Pith. sign in

REVIEW 4 major objections 5 minor 57 references

Not eXactly Byzantine: Efficient and Resilient TEE-Based State Machine Replication

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read TEE-based async consensus beats leader-based BFT throughput in every test

desk verdict A solid TEE-based SMR systems paper whose evaluation is worth engaging, but the claimed recovery impossibility only holds for the authors' specific broadcast design, not as a fundamental result. read the letter →

arxiv 2501.11051 v3 pith:DV75UZED submitted 2025-01-19 cs.DC

Marc Leinweber , Hannes Hartenstein This is my paper · ORCID
classification cs.DC
keywords statemachinereplicationByzantinefaulttolerancetrustedexecutionenvironmentasynchronousconsensusDAG-basedcrashrecoverynon-equivocationcommoncoin
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

NxBFT claims that a federation of operators can get Byzantine-grade resilience at crash-fault cost by adopting a "Not eXactly Byzantine" (NxB) operating model: operators do not attack their own TEE, do not tamper with application logic, and allow scheduled synchronous maintenance windows. On top of that model, the paper builds an asynchronous, leaderless, DAG-based state machine replication protocol whose small TEE provides non-equivocation and a private common coin, so every exchanged message can carry new client requests and no leader bottleneck exists. The paper's experiments, across 3 to 40 replicas and network round-trip latencies up to 150 ms, show NxBFT with the highest throughput in every configuration tested, with fault-free decisions in about two network round trips and with throughput degrading at most by $c/n$ when $c$ replicas crash. The paper also establishes an impossibility: in asynchrony, recovering a crashed TEE-based replica cannot be done by quorum-based checkpoint agreement, and liveness of recovery requires synchrony and the participation of all replicas.

What carries the argument

The machinery is NxBFT's layered protocol: a broadcast layer in which each replica proposes one vertex per round referencing $\lfloor n/2\rfloor+1$ vertices of the previous round, a small TEE providing a signature service with an increment-only counter (so each counter value can be used once, eliminating equivocation) and a common coin implemented as a PRNG seeded by XORed setup shares (so wave-root selection is fair, unpredictable, and cheap), and a consensus layer that groups four broadcast rounds into a wave, selects a wave root by the coin, and orders all earlier waves by a deterministic DAG traversal without extra communication. The load-bearing mechanism is that every message performs double duty as both a new client request and a consensus step, and the one-step backfilling-based reliable broadcast replaces echo-based or certificate-based schemes, reducing common-case communication to one $n^2$ all-to-all step per broadcast round. The four-round wave length is essential: the paper proves (and gives a counterexample) that reducing it to three rounds breaks the get-core property needed for liveness at $n>2f$.

What would settle it

Run the recovery protocol with $n=3$ and one deliberately Byzantine replica that never sends a RecoveryProposal; if recovery still completes, the paper's liveness claim is wrong, and if it never completes, the claim that recovery depends on all replicas being reactive is confirmed.

Watch

Extended reading notes

Core claim

The central claim is that the NxB operating model unlocks an asynchronous, graph-based, leaderless SMR protocol, NxBFT, that is both efficient and crash-resilient: correct replicas build a DAG one vertex per round, a TEE-enforced counter-signature prevents equivocation, and a TEE-seeded PRNG serves as a common coin that selects the wave root for deterministic ordering. Because clients unicast to one randomly chosen replica and a single correct response suffices, the load is balanced across all replicas and each broadcast message simultaneously carries client requests, yielding two network round trips between decisions in the fault-free case and one $n^2$ communication step per broadcast round. In direct measurement against MinBFT (static leader) and Chained-Damysus (rotating leader), NxBFT achieves the highest sustained throughput in every tested scenario—up to 178 kOp/s at 40 replicas in a datacenter and 20 kOp/s at 40 replicas with 150 ms round-trip latency—and, unlike the leader-based protocols, its end-to-end latency recovers after actual crash faults. The paper further claims a fundamental boundary: TEE-based crash recovery in asynchrony cannot use quorum-based checkpoint agreement without violating reliable-broadcast totality, so recovery must require all replicas' input and synchrony for liveness.

