in B_{v}$ in step (c). There are 4 cases to consider, corresponding to the 4 cases in step (c). Note that neither $A_{v}$ nor $B_{v}$ contain any node from $T$.

1. Case 1:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}\leq\left\lfloor{\varphi/2}\right\rfloor$ and $\mathinner{\!\left\lvert N_{v}\right\rvert}>f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$. Therefore there exist at least $f+1$ nodes in $A_{v}$. Node $v$ selects $f+1$ nodes $A^{\prime}_{v}$ from $A_{v}$ by choosing all nodes from $A_{v}\cap F$ and the rest arbitrarily from $A_{v}-F$. Define $B^{\prime}_{v}=B_{v}\cap(F-v)$. Now, $\mathinner{\!\left\lvert B^{\prime}_{v}\right\rvert}\leq\mathinner{\!\left\lvert B_{v}\cap F\right\rvert}=\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}\leq\left\lfloor{\varphi/2}\right\rfloor$ by assumption of case 1. Since $G$ is $(\left\lfloor{3(f-t)/2}\right\rfloor+2t+1)$-connected, the vertex connectivity of $G-T-B^{\prime}_{v}$ is at least

[TABLE]

So there exist $f+1$ node-disjoint $A^{\prime}_{v}v$-paths in $G-T-B^{\prime}_{v}$. Furthermore, since all the nodes in $A_{v}\cap F$ are endpoints in these paths and $F=(A_{v}\cap F)\cup(B_{v}\cap F)$, we have that these paths exclude222Recall that a path is said to exclude $X$ if none of the internal nodes in the path belong to $X$. $F\cup T$. 2. Case 2:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}\leq\left\lfloor{\varphi/2}\right\rfloor$ and $\mathinner{\!\left\lvert N_{v}\right\rvert}\leq f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$. Recall that $0<t\leq f$ and $\mathinner{\!\left\lvert F\right\rvert}\leq\varphi$. Let $F^{\prime}$ be a maximal set such that

1. (i)

$F^{\prime}\subseteq B_{v}-v$, 2. (ii)

$F^{\prime}\supseteq(F\cap B_{v})-v$, and 3. (iii)

$\mathinner{\!\left\lvert F^{\prime}\right\rvert}\leq\varphi$,

i.e., there is no set $F^{\prime\prime}\supseteq F^{\prime}$ such that

1. (i)

$F^{\prime\prime}\subseteq B_{v}-v$, 2. (ii)

$F^{\prime\prime}\supseteq(F\cap B_{v})-v$, and 3. (iii)

$\mathinner{\!\left\lvert F^{\prime\prime}\right\rvert}\leq\varphi$.

Note that $F^{\prime}$ exists because $\mathinner{\!\left\lvert F\right\rvert}\leq\varphi$. Let $B^{\prime}_{v}=B_{v}-F^{\prime}$. We first show that $\mathinner{\!\left\lvert B^{\prime}_{v}\right\rvert}\leq t$. There are two cases to consider. In the first case, $\mathinner{\!\left\lvert F^{\prime}\right\rvert}<\varphi$. Then $v$ is the only node in $B^{\prime}_{v}=B_{v}-F^{\prime}$ as follows. Suppose there is another node $u\in B^{\prime}_{v}=B_{v}-F^{\prime}$. Then $F^{\prime}\cup\mathinner{\left\{u\right\}}\subseteq B_{v}-v$ and $F^{\prime}\cup\mathinner{\left\{u\right\}}\supseteq F^{\prime}\supseteq(F\cap B_{v})-v$. Moreover, $\mathinner{\!\left\lvert F^{\prime}\cup\mathinner{\left\{u\right\}}\right\rvert}=\mathinner{\!\left\lvert F^{\prime}\right\rvert}+1\leq\varphi$, a contradiction since $F^{\prime}$ is maximal. So we have that $\mathinner{\!\left\lvert B_{v}^{\prime}\right\rvert}=1\leq t$. In the second case, $\mathinner{\!\left\lvert F^{\prime}\right\rvert}=\varphi$, and we have that $\mathinner{\!\left\lvert B_{v}^{\prime}\right\rvert}=\mathinner{\!\left\lvert B_{v}\right\rvert}-\varphi=\mathinner{\!\left\lvert N_{v}\right\rvert}-\varphi\leq f-\varphi=\mathinner{\!\left\lvert T\right\rvert}\leq t$.

