FIP-0086 updates from implementation #1022

anorth · 2024-06-18T01:15:38Z

Two notable changes feeding back from the implementation, plus some smaller improvements:

There is not (yet) any mechanism to slow F3 if EC is producing only empty tipsets
The mayHaveStrongQuorum function is changed to treat boundary conditions "correctly"
Described F3 committee lookback
Specified filters to power table eligibility (TODO: confirm with @Stebalien, especially around ticket math)
Specified power scaling/truncation
Specified values for step numbers

Tightened up some language and formatting:

Removed some unnecessary phrases.
Removed lingering tab characters.
Unified commenting style in pseudocode to use //.
Replaced some academic argument-style language (especially use of"we") with declarative statements.

A potentially clarifying change we could make would be a change in terminology from power table & power (EC concepts) to committee and weight (F3 concepts). These terms are currently a bit ambiguous since the concepts are not 1:1. I refrained for now.

FIPS/fip-0086.md

)

FIPS/fip-0086.md

anorth · 2024-06-25T01:51:57Z

FIPS/fip-0086.md

+Given an EC chain state at some epoch, the corresponding F3 committee comprises all miner actors with:
+- at least 10TiB of quality-adjusted power;
+- zero fee debt; and
+- no active consensus fault.


@Kubuxu could you please check the EC leader election and confirm there are no other relevant checks? I'm aware that in EC these are applied against both lookback state and current state: we can only do one.

In the code, I'm using the same rules that apply to the EC election but without the Finality lookback.

That sounds great. Can you please clarify that I have captured those rules here? Are there any more?

There is a caveat about not having enough miners (if there are fewer miners than X, the minimum power no longer applies). Other than that, it is the 3 checks you mentioned.

Should we add that line here that the number of miners must be X to reach consensus?

Should we add that line here that the number of miners must be X to reach consensus?

There's no minimum on the number of participants, except implicitly 1. The protocol would be unable to recover from dropping below any such number.

FIPS/fip-0086.md

* Specify backoff when EC produces empty tipsets Update FIP to backoff when starting a new instance when EC produces empty tipsets. Relates to filecoin-project/go-f3#371 * Document the increment function of start backoff Introduce a function to concretely document the increment of start backoff and explicitly mention that it must be consistent across all participants for a given instance number. Change the start backoff to epochs for a more concrete unit.

anorth · 2024-07-02T21:11:36Z

Thanks for the contributions @masih @Stebalien.

This PR is ready for editorial and detailed technical review, and then merging.

FIPS/fip-0086.md

Kubuxu

LGTM

FIPS/fip-0086.md

jennijuju · 2024-07-15T01:26:13Z

FIPS/fip-0086.md

 * **Liveness.** Implementing F3 introduces the risk that an adversary controlling at least ⅓ QAP prevents termination of a GossiPBFT instance. In that case, the F3 component would halt, not finalizing any tipset anymore. At the same time, EC would still operate, outputting tipsets and considering them final after 900 epochs. The liveness of the system is thus not affected by attacks on the liveness of F3.
 * **Safety.** Implementing F3 ensures the safety of finalized outputs during regular or even congested networks against a Byzantine adversary controlling less than ⅓ QAP. For stronger adversaries, F3 provides mitigations to prevent censorship attacks, as outlined above. If deemed necessary, the punishment and recovery from coalitions in the event of an attempted attack on safety can be explored in future FIPs. Note that the (safe) finality time is already significantly improved by F3 compared to the status quo: F3 provides safety of finalized outputs two orders of magnitude faster than the current parameter of 900 epochs during regular network operation.
 * **Denial-of-service (DoS).** The implementation of the F3 preserves resistance against DoS attacks currently ensured by Filecoin, thanks to the fully leaderless nature of GossiPBFT and to the use of a VRF to self-assign tickets during the CONVERGE step.
-* **Committees.** This FIP proposes to have all participants run all instances of GossiPBFT. While this ensures optimal resilience against a Byzantine adversary, it can render the system unusable if the number of participants grows too large. While we are still evaluating the maximum practical number of participants in F3, it is expected to be at least one order of magnitude greater than the current number of participants in Filecoin. This introduces an attack vector: if the scalability limit is 100,000 participants, a participant holding as little as 3% of the current QAP can perform a Sybil attack to render the system unusable, with the minimum QAP required per identity. As a result, the implementation should favor the messages of the more powerful participants if the number of participants grows too large. Given that favoring more powerful participants discriminates against the rest, affecting decentralization, amending F3 to use committees in the event of the number of participants exceeding the practical limit will be the topic of a future FIP, as well as the analysis of optimized message aggregation in the presence of self-selected committees.
+* **Committees.** This FIP proposes to have all eligible EC participants run all instances of GossiPBFT. While this ensures optimal resilience against a Byzantine adversary, it can render the system unusable if the number of participants grows too large. This introduces an attack vector: if the scalability limit is 100,000 participants, a participant holding as little as 3% of the current QAP can perform a Sybil attack to render the system unusable, with the minimum QAP required per identity. As a result, the implementation should favor the messages of the more powerful participants if the number of participants grows too large. Given that favoring more powerful participants discriminates against the rest, affecting decentralization, amending F3 to use committees in the event of the number of participants exceeding the practical limit might be the topic of a future FIP, as well as the analysis of optimized message aggregation in the presence of self-selected committees.