Load-bearing premise

The load-bearing premise is that operators never attack their own TEE, never tamper with the application logic, and provide sufficiently long synchronous windows for maintenance; if an operator compromises its TEE, the guarantees that each message is unique and that coin values stay secret disappear, and with them the $n>2f$ asynchronous resilience argument.

Editorial extensions

If this is right

  • Adopting the NxB operating model lets an asynchronous DAG-based SMR reach 178 kOp/s at 40 replicas in a datacenter and 20 kOp/s across a 150 ms wide-area network, the best throughput among the three protocols in every configuration tested.
  • Fault-free operation needs only two network round trips per decision, and each broadcast round costs one $n^2$ communication step in the common case, improving on TEE-Rider's $n^2+n^3$ and Narwhal's $3n^2$ patterns.
  • Crash faults are cheap for NxBFT: throughput degrades by at most $c/n$ for c crashed replicas and latency recovers once clients reroute, whereas MinBFT stalls on leader failure and Chained-Damysus's timeouts inflate cumulatively.
  • Recovery of a crashed TEE replica is Byzantine-safe only with all-replica participation, and quorum-based checkpoint agreement is impossible in asynchrony without rollbacks; consequently recovery liveness requires synchrony, which the NxB model provides via scheduled maintenance windows.
  • Liveness with the reduced resilience threshold $n>2f$ requires a wave length of four rounds; shortening to three breaks the get-core property, with a concrete counterexample for $n=5$.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the NxB operating model is accepted, the protocol's real scalability ceiling shifts to payload-dependent cryptographic work and to the memory needed to store the unbounded DAG; the paper's observation that one replica CPU core is saturated at about 25% total server CPU suggests that parallelizing vertex validation at each replica is a direct, testable next step.
  • The impossibility argument points to a general design rule beyond this paper: TEE-based SMR with asynchronous reliable broadcast and $n>f$ cannot recover a replica through quorums, so any system that offers online recovery must either abandon asynchrony for recovery or require all replicas' participation; this explains why leader-based, partially synchronous TEE systems provide recovery while asyn
  • The NXB client model delegates censorship-resistance to random replica choice plus a fallback timer; an extension worth testing is whether application-signed responses and client-side proof of correct behavior are enough to keep liveness under a client that deliberately selects a corrupt replica or under colluding replicas that selectively drop requests.
  • The recovery protocol's all-replica input requirement means one Byzantine replica can block recovery forever; a practical mitigation, not explored in the paper, would be to combine the maintenance-window assumption with a synchrony-bounded timeout after which the recovering replica is expelled and reconfigured out.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes NxBFT, an asynchronous, DAG-based, leaderless State Machine Replication protocol designed for a 'Not eXactly Byzantine' (NXB) operating model in which replicas are equipped with a small TEE that provides non-equivocation via a counter-based signature service and a PRNG-based common coin. Normal-case operation builds one vertex per replica per round, uses backfilling in place of echo-based reliable broadcast, and derives total order from waves of four rounds using a common-coin-selected root; the NXB client model lets each client unicast to a single replica and accept a single response. The paper also claims a fundamental impossibility: quorum-based TEE crash recovery cannot be safe under asynchrony without rollbacks, so recovery must rely on synchrony for liveness and on the participation of all replicas. It evaluates NxBFT against MinBFT and Chained-Damysus under the ABCperf framework for up to 40 replicas and network round-trip latencies up to 150 ms, reporting that NxBFT achieves the highest throughput in all tested configurations, with a latency penalty relative to leader-based protocols and with latency that is only mildly affected by actual crash faults.

