Consensus on Bitsy Wiki

Nakamoto Consensus

Mon, 01 Jan 0001 00:00:00 +0000

Nakamoto consensus is the rule by which Bitcoin’s nodes agree on one history of transactions. Among all the valid chains of blocks a node has seen, it treats the one with the most accumulated proof of work as the true history, and it tries to add its own next block to the end of that chain. A block may be added by whoever first solves a hash puzzle built on the previous block.

GHOST

Mon, 01 Jan 0001 00:00:00 +0000

GHOST is a rule for choosing which chain of blocks is the true one when a blockchain has forked. It starts at the first block and repeatedly steps to the child block whose subtree is heaviest, where a block’s subtree is the block plus everything built on top of it on any branch. It stops at a block with no children, and the path it walked is the chain.

The name stands for Greedy Heaviest-Observed Sub-Tree (GHOST). Sompolinsky and Zohar proposed it in 2013 as a replacement for the longest-chain rule of Nakamoto consensus, which weighs each competing chain by its own blocks alone. Under GHOST a block on an abandoned side branch still adds weight to every ancestor it shares with the main chain. In the paper’s words, “blocks that are off the main chain can still contribute to its weight.”

GHOSTDAG

Mon, 01 Jan 0001 00:00:00 +0000

GHOSTDAG is a proof-of-work consensus protocol in which each new block references every block its miner knows of that nothing references yet. The blocks therefore form a directed acyclic graph (DAG) where Bitcoin has a single chain, and no block is thrown away. The protocol’s job is to turn that graph into one ordered list of blocks that every node computes identically, with blocks from miners who followed the rules placed ahead of blocks an attacker built in secret.

Ouroboros

Mon, 01 Jan 0001 00:00:00 +0000

Ouroboros is a family of proof-of-stake consensus protocols built on the longest-chain rule. Time is divided into fixed slots. In each slot a lottery weighted by stake decides which stakeholders, if any, may add a block, and every node follows the longest valid chain. It is Nakamoto consensus with a stake lottery where Bitcoin has a hash puzzle. Cardano runs it.

Kiayias, Russell, David and Oliynykov presented the first version as “the first blockchain protocol based on proof of stake with rigorous security guarantees”. Three versions carry the design:

PBFT

Mon, 01 Jan 0001 00:00:00 +0000

Practical Byzantine Fault Tolerance (PBFT) is a protocol by which a fixed group of servers, called replicas, execute the same client requests in the same order while some of the replicas misbehave. The misbehaviour it covers is arbitrary: a faulty replica may crash, send different messages to different peers, or be run by an attacker. Faults of that kind are called Byzantine. With 3f + 1 replicas the protocol tolerates f faulty ones, so four replicas survive one fault and seven survive two.

Tendermint

Mon, 01 Jan 0001 00:00:00 +0000

Tendermint is a consensus algorithm for blockchains in which a set of validators, each holding some amount of voting power, agrees on one block for each position in the chain, and a block is final as soon as it is agreed. It tolerates Byzantine faults, meaning validators that crash, lie or collude, provided the faulty validators hold less than one third of the total voting power. On a proof-of-stake chain a validator’s voting power is its stake.

HotStuff

Mon, 01 Jan 0001 00:00:00 +0000

HotStuff is a Byzantine fault tolerant (BFT) consensus protocol run by a fixed set of servers, called replicas, in which one replica at a time, the leader, proposes a block and gathers the other replicas’ votes on it into a single compact proof called a quorum certificate. A Byzantine fault is an arbitrary one: a replica that crashes, lies or colludes. With n = 3f + 1 replicas the protocol tolerates f of them. Yin, Malkhi, Reiter, Gueta and Abraham first posted it in 2018.

Casper FFG

Mon, 01 Jan 0001 00:00:00 +0000

Casper the Friendly Finality Gadget (FFG) is a voting protocol that runs on top of a blockchain and marks some of its blocks as final. Validators, who have each locked up a deposit, vote on checkpoints: blocks picked out at regular intervals. A checkpoint that collects votes from two thirds of the deposited stake, in a pattern that takes two rounds, is finalized, and nodes will not revert it afterwards.