what's the practical scalability limit today, i.e., if participant # is approaching X, a FIP is necessary to harden the protocol further?

jennijuju · 2024-07-15T01:27:21Z

editorial ✅

jsoares · 2024-07-15T07:59:14Z

I'm hoping to still read through today, assuming it's not merged before.

jsoares

part 1/3

FIPS/fip-0086.md

jsoares

part 2/3

FIPS/fip-0086.md

jsoares · 2024-07-15T17:37:39Z

FIPS/fip-0086.md

@@ -591,32 +656,27 @@ OR (step=COMMIT                                            | valid COMMIT eviden
 OR (step = DECIDE                                          | valid DECIDE evidence
      AND (∃ M: IsStrongQuorum(M) AND evidence=Aggregate(M)| is a strong quorum 
        AND ∀ m’ ∈ M: m’.step = COMMIT                     | of COMMIT messages
-        AND ∀ m’,m'' ∈ M: m’.round = m''.round             | from the same round 
+        AND ∀ m’,m’’ ∈ M: m’.round = m’’.round             | from the same (any) round as each other


Not sure the added "any" contributes to clarity.

FIPS/fip-0086.md

jsoares

3/3

editorial ✅

FIPS/fip-0086.md

Co-authored-by: MollyM <momack2@users.noreply.github.com>

Co-authored-by: Jorge M. Soares <547492+jsoares@users.noreply.github.com>

WIP updating FIP-0086 with implementation.

dc1d325

anorth commented Jun 18, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

Describe SupplementalData updates to the Payload and Certificates (#1024

28ca2e9

)

anorth mentioned this pull request Jun 20, 2024

Final GPBFT protocol alignment with FIP filecoin-project/go-f3#244

Closed

anorth commented Jun 21, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

anorth force-pushed the anorth/86-alignment branch 2 times, most recently from e5b14c9 to 3cb71d2 Compare June 25, 2024 01:02

anorth marked this pull request as ready for review June 25, 2024 01:29

anorth requested review from momack2, arajasek, jennijuju, kaitlin-beegle, raulk, jsoares and TippyFlitsUK as code owners June 25, 2024 01:29

Update FIP-0086 with implementation notes and cleaner formatting.

180e63a

anorth force-pushed the anorth/86-alignment branch from 3cb71d2 to 180e63a Compare June 25, 2024 01:33

anorth commented Jun 25, 2024

View reviewed changes

FIPS/fip-0086.md Show resolved Hide resolved

anorth mentioned this pull request Jun 25, 2024

Filter SP representation in F3 power table by threshold etc filecoin-project/go-f3#346

Closed

anorth commented Jun 25, 2024

View reviewed changes

Kubuxu reviewed Jun 25, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

anorth and others added 2 commits July 2, 2024 08:42

Change mayHaveStrongQuorum to use >= 2/3

3b2c750

masih approved these changes Jul 2, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

Kubuxu approved these changes Jul 5, 2024

View reviewed changes

momack2 reviewed Jul 9, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

momack2 reviewed Jul 9, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

momack2 approved these changes Jul 9, 2024

View reviewed changes

jennijuju reviewed Jul 15, 2024

View reviewed changes

FIPS/fip-0086.md Show resolved Hide resolved

jennijuju reviewed Jul 15, 2024

View reviewed changes

jennijuju approved these changes Jul 15, 2024

View reviewed changes

jsoares reviewed Jul 15, 2024

View reviewed changes

jsoares approved these changes Jul 15, 2024

View reviewed changes

FIPS/fip-0086.md Outdated Show resolved Hide resolved

FIPS/fip-0086.md Outdated Show resolved Hide resolved

FIPS/fip-0086.md Outdated Show resolved Hide resolved

FIPS/fip-0086.md Outdated Show resolved Hide resolved

anorth and others added 3 commits July 16, 2024 09:23

Update FIPS/fip-0086.md

7b984c4

Co-authored-by: MollyM <momack2@users.noreply.github.com>

Apply suggestions from code review

8940b9a

Co-authored-by: Jorge M. Soares <547492+jsoares@users.noreply.github.com>

Review responses.

4069d1c

anorth merged commit ecddc3d into master Jul 15, 2024
1 check passed

anorth deleted the anorth/86-alignment branch July 15, 2024 21:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FIP-0086 updates from implementation #1022

FIP-0086 updates from implementation #1022

anorth commented Jun 18, 2024 •

edited

Loading

anorth Jun 25, 2024

Kubuxu Jun 25, 2024

anorth Jun 25, 2024

Kubuxu Jul 4, 2024

momack2 Jul 9, 2024

anorth Jul 15, 2024

anorth commented Jul 2, 2024

Kubuxu left a comment

jennijuju Jul 15, 2024

jennijuju commented Jul 15, 2024

jsoares commented Jul 15, 2024

jsoares left a comment

jsoares left a comment

jsoares Jul 15, 2024

jsoares left a comment

FIP-0086 updates from implementation #1022

FIP-0086 updates from implementation #1022

Conversation

anorth commented Jun 18, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

anorth commented Jul 2, 2024

Kubuxu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jennijuju commented Jul 15, 2024

jsoares commented Jul 15, 2024

jsoares left a comment

Choose a reason for hiding this comment

jsoares left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jsoares left a comment

Choose a reason for hiding this comment

anorth commented Jun 18, 2024 •

edited

Loading