Significance. If the correctness and recovery claims hold, NxBFT is a valuable datapoint for TEE-based asynchronous consensus: it demonstrates a practical n>2f design that combines DAG-based ordering with a small enclave, and it provides a systematic throughput-latency comparison against two established TEE-based SMR protocols. The paper ships an implementation and a substantial experimental study with multiple repetitions and a stated sensitivity analysis, and it is explicit about the recovery protocol's liveness dependence on all replicas in App. A.3. The main theoretical contribution, however, is the recovery impossibility; as written, that claim is not established with a formal proof and is tied to the specific immediate-delivery broadcast used by NxBFT. The empirical headline is extensive, but the throughput tables lack variance information, so the significance of the closest performance margins cannot be assessed from the paper alone.

major comments (4)
  1. [Sec. IV-C1] The claimed fundamental impossibility of quorum-based TEE recovery in asynchrony is not established. The argument depends on the specific broadcast design: 'In a TEE-based reliable broadcast with a fault tolerance of n > f, a receiving replica can, on successful signature verification, deliver immediately.' That is the property of NxBFT's backfilling-only broadcast, not of all possible asynchronous TEE-based reliable broadcasts. The paper itself discusses Narwhal in Sec. IV-A3, where delivery is mediated by a quorum certificate of f+1 acknowledgements; with such a layer, a value delivered by a correct replica is witnessed by f+1 replicas and can be supplied as a certificate during recovery. The paper gives no proof that quorum-certificate layers cannot satisfy the no-rollback condition. Therefore the abstract's and Sec. IV-C1's 'fundamental' claim is too strong as stated: at minimum, the argument must be restricted to the chosen broadcast layer, or a formal proof must be given for the general setting.
  2. [Sec. IV-C2 / App. A.3] The recovery protocol is not live under the paper's own Byzantine fault model. The protocol requires n RecoveryProposals before a RecoveryCommit can be issued, and App. A.3 states, 'Obviously, the proposed recovery protocol is only live if all replicas are eventually reactive: Byzantine faulty replicas can stop the recovery procedure by not sending a RecoveryProposal at any time.' Since the consensus layer tolerates up to f < n/2 Byzantine replicas, recovery liveness in NxBFT is guaranteed only when the recovering replica's peers are correct, which is a substantially stronger assumption than the one used for normal-case operation. The paper should either explicitly restrict the recovery guarantee to the NxB operating model and state this restriction in the contributions, or provide a recovery protocol whose liveness does not require all n replicas to cooperate.
  3. [Sec. III-B(c), Sec. IV-A3, Sec. IV-B3] The correctness of the consensus layer is delegated to cited results rather than proved for the modified protocol: Sec. III-B(c) refers to [11, Lemma 3] and [12, Proposition 2], while Sec. IV-A3 replaces TEE-Rider's echo broadcast with backfilling-only reliable broadcast and Sec. IV-B3 replaces a threshold-signature common coin with a TEE PRNG coin. Appendix A gives informal arguments, but no formal proof that the modified broadcast and coin satisfy the hypotheses of the cited lemmas, nor that the wave/commit construction remains correct under the NXB client model. Because the central claim is a correct and resilient SMR protocol, the paper should either supply a precise transfer argument showing which properties are inherited unchanged, or give direct proofs for the modified protocol.
  4. [Sec. V-B, Sec. V-C, Tables I and II] The maximum sustained throughput values that support the headline claim 'NxBFT achieves the highest throughput in all scenarios' are reported as single point estimates without confidence intervals or per-run variance. Figure 4 and Table III provide error bars or confidence intervals for latency and recovery time, but Tables I and II do not report variance for throughput. Some margins are not large enough to be obviously stable under measurement noise (for example, 45 vs 33 kOp/s for n=3 at 150 ms network latency in Table II). Please report run-level throughput distributions, confidence intervals, or a statistical test, or explicitly state which differences are significant under the described measurement methodology.
minor comments (5)
  1. [Fig. 3] The legend appears to contain stray axis-label text ('0 500000'), and the small window on the right is referenced but not explained in the caption; please clean up the figure.
  2. [Footnote 1] The code availability link is a placeholder ('https://blinded.for/review'); the final version should provide the actual repository identifier or DOI.
  3. [Sec. II-B] The name 'Yanadmuri et al.' in the text should be 'Yandamuri et al.' to match reference [32].
  4. [Sec. IV-B1] The phrase 'n synchronous authenticated reliable broadcast instances with a fault tolerance of n > f' is ambiguous; please state precisely what fault-tolerance property is guaranteed during setup when f replicas are faulty.
  5. [Sec. V-C] The text says 'both Chained-Damysus and NxBFT loose this ability'; 'loose' should be 'lose'.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the NXB model is a stated trust assumption, correctness relies on separately published proofs, and the empirical claims are measurements rather than fitted predictions.

