Subject: [Din] [DIN] question about a quorum intersection in SCP

From: Vasiliy Kevroletin <[email-masked]>
Date: Mon, 4 Mar 2019 15:30:26 +0700

Hello, mailing list

*About me*

My name is Vasiliy Kevroletin, currently, I am studying SCP as a part of my work
at serokell.io. I have a question about Stellar network and SCP.

*Short version*

How system ensures (both in practice and in theory), that there will be quorum
intersection despite ill-behaved nodes?

*Long version*

As far as I understand, to guarantee safety, the paper requires FBAS to have
quorum intersection despite ill-behaved nodes (correct me please if I am wrong).
Which, for me, sounds reasonable and similar to the requirement from the
classical PBFT algorithm to have `2*f + 1` well-behaving nodes.

However, the requirement of quorum intersection seems to be more complex
compared to the classical PBFT, because in SCP each node has it's own "trust
preferences" (quorum slices). Which means that the choice of each node
contributes to the security of the whole system. I don't know right terminology,
but I try to visualize union of all quorum slices as a graph and I intuitively
call it as a "trust graph". My question can be reformulated as "how to analyze a
trust graph?". I am interested both in mathematical analysis, experiments and
observing a real-world functioning system.

I am interested in the analysis of "trust graph" to answer more practical
questions:
+ how each node should choose quorum slices? are there any guidelines?
+ does someone have an idea if it possible to get some metrics from the system
  (for example amount of Stake) and automatically propose (or recommend) quorum
  slices for each node?
+ is it possible to somehow analyze existing system and understand that there
  are potential problems with choices of particular nodes? For example, that
  failure of only a few nodes can partition the system

Thank you

--
Best regards,
Vasiliy Kevroletin

---

From: David Mazieres <[email-masked]>
Date: Thu, 14 Mar 2019 00:30:06 -0700

Vasiliy Kevroletin <[email-masked]> writes:

> Hello, mailing list
>
> *About me*
>
> My name is Vasiliy Kevroletin, currently, I am studying SCP as a part
> of my work at serokell.io. I have a question about Stellar network and
> SCP.
>
> *Short version*
>

You don't need to ensure this on a whole system level.  In fact you
can't, because of Sybil attacks, in which an attacker creates fake
nodes.  The point is that everyone keeps agreement with the people they
consider important, and this works transitively.

BTW, you may find our recent Simplified SCP useful if you are looking at
SCP:

        http://www.scs.stanford.edu/~dm/blog/simplified-scp.html

> *Long version*
>
> As far as I understand, to guarantee safety, the paper requires FBAS
> to have quorum intersection despite ill-behaved nodes (correct me
> please if I am wrong).  Which, for me, sounds reasonable and similar
> to the requirement from the classical PBFT algorithm to have `2*f + 1`
> well-behaving nodes.

Sort of, except there's no longer any f.

> + how each node should choose quorum slices? are there any guidelines?

Many applications provide an extrinsic rationale for trust.

For example, if all the certificate authorities ran SCP, no CA wants to
be the one that signed conflicting messages and therefore proved it
couldn't be trusted.  Hence, depending on "all CAs" (even though
different people have different notions of what "all CAs" means) might
be good in some contexts.

Another example, in Stellar, if you have digital dollar tokens backed by
a company like Stronghold or AnchorUSD, you inherently need those
companies to redeem your tokens, so want to put them in your quorum
slices to avoid getting forked from them.

>   (for example amount of Stake) and automatically propose (or recommend) quorum

In a counterparty-free blockchain that would make sense (like Bitcoin or
Ethereum).  For other applications, the replicated state machine might
not have a notion of stake.

>   failure of only a few nodes can partition the system

That question might be worth investigating.

David