We construct a graph $H$ from $G-T-F^{\prime}$ as follows. Remove all edges $uw$ such that both $u,w\in A_{v}$. Add a node $r$ with edges to all nodes in $A_{v}$. We first show that $H$ has $f+1$ node-disjoint $rv$-paths. So suppose, for the sake of contradiction, that $H$ does not have $f+1$ node-disjoint $rv$-paths. Then by Menger’s Theorem, there exists an $rv$-cut $C$ of size at most $f$. This partitions $H-C$ into $(R,S)$ such that $R$ and $S$ are both non-empty and disconnected with $r\in R$ and $v\in S$. Since $r$ has an edge to each node in $A_{v}$, we have that $S\subseteq B_{v}^{\prime}$ and so $\mathinner{\!\left\lvert S\right\rvert}\leq t$. All the neighbors of $S$ in $H$ are contained entirely in $C$333Recall that neighbors of $S$ are nodes outside of $S$ that have an edge to some node in $S$.. Since no edge incident to any node in $B_{v}^{\prime}$ in $G$ was removed when constructing graph $H$, so all the neighbors of $S$ in $G$ are contained entirely in $C\cup T\cup F^{\prime}$. It follows that $S$ has at most $f+\mathinner{\!\left\lvert T\right\rvert}+\varphi=f+\mathinner{\!\left\lvert T\right\rvert}+f-\mathinner{\!\left\lvert T\right\rvert}=2f$ neighbors in $G$, a contradiction with the condition (iii) in Theorem 6.1.

We now show that $f+1$ node-disjoint $rv$-paths in $H$ imply that there are $f+1$ node-disjoint $A_{v}v$-paths in $G$ that exclude $F\cup T$. Observe that an $rv$-path $P$ in $H$ can have more than one node from $A_{v}$. However, since $r$ has an edge to each node in $A_{v}$, a shorter sub-path $P^{\prime}$ exists that contains only the last node from $A_{v}$ in $P$. Furthermore, if a path $Q$ and $P$ are node-disjoint, then so are $Q$ and $P^{\prime}$. So there exist $f+1$ node-disjoint $rv$-paths that each contain exactly one node from $A_{v}$. By removing the endpoint $r$ from each of these paths, we get $f+1$ node-disjoint $A_{v}v$-paths. Since each of these paths have exactly one node from $A_{v}$, this must necessarily be an endpoint. So each of these paths exclude $A_{v}$. By construction of $H$, these paths exist in $G-T-F^{\prime}$ and so exclude $F^{\prime}$ and $T$ as well.

Now, $A_{v}\supseteq A_{v}\cap F$ and $F=(A_{v}\cap F)\cup(B_{v}\cap F)$. Recall that $F^{\prime}\supseteq(B_{v}\cap F)-v$. It follows that the $f+1$ node-disjoint $A_{v}v$-paths above exclude $A_{v}\cup F^{\prime}\cup T\supseteq(F-v)\cup T$. Since $v$ can only be an endpoint in these paths, we have that these $f+1$ node-disjoint $A_{v}v$-paths exclude $F\cup T$, as required. 3. Case 3:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}>\left\lfloor{\varphi/2}\right\rfloor$ and $\mathinner{\!\left\lvert Z_{v}\right\rvert}>f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$. We have that

[TABLE]

So this case is the same as Case 1 with the roles of $Z_{v}$ and $N_{v}$ swapped. 4. Case 4:

$\mathinner{\!\left\lvert Z_{v}\cap F\right\rvert}>\left\lfloor{\varphi/2}\right\rfloor$ and $\mathinner{\!\left\lvert Z_{v}\right\rvert}\leq f$. Then $A_{v}\mathrel{\mathop{\mathchar 58\relax}}=N_{v}$ and $B_{v}\mathrel{\mathop{\mathchar 58\relax}}=Z_{v}$. From the analysis in Case 3, we have that $\mathinner{\!\left\lvert N_{v}\cap F\right\rvert}\leq\left\lfloor{\varphi/2}\right\rfloor$. So this case is the same as Case 2 with the roles of $Z_{v}$ and $N_{v}$ swapped.

So we have that there do exist $f+1$ node-disjoint $A_{v}v$-paths that exclude $F\cup T$.

$\Box$

The next lemma states that in any phase, the state of a non-faulty node at the end of the phase equals the state of some non-faulty node at the beginning of the phase.

Lemma D.6**.**

For any non-faulty node $v$, its state $\gamma_{v}$ at the end of any given phase equals the state of some non-faulty node at the start of that phase.