full rationale

The paper's derivation chain is not circular. The NxB operating model (Sec. III-A) is an explicit trust assumption, not an output of fitting, so the protocol's design is not a renamed fit. Consensus correctness is inherited from TEE-Rider [11] and DAG-Rider [12]; although [11] is by the same authors, it is a separately published protocol with its own stated proofs, so this is load-bearing self-citation but not circular under the review rules: the cited result is externally inspectable and is not itself justified by the present paper. The recovery 'impossibility' argument (Sec. IV-C1) is a consequence of NxBFT's chosen immediate-delivery reliable broadcast: a correct replica can be the only one to have delivered a value, so a quorum smaller than n can outvote it. That is a valid conditional argument, not an input--output equivalence, but it is overgeneralized because the paper does not rule out quorum-certificate broadcast layers such as Narwhal's, which it discusses in Sec. IV-A3. This is a scope/correctness concern rather than circularity. Appendix A.3 explicitly admits that recovery liveness requires all replicas to be eventually reactive; that limitation weakens the contribution but does not make the derivation self-referential. The evaluation compares NxBFT against MinBFT and Chained-Damysus on a shared harness with manually tuned parameters, so the 'highest throughput in all scenarios' claim is an empirical benchmark result, not a parameter renamed as a prediction.

Assumptions & free parameters 5 free parameters · 7 assumptions · 0 invented entities

The protocol's safety and performance claims rest on TEE non-equivocation and the N XB trust assumptions; all free parameters are experimental tuning choices rather than fitted physical constants. No new particles, forces, dimensions, or ledger entities are introduced; the N XB model is an assumption, not an entity.

free parameters (5)
  • NxBFT/Damysus block size = 100 requests
    Chosen via manual sensitivity analysis (Sec. V-A); the throughput comparison depends on this value.
  • MinBFT block size = 10,000 requests
    Chosen via manual sensitivity analysis; affects MinBFT throughput and latency.
  • Proposal timeout = 0.1 s
    All algorithms propose at least every 0.1 s; tuned parameter used in all experiments.
  • Initial view timeout = 3 s for MinBFT and Damysus
    View-change timeout, chosen parameter described in Sec. V-A.
  • NXB client fallback timeout = 5 s
    Client retry timeout; affects crash recovery behavior and end-to-end latency in the evaluation.
assumptions (7)
  • domain assumption TEEs provide non-equivocation: an enclave signs each message with a unique monotonic counter, and a replica cannot produce two different messages for the same counter.
    Sec. III-A and Sec. IV-B2; if this fails, the n > 2f asynchronous consensus proof does not hold.
  • domain assumption Operators do not attack their own TEE and do not manipulate application business logic.
    Sec. I and Sec. III-A define the N XB operating model; this limits faulty replicas to omission faults and justifies the single-response client model.
  • domain assumption Asynchronous network channels reorder and arbitrarily delay but do not drop messages.
    Sec. III-A; backfilling-based reliable broadcast relies on eventual delivery of messages from correct replicas.
  • domain assumption The PRNG-based common coin is fair, unpredictable until enough replicas toss for a wave, and secret inside the TEE.
    Sec. IV-B3 and Appendix A.2; the coin selects wave roots and drives liveness; no formal proof of PRNG security is included.
  • standard math DAG-Rider/TEE-Rider get-core property holds for wave length four and n > 2f.
    Invoked in Sec. III-B and Sec. VI via [11, Lemma 4] and [12, Proposition 2]; NxBFT relies on these cited theorems for agreement and liveness; not re-proven here.
  • domain assumption Setup and recovery require a synchronous period and participation of all n replicas for liveness.
    Sec. IV-B1 and IV-C2; recovery uses n RecoveryProposals; a Byzantine replica can block recovery, as admitted in Appendix A.3.
  • domain assumption A single client response suffices; clients choose one replica at random and retry after a fallback timeout.
    Sec. IV-A1 defines the N XB client model; this assumption enables load balancing and the n-fold throughput scaling.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Not eXactly Byzantine: Efficient and Resilient TEE-Based State Machine Replication." pith.science (2026). https://pith.science/paper/DV75UZED

