Comment
Author: Admin | 2025-04-28
}}\) have been computed either by an honest party in S (due to the definition of \(r_1\)) or, given part (c) of a typical execution, by the adversary in \(S^{\prime }\).Now, define \(\mu\) as in the statement and let x denote the number of blocks from honest parties that are included in the \(\ell\) blocks and, towards a contradiction, assume that \begin{equation*} x\lt \mu \ell \le \mu L . \end{equation*} Then, \begin{equation} Z(S^{\prime }) \ge L-x\gt (1-\mu)L\ge (1-\mu)X(S) \gt (1-\mu)(1-\epsilon)f|S| . \end{equation} (4)The first inequality comes from the fact that the adversary computed \(L-x\) of the L blocks. The second one comes from the postulated relation between x and L. The last one is Lemma 4.6(a). To argue the third one, we assume \(X(S)\gt L\) and contradict property (2). Note that at round \(r_1\) an honest party has produced block \(B_{u^{\prime }-1}\) and so at round \(r_1+1\) has a chain of length at least \(u^{\prime }-1\) (note that this holds also in the case \(B_{u^{\prime }}=B_1\)). By Lemma 4.2, every honest party at round \(r_2\) will adopt a chain of length at least \(u^{\prime }-1+X(S)\gt u^{\prime }-1+L=v^{\prime }\).On the other hand, \(|S|\ge \lambda\) by Lemma 4.8 and so the properties of a typical execution apply for the set of rounds S. Combining the upper bound for \(Z(S^{\prime })\) from Lemma 4.6(b) and recalling the value of \(\mu\), \begin{equation} Z(S^{\prime }) \lt f(|S|+2)\Bigl (\frac{t}{n-t}\cdot \frac{1}{1-f}+\epsilon \Bigr) =(1-\mu)(1-\epsilon)f\cdot \frac{|S|+2}{1+f} . \end{equation} (5)Inequalities \((4)\) and \((5)\) contradict each other in a typical execution, since \(|S|\ge \lambda \ge 2/f\).To verify the lower bound in terms of \(\delta\), note that\[\begin{multline*} \frac{1+f}{(1-f)(1-\epsilon)}\cdot \frac{t}{n-t}+\frac{(1+f)\epsilon }{1-\epsilon } \lt \frac{1}{(1-f)^2(1-\epsilon)}\cdot \frac{t}{n-t}+\frac{\epsilon }{(1-f)(1-\epsilon)} \\ \lt \frac{1}{1-2f-\epsilon }\cdot \frac{t}{n-t}+\frac{\epsilon }{1-f-\epsilon } \lt \frac{1}{1-2\delta /3}\cdot \frac{t}{n-t}+\frac{\delta /3}{1-\delta /3} \end{multline*}\]and recall that the Honest Majority Assumption requires \(3\epsilon +3f\lt \delta\). □Corollary 4.12.In a typical execution the following hold.—Any \(\lceil 2\lambda f\rceil\) consecutive blocks in the chain of an honest party contain at least one honest block.—For any consecutive \(\lambda\) rounds, the chain of an honest party contains an honest block computed in one of these rounds.Proof.Using \(t\le (1-\delta)(n-t)\), we have \(\mu \gt 1-\frac{1-\delta }{1-2\delta /3}-\frac{\delta /3}{1-\delta /3} \gt 0 .\) Since \(\mu \gt 0\), the first item follows from Chain Quality.For the second item, suppose the chain \(\mathcal {C}\) of an honest party contains an honest block B at height \(\ell\) that was computed in round r. Suppose further, towards a contradiction, that
Add Comment