Quantum Byzantine agreement

Byzantine fault tolerant protocols are algorithms that are robust to arbitrary types of failures in distributed algorithms. With the advent and popularity of the Internet, there is a need to develop algorithms that do not require any centralized control that have some guarantee of always working correctly. The Byzantine agreement protocol is an essential part of this task. In this article the quantum version of the Byzantine protocol,[1] which works in constant time is described.

Introduction

The Byzantine Agreement protocol is a protocol in distributed computing. It takes its name from a problem formulated by Lamport, Shostak and Pease in 1982,[2] which itself is a reference to a historical problem. The Byzantine army was divided into divisions with each division being led by a General with the following properties:

(See [3] for the proof of the impossibility result). The problem usually is equivalently restated in the form of a commanding General and loyal Lieutenants with the General being either loyal or a traitor and the same for the Lieutenants with the following properties.

Byzantine Failure and Resilience

Failures in an algorithm or protocol can be categorized into three main types:

  1. A failure to take another execution step in the algorithm: This is usually referred to as a "fail stop" fault.
  2. A random failure to execute correctly: This is called a "random fault" or "random Byzantine" fault.
  3. An arbitrary failure where the algorithm fails to execute the steps correctly (usually in a clever way by some adversary to make the whole algorithm fail) which also encompasses the previous two types of faults; this is called a "Byzantine fault".

A Byzantine resilient or Byzantine fault tolerant protocol or algorithm is an algorithm that is robust to all the kinds of failures mentioned above. For example, given a space shuttle with multiple redundant processors and some of the processors give incorrect data, which processors or sets of processors should be believed? The solution can be formulated as a Byzantine fault tolerant protocol.

Sketch of the Algorithm

We will sketch here the asynchronous algorithm [1] The algorithm works in two phases:

All messages are sent and received in this round.
A coin flipping protocol is a procedure that allows two parties A and B that do not trust each other to toss a coin to win a particular object.

There are two types of coin flipping protocols

Verifiable secret sharing.

The Fail-stop protocol.

Protocol QuantumCoinFlip for player P_i

  1. Round 1 generate the state |Coin_i\rangle =\frac{1}{\sqrt{2}}|0,0,\ldots,0\rangle + \frac{1}{\sqrt{2}}|1,1,\ldots,1\rangle on n qubits and send the kth qubit to the kth player keeping one part
  2. Generate the state |Leader_i\rangle= \frac{1}{n^{3/2}}\sum _{a=1}^{n^3}|a,a,\ldots,a\rangle on n qubits, an equal superposition of the numbers between 1 and n^3.Distribute the n qubits between all the players
  3. Receive the quantum messages from all players and wait for the next communication round, thus forcing the adversary to choose which messages were passed.
  4. Round 2: Measure (in the standard base) all Leader_{j} qubits received in round I. Select the player with the highest leader value (ties broken arbitrarily) as the "leader" of the round. Measure the leader’s coin in the standard base.
  5. Set the output of the QuantumCoinFlip protocol: v_{i} = measurement outcome of the leader’s coin.

The Byzantine protocol.

To generate a random coin assign an integer in the range [0,n-1] to each player and each player is not allowed to choose its own random ID as each player P_k selects a random number s{_{k}^{i}} for every other player P_{i} and distributes this using a verifiable secret sharing scheme.

At the end of this phase players agree on which secrets were properly shared, the secrets are then opened and each player P_i is assigned the value s_i =\sum \, {s_{k}^{i}}{\text{for all secrets properly shared}}\mod n This requires private information channels so we replace the random secrets by the superposition |\phi\rangle =\frac{1}{\sqrt{n}}\sum_{a=0}^{n-1}|a\rangle. In which the state is encoded using a quantum verifiable secret sharing protocol (QVSS).[6] We cannot distribute the state |\phi,\phi,\ldots \phi\rangle since the bad players can collapse the state. To prevent bad players from doing so we encode the state using the Quantum verifiable secret sharing (QVSS) and send each player their share of the secret. Here again the verification requires Byzantine Agreement, but replacing the agreement by the grade-cast protocol is enough.[7][8]

Grade-cast protocol

A grade-cast protocol has the following properties using the definitions in [7] Informally, a graded broadcast protocol is a protocol with a designated player called “dealer” (the one who broadcasts) such that:

  1. If the dealer is good, all the players get the same message.
  2. Even if the dealer is bad, if some good player accepts the message, all the good players get the same message (but they may or may not accept it).