@misc{pith2026250111051,
  author       = {Pith},
  title        = {Pith review of: Not eXactly Byzantine: Efficient and Resilient TEE-Based State Machine Replication},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DV75UZED}},
  note         = {Machine review of arXiv:2501.11051}
}
read the original abstract

We propose, implement, and evaluate NxBFT, a resilient and efficient State Machine Replication protocol using Trusted Execution Environments (TEEs). NxBFT focuses on a "Not eXactly Byzantine" (NxB) operating model as a middle ground between crash and Byzantine fault tolerance. NxBFT's consensus layer is asynchronous, graph-based, leaderless, and optimized for the NxB operating model, enabling load-balancing of requests between replicas and, in fault-free cases, two network round trips between decisions. We identify fundamental issues with crash recovery due the use of TEEs in asynchrony that only can be circumvented by relying on synchrony for liveness. We provide a throughput-latency trade-off analysis of NxBFT, Chained-Damysus (rotating leader), and MinBFT (static leader) for up to 40 replicas and network round trip latencies up to 150 ms. NxBFT achieves the highest throughput in all scenarios. When small latencies are required, MinBFT and Damysus are at an advantage with Damysus benefiting from the NxB model in terms of throughput for small deployments. In contrast to leader-based approaches, NxBFT's performance is almost not impacted when actual crash faults occur.

Figures

Figures reproduced from arXiv: 2501.11051 by the authors.

Figure 1
Figure 1. NxBFT components for normal operation (setup and recovery left [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Common case communication patterns of TEE-Rider [11], Narwhal [10] and NxBFT (this work). Blue vertical lines delimit communication rounds, [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. End-to-end-latency of Chained-Damysus (dotted lines) and NxBFT [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Investigation of the NXB client latency penalty: end-to-end-latency of MinBFT, Chained-Damysus, and NxBFT for n = 10 and request rates between 50 kOp/s and 800 kOp/s using NXB (solid lines) and BFT (dotted lines) clients; each data point shown is an average of eight ru…
Figure 5
Figure 5. Figure 5: End-to-end-latency of MinBFT, Chained-Damysus, and NxBFT for [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Counter example for the get core property with n = 5 and a wave length of three rounds. All blue vertices (vertices of round 3) should have a path to a shared subset of round 1 (red and green vertices) of size 3. The maximum shared subset, however, is of size 2 (green …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 28 canonical work pages

  1. [1]

    Implementing fault-tolerant services using the state machine approach: A tutorial,

    F. B. Schneider, “Implementing fault-tolerant services using the state machine approach: A tutorial,” ACM Comput. Surv. , vol. 22, no. 4, pp. 299–319, 1990. [Online]. Available: https://doi.org/10.1145/98163. 98167

    work page doi:10.1145/98163 1990

  2. [2]

    Blockchain technology as a mechanism for digital railway ticketing,

    J. D. Preece and J. M. Easton, “Blockchain technology as a mechanism for digital railway ticketing,” in 2019 IEEE International Conference on Big Data (IEEE BigData), Los Angeles, CA, USA, December 9-12, 2019 , 2019, pp. 3599–3606. [Online]. Available: https://doi.org/10.1109/BigData47090.2019.9006293

    arXiv 2019

  3. [3]

    Leveraging Distributed Ledger Technology for Decentralized Mobility- as-a-Service Ticket Systems,

    M. Leinweber, N. Kannengießer, H. Hartenstein, and A. Sunyaev, “Leveraging Distributed Ledger Technology for Decentralized Mobility- as-a-Service Ticket Systems,” in Towards the New Normal in Mobility: Technische und betriebswirtschaftliche Aspekte . Springer Fachmedien Wiesbaden, 2023, pp. 547–567. [Online]. Available: https://doi.org/10.1007/978-3-658-3...

    work page doi:10.1007/978-3-658-39438-7 2023

  4. [4]

