# On the Round Complexity of Randomized Byzantine Agreement

## TL;DR

This paper establishes fundamental lower bounds on the number of rounds needed for randomized Byzantine agreement protocols to terminate with high probability, even under trusted setups, highlighting inherent limitations in protocol efficiency.

## Contribution

It provides new lower bounds on the round complexity of Byzantine agreement protocols for various corruption thresholds, including practical protocols, under standard cryptographic assumptions.

## Key findings

- Protocols resilient against n/3 corruptions cannot terminate in one round with high probability.
- Protocols resilient against more than 1/4 corruptions cannot reliably terminate in two rounds.
- Most practical protocols cannot terminate in two rounds if more than 1/3 or 1/4 of parties are corrupted.

## Abstract

We prove lower bounds on the round complexity of randomized Byzantine agreement (BA) protocols, bounding the halting probability of such protocols after one and two rounds. In particular, we prove that: (1) BA protocols resilient against $n/3$ [resp., $n/4$] corruptions terminate (under attack) at the end of the first round with probability at most $o(1)$ [resp., $1/2+ o(1)$]. (2) BA protocols resilient against a fraction of corruptions greater than $1/4$ terminate at the end of the second round with probability at most $1-\Theta(1)$. (3) For a large class of protocols (including all BA protocols used in practice) and under a plausible combinatorial conjecture, BA protocols resilient against a fraction of corruptions greater than $1/3$ [resp., $1/4$] terminate at the end of the second round with probability at most $o(1)$ [resp., $1/2 + o(1)$]. The above bounds hold even when the parties use a trusted setup phase, e.g., a public-key infrastructure (PKI). The third bound essentially matches the recent protocol of Micali (ITCS'17) that tolerates up to $n/3$ corruptions and terminates at the end of the third round with constant probability.