Proof:   Fix a phase in the algorithm and the corresponding sets $F$ and $T$. For any node $u$, we denote the state at the beginning of the phase by $\gamma_{u}^{\operatorname{start}}$ and the state at the end of the phase by $\gamma_{u}^{\operatorname{end}}$. Consider an arbitrary non-faulty node $v$ and the sets $A_{v}$ and $B_{v}$ in step (c). If $\gamma_{v}^{\operatorname{start}}=\gamma_{v}^{\operatorname{end}}$, then the claim is trivially true. So suppose $v\in B_{v}$ and $v$ receives identical value along $f+1$ node-disjoint $A_{v}v$-paths in step (a). Since the number of faulty nodes is at most $f$, at least one of these paths is both fault-free and has a non-faulty endpoint (other than $v$), say $u$. By Observation D.3, it follows that whatever value is received by $v$ along this path in step (a) is the value flooded by $u$. Therefore, $\gamma_{v}^{\operatorname{end}}=\gamma_{u}^{\operatorname{start}}$, where $u$ is a non-faulty node, as required.

$\Box$

Next, we show that when the sets $F$ and $T$ are properly selected, all non-faulty nodes reach agreement in that phase.

Lemma D.7**.**

Consider the unique phase of the Algorithm 3 where $F=F^{*}$ and $T=T^{*}$. At the end of this phase, every pair of non-faulty nodes $u,v\in V$ have identical state, i.e., $\gamma_{u}=\gamma_{v}$.

Proof:   Consider the unique phase of the algorithm where $F=F^{*}$ and $T=T^{*}$. By choice of $T$, all equivocating faulty nodes are in $T$ so each node in $V-T$ floods one value, and one value only, in step (a) of the phase. Let $Z\subseteq V-T$ be the set of nodes that flooded [math] in step (a) and let $N\subseteq V-T$ be the set of nodes that flooded $1$ in step (a). We first show that for any non-faulty node $v$, $Z_{v}=Z$ and $N_{v}=N$. Consider an arbitrary node $w\in V-T$ that flooded [math] (resp. $1$) in step (a) of this phase. Note that $w\in Z$ (resp. $w\in N$). Observe that $P_{wv}$ identified in step (b) of the phase excludes $T\cup F$ and is fault-free. Therefore, by Observation D.3, $v$ receives [math] (resp. $1$) along $P_{wv}$ and correctly puts $w$ in the set $Z_{v}$ (resp. $N_{v}$), as required.

It follows that for any two non-faulty nodes $u$ and $v$, we have that $Z_{u}=Z_{v}=Z$ and $N_{u}=N_{v}=N$. Thus $A_{u}=A_{v}$ and $B_{u}=B_{v}$. Let $A\mathrel{\mathop{\mathchar 58\relax}}=A_{u}$ and $B\mathrel{\mathop{\mathchar 58\relax}}=B_{u}$. Since $T=T^{*}$ has no non-faulty node, a non-faulty node is either in $A$ or in $B$. First note that $A$ is always non-empty as follows. If $B$ is empty, then $A=V-T$ is non-empty since $n>f$. If $B$ is non-empty, then let $w\in B$ be a node in $B$. By Lemma D.5, there exist $f+1$ node-disjoint $Aw$-paths, which implies that $\mathinner{\!\left\lvert A\right\rvert}\geq f+1$. Now all nodes in $A$ flooded identical value in step (a), say $\alpha$. If $u\in A$, then $u$’s state is $\alpha$ at the beginning of the phase and stays unchanged in step (c). Therefore, at the end of the phase $\gamma_{u}=\alpha$. If $u\in B$, then observe that the $f+1$ node-disjoint $Au$-paths identified by $u$ in step (c) are all fault-free. By Observation D.3, it follows that $u$ receives $\alpha$ identically along these $f+1$ paths and so, at the end of the phase, $\gamma_{u}=\alpha$. Similarly for $v$, we have that $\gamma_{v}=\alpha$, as required.

$\Box$

We now have all the necessary ingredients to prove the sufficiency portion of Theorem 6.1.

Proof of Theorem 6.1:   The necessity of the conditions in Theorem 6.1 were proven in Appendix D.1. For sufficiency, we prove the correctness of Algorithm 3.

The algorithm terminates in finite time because the number of phases is finite and flooding in each phase completes in finite time. Thus, the algorithm satisfies the termination condition.

Since there are at most $f$ faulty nodes with at most $t$ equivocating faulty nodes in any given execution, there exists at least one phase in which sets $F=F^{*}$ and $T=T^{*}$. Then, from Lemma D.7, we have that all non-faulty nodes have the same state at the end of this phase. Lemma D.6 implies that the state of the non-faulty nodes will remain unchanged after any subsequent phases. Therefore, all non-faulty nodes will have the same state at the end of the algorithm, and their output will be identical. This proves that the algorithm satisfies the agreement condition.

At the start of phase 1, the state of each non-faulty node equals its own input. Now, applying Lemma D.6 inductively implies that the state of a non-faulty node always equals the input of some non-faulty node. This, in turn, implies that the algorithm satisfies the validity condition. Thus, we have proved correctness of Algorithm 3 under the conditions stated in Theorem 6.1. $\Box$