    Blockchain for future smart grid: A comprehensive survey,

    M. B. Mollah, J. Zhao, D. Niyato, K. Lam, X. Zhang, A. M. Y . M. Ghias, L. H. Koh, and L. Yang, “Blockchain for future smart grid: A comprehensive survey,”IEEE Internet Things J., vol. 8, no. 1, pp. 18–43,

    work page

  5. [5]

    Chapter 22: Digital currencies, decentralized ledgers and the future of central banking,

    M. Raskin and D. Yermack, “Chapter 22: Digital currencies, decentralized ledgers and the future of central banking,” in Research Handbook on Central Banking . Edward Elgar Publishing, 2018. [Online]. Available: https://doi.org/10.4337/9781784719227

    work page doi:10.4337/9781784719227 2018

  6. [6]

    Central bank digital currency research around the world: a review of literature,

    P. K. Ozili, “Central bank digital currency research around the world: a review of literature,” Journal of Money Laundering Control, vol. 26, no. 2, pp. 215–226, 2023. [Online]. Available: https://doi.org/10.1108/jmlc-11-2021-0126

    work page doi:10.1108/jmlc-11-2021-0126 2023

  7. [7]

    Hybrids on steroids: SGX-based high performance BFT,

    J. Behl, T. Distler, and R. Kapitza, “Hybrids on steroids: SGX-based high performance BFT,” in Proceedings of the Twelfth European Conference on Computer Systems, EuroSys 2017, Belgrade, Serbia, April 23-26, 2017 . ACM, 2017, pp. 222–237. [Online]. Available: https://doi.org/10.1145/3064176.3064213

    work page arXiv 2017

  8. [8]

    ENGRAFT: enclave-guarded Raft on Byzantine faulty nodes,

    W. Wang, S. Deng, J. Niu, M. K. Reiter, and Y . Zhang, “ENGRAFT: enclave-guarded Raft on Byzantine faulty nodes,” in Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security, CCS 2022, Los Angeles, CA, USA, November 7-11, 2022 . ACM, 2022, pp. 2841–2855. [Online]. Available: https://doi.org/10.1145/3548606.3560639

    arXiv 2022

Show all 57 references
  1. [9]

    Oneshot: View-adapting streamlined BFT protocols with trusted execution environments,

    J. Decouchant, D. Kozhaya, V . Rahli, and J. Yu, “Oneshot: View-adapting streamlined BFT protocols with trusted execution environments,” in IEEE International Parallel and Distributed Processing Symposium, IPDPS 2024, San Francisco, CA, USA, May 27-31, 2024 . IEEE, 2024, pp. 1...

    2024

  2. [11]

    Brief announcement: Let it TEE: asynchronous Byzantine atomic broadcast with n ≥ 2f+1,

    M. Leinweber and H. Hartenstein, “Brief announcement: Let it TEE: asynchronous Byzantine atomic broadcast with n ≥ 2f+1,” in 37th International Symposium on Distributed Computing, DISC 2023, October 10-12, 2023, L’Aquila, Italy , ser. LIPIcs, vol. 281. Schloss Dagstuhl - Leibn...

    2023 doi

  3. [12]

    All you need is DAG,

    I. Keidar, E. Kokoris-Kogias, O. Naor, and A. Spiegelman, “All you need is DAG,” in PODC ’21: ACM Symposium on Principles of Distributed Computing, Virtual Event, Italy, July 26-30, 2021 . ACM, 2021, pp. 165–175. [Online]. Available: https://doi.org/10.1145/3465084.3467905

    2021

  4. [13]

    DAMYSUS: streamlined BFT consensus leveraging trusted components,

    J. Decouchant, D. Kozhaya, V . Rahli, and J. Yu, “DAMYSUS: streamlined BFT consensus leveraging trusted components,” in EuroSys ’22: Seventeenth European Conference on Computer Systems, Rennes, France, April 5 - 8, 2022 . ACM, 2022, pp. 1–16. [Online]. Available: https://doi.o...