A protocol P is said to be achieve graded broadcast if, at the beginning of the protocol, a designated player D (called the dealer) holds a value v, and at the end of the protocol, every player P_{i} outputs a pair (value_{i}, confidence_{i})
such that the following properties hold: (\forall i, confidence_{i} \in \{0, 1, 2\})

  1. If D is honest, then value_{i} = v and confidence_{i} = 2 for every honest player P_i.
  2. For any two honest players P_{i} and  P_{j}, \vert confidence_{i} - confidence_{j}\vert \leq 1 .
  3. (Consistency) For any two honest players P_{i} and P_{j}, if confidence_{i}> 0 and  confidence_{j}> 0 ,then  value_{i}= value_{j}.

For t < \frac{n}{4} the verification stage of the QVSS protocol guarantees that for a good dealer the correct state will be encoded, and that for any, possibly faulty dealer, some particular state will be recovered during the recovery stage. We note that for the purpose of our Byzantine quantum coin flip protocol the recovery stage is much simpler. Each player measures his share of the QVSS and sends the classical value to all other players. The verification stage guarantees, with high probability, that in the presence of up to t < \frac{n}{4} faulty players all the good players will recover the same classical value (which is the same value that would result from a direct measurement of the encoded state).

Remarks

In 2007, a quantum protocol for Byzantine Agreement was demonstrated experimentally [9] using a four-photon polarization-entangled state. This shows that the quantum implementation of classical Byzantine Agreement protocols is indeed feasible.

References

  1. 1.0 1.1 Michael Ben-Or and Avinatan Hassidim, Fast quantum byzantine agreement,STOC '05: Proceedings of the thirty-seventh annual ACM symposium on Theory of computing, pg 481-485 [2005]
  2. L. Lamport and R. Shostak and M. Pease, The Byzantine Generals Problem, ACM Trans. Program. Lang. Syst., volume 4, number 3, pg 382-401 [1982]
  3. Michael J. Fisher, Nancy A. Lynch,Michael S. Paterson,Impossibility of Distributed Consensus with One Faulty Process, Journal of the ACM volume 32, issue=2, pg 374-382 Impossibility of Distributed Consensus with One Faulty Process[1985]
  4. I. Kerenidis, A. Nayak, coin flipping with small bias, arxiv
  5. Verifiable secret sharing verifiable secret sharing
  6. Claude Cr´epeau, Daniel Gottesman and Adam Smith, Secure Multi-party Quantum Computation, In 34th ACM Symposium on the Theory of Computing, STOC, pg. 643–652, [2002]
  7. 7.0 7.1 Michael Ben-Or, Elan Pavlov, Vinod Vaikuntanathan, Byzantine Agreement in the Full-Information Model in O(log n) Rounds, STOC '06: Proceedings of the thirty-eighth annual ACM symposium on Theory of computing, pg 179-186 [2006]
  8. Pesech Feldman and Silvio Micali. An optimal probabilistic protocol for synchronous byzantine agreement. SIAM J. Comput., pg 873–933, [1997]
  9. Sascha Gaertner, Mohamed Bourennane, Christian Kurtsiefer, Adán Cabello, Harald Weinfurter, Experimental Demonstration of a Quantum Protocol for Byzantine Agreement and Liar Detection, arXiv:0710.0290v2, [2007], Phys. Rev. Lett. 100 (2008) 070504.
This article is issued from Wikipedia - version of the Wednesday, April 29, 2015. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.