BABE and GRANDPA

Mon, 01 Jan 0001 00:00:00 +0000

Polkadot splits consensus between two protocols that run side by side. Blind Assignment for Blockchain Extension (BABE) decides which validator produces each block. GRANDPA decides which blocks are final. The Polkadot Wiki expands GRANDPA as “GHOST-based Recursive ANcestor Deriving Prefix Agreement”.

BABE on its own would give a chain like Bitcoin’s, in which a block is only ever probably permanent. GRANDPA is a finality gadget: a voting protocol among the validators that marks a block as final, after which no node will revert it.

Algorand Consensus

Mon, 01 Jan 0001 00:00:00 +0000

Algorand’s consensus protocol is a Byzantine agreement protocol in which every step of every round is carried out by a different committee, drawn by a private lottery from all accounts in proportion to the currency they hold. Byzantine agreement is agreement among participants some of whom may lie or collude. A round produces one block.

An account finds out that it is on a committee by evaluating a verifiable random function (VRF) on its own secret key and a public value from the chain. A VRF returns a pseudo-random output together with a proof, checkable with the public key, that the output is correct. Nobody else knows the account was selected until it broadcasts its vote with the proof attached. Each member speaks once, and the next step has a new committee.

Avalanche Consensus

Mon, 01 Jan 0001 00:00:00 +0000

Avalanche consensus is a family of protocols in which a node reaches a decision by polling. Faced with two conflicting options, the node repeatedly asks a small random sample of the other validators which one they prefer, adopts the answer when a large enough majority of the sample agrees, and treats the matter as decided once the same answer has come back enough times in a row. There is no leader, and no step in which every validator hears from every other.

DAG-Based BFT

Mon, 01 Jan 0001 00:00:00 +0000

DAG-based BFT is a class of Byzantine fault tolerant (BFT) consensus protocols in which every validator proposes a block in every round, each block references most of the blocks of the round before, and the validators work out one agreed order for all the blocks from the shape of the resulting graph. Because references only point backwards, the graph is a directed acyclic graph (DAG). Byzantine fault tolerant means the protocol works while up to f of its 3f + 1 validators behave arbitrarily, including lying.

Hashgraph

Mon, 01 Jan 0001 00:00:00 +0000

Hashgraph is a consensus algorithm in which the participants never send each other votes. They exchange events, small signed records of who synchronized with whom, and each participant works out from its own copy of those records how every other participant would have voted. Leemon Baird published it in 2016. The Hedera network runs it.

An event is created each time one member receives a synchronization from another. It contains the hashes of two earlier events: the creator’s own previous event, and the latest event of the member who just synchronized with it. It also carries any new transactions the creator wants to submit, the creator’s clock time, and the creator’s signature. Linked by those hashes, the events form a graph, which the paper defines as “a data structure that records who gossiped to whom, and in what order.”

Federated Byzantine Agreement

Mon, 01 Jan 0001 00:00:00 +0000

Federated Byzantine agreement (FBA) is a model of consensus in which there is no global list of validators. Byzantine agreement is agreement among nodes some of which may behave arbitrarily, including dishonestly. Each node chooses for itself which other nodes it relies on, and the sets of nodes able to reach agreement emerge from the combination of everyone’s choices. David Mazières introduced the model in the paper that defines the Stellar Consensus Protocol (SCP). The XRP Ledger works on a related principle, with a trusted list per server.

Proof of History and Tower BFT

Mon, 01 Jan 0001 00:00:00 +0000

Proof of History is a chain of hashes that Solana uses as a clock. One machine runs a hash function over and over, each time feeding in the previous output, and publishes the count and the output at intervals. Because each output is needed to compute the next, the chain can be produced only one step at a time, so a chain of a given length shows that some amount of time went into making it.