    2022

  5. [14]

    Efficient Byzantine fault-tolerance,

    G. S. Veronese, M. Correia, A. N. Bessani, L. C. Lung, and P. Ver ´ıssimo, “Efficient Byzantine fault-tolerance,” IEEE Trans. Computers, vol. 62, no. 1, pp. 16–30, 2011. [Online]. Available: https://doi.org/10.1109/TC.2011.221

    2011 doi

  6. [15]

    Practical Byzantine fault tolerance and proactive recovery,

    M. Castro and B. Liskov, “Practical Byzantine fault tolerance and proactive recovery,” ACM Trans. Comput. Syst., vol. 20, no. 4, pp. 398– 461, 2002. [Online]. Available: https://doi.org/10.1145/571637.571640

    2002

  7. [16]

    How to tolerate half less one Byzantine nodes in practical distributed systems,

    M. Correia, N. F. Neves, and P. Ver ´ıssimo, “How to tolerate half less one Byzantine nodes in practical distributed systems,” in 23rd International Symposium on Reliable Distributed Systems (SRDS 2004), 18-20 October 2004, Florianpolis, Brazil . IEEE Computer Society, 2004, p...

    2004 arXiv

  8. [17]

    Attested append-only memory: making adversaries stick to their word,

    B. Chun, P. Maniatis, S. Shenker, and J. Kubiatowicz, “Attested append-only memory: making adversaries stick to their word,” in Proceedings of the 21st ACM Symposium on Operating Systems Principles 2007, SOSP 2007, Stevenson, Washington, USA, October 14-17, 2007 . ACM, 2007, p...

    2007

  9. [18]

    Asynchronous Byzantine consensus with 2f+1 processes,

    M. Correia, G. S. Veronese, and L. C. Lung, “Asynchronous Byzantine consensus with 2f+1 processes,” in Proceedings of the 2010 ACM Symposium on Applied Computing (SAC), Sierre, Switzerland, March 22-26, 2010 . ACM, 2010, pp. 475–480. [Online]. Available: https://doi.org/10.114...

    2010

  10. [19]

    On the (limited) power of non-equivocation,

    A. Clement, F. Junqueira, A. Kate, and R. Rodrigues, “On the (limited) power of non-equivocation,” in ACM Symposium on Principles of Distributed Computing, PODC ’12, Funchal, Madeira, Portugal, July 16-18, 2012 . ACM, 2012, pp. 301–308. [Online]. Available: https://doi.org/10....

    2012

  11. [20]

    On the subject of non-equivocation: Defining non-equivocation in synchronous agreement systems,

    M. F. Madsen and S. Debois, “On the subject of non-equivocation: Defining non-equivocation in synchronous agreement systems,” in PODC ’20: ACM Symposium on Principles of Distributed Computing, Virtual Event, Italy, August 3-7, 2020 . ACM, 2020, pp. 159–168. [Online]. Available...

    2020

  12. [21]

    Intel SGX explained,

    V . Costan and S. Devadas, “Intel SGX explained,” IACR Cryptol. ePrint Arch., p. 86, 2016. [Online]. Available: http://eprint.iacr.org/2016/086

    2016

  13. [22]

    TrInc: Small trusted hardware for large distributed systems,

    D. Levin, J. R. Douceur, J. R. Lorch, and T. Moscibroda, “TrInc: Small trusted hardware for large distributed systems,” in Proceedings of the 6th USENIX Symposium on Networked Systems Design and Implementation, NSDI 2009, April 22-24, 2009, Boston, MA, USA. USENIX Association,...

    2009

  14. [23]

    Scalable Byzantine consensus via hardware-assisted secret sharing,

    J. Liu, W. Li, G. O. Karame, and N. Asokan, “Scalable Byzantine consensus via hardware-assisted secret sharing,” IEEE Trans. Computers , vol. 68, no. 1, pp. 139–151, 2019. [Online]. Available: https://doi.org/10.1109/TC.2018.2860009

    2019

  15. [24]

    Teegraph: A blockchain consensus algorithm based on TEE and DAG for data sharing in IoT,

    X. Fu, H. Wang, P. Shi, and X. Zhang, “Teegraph: A blockchain consensus algorithm based on TEE and DAG for data sharing in IoT,” J. Syst. Archit. , vol. 122, p. 102344, 2022. [Online]. Available: https://doi.org/10.1016/j.sysarc.2021.102344

    2022

  16. [25]

    Fides: Scalable censorship-resistant DAG consensus via trusted components,

    S. Xie, D. Kang, H. Lyu, J. Niu, and M. Sadoghi, “Fides: Scalable censorship-resistant DAG consensus via trusted components,” CoRR, vol. abs/2501.01062, 2025. [Online]. Available: https://doi.org/10. 48550/arXiv.2501.01062

    2025 doi arXiv

  17. [26]

    uBFT: Microsecond-scale BFT using disaggregated memory,

    M. K. Aguilera, N. Ben-David, R. Guerraoui, A. Murat, A. Xygkis, and I. Zablotchi, “uBFT: Microsecond-scale BFT using disaggregated memory,” in Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume...

    2023

  18. [27]

    Dissecting BFT consensus: In trusted components we trust!

    S. Gupta, S. Rahnama, S. Pandey, N. Crooks, and M. Sadoghi, “Dissecting BFT consensus: In trusted components we trust!” in Proceedings of the Eighteenth European Conference on Computer Systems, EuroSys 2023, Rome, Italy, May 8-12, 2023 . ACM, 2023, pp. 521–539. [Online]. Avail...

    2023

  19. [28]

    Vivisecting the dissection: On the role of trusted components in BFT protocols,

    A. Bessani, M. Correia, T. Distler, R. Kapitza, P. E. Ver ´ıssimo, and J. Yu, “Vivisecting the dissection: On the role of trusted components in BFT protocols,” CoRR, vol. abs/2312.05714, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2312.05714

    2023 doi arXiv

  20. [29]

    The honey badger of BFT protocols,

    A. Miller, Y . Xia, K. Croman, E. Shi, and D. Song, “The honey badger of BFT protocols,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, Vienna, 11 Austria, October 24-28, 2016 . ACM, 2016, pp. 31–42. [Online]. Available: https://doi.o...

    2016

  21. [30]

    The hashgraph protocol: Efficient asynchronous BFT for high-throughput distributed ledgers,

    L. Baird and A. Luykx, “The hashgraph protocol: Efficient asynchronous BFT for high-throughput distributed ledgers,” in 2020 International Conference on Omni-layer Intelligent Systems, COINS 2020, Barcelona, Spain, August 31 - September 2, 2020 . IEEE, 2020, pp. 1–7. [Online]....

    2020

  22. [31]

    On quorum sizes in DAG-based BFT protocols,

    R. Ladelsky and R. Friedman, “On quorum sizes in DAG-based BFT protocols,” CoRR, vol. abs/2504.08048, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2504.08048

    2025 doi arXiv

  23. [32]

    Communication-efficient BFT using small trusted hardware to tolerate minority corruption,

    S. Yandamuri, I. Abraham, K. Nayak, and M. K. Reiter, “Communication-efficient BFT using small trusted hardware to tolerate minority corruption,” in 26th International Conference on Principles of Distributed Systems, OPODIS 2022, December 13-15, 2022, Brussels, Belgium , ser. ...

    2022 doi

  24. [33]

    Byzantine fault-tolerant state-machine replication from a systems perspective,

    T. Distler, “Byzantine fault-tolerant state-machine replication from a systems perspective,” ACM Comput. Surv. , vol. 54, no. 1, pp. 24:1–24:38, 2021. [Online]. Available: https://doi.org/10.1145/3436728

    2021 doi

  25. [34]

    Confidential consortium framework: Secure multiparty applications with confidentiality, integrity, and high availability,

    H. Howard, F. Alder, E. Ashton, A. Chamayou, S. Clebsch, M. Costa, A. Delignat-Lavaud, C. Fournet, A. Jeffery, M. Kerner, F. Kounelis, M. A. Kuppe, J. Maffre, M. Russinovich, and C. M. Wintersteiger, “Confidential consortium framework: Secure multiparty applications with confi...

    2023

  26. [35]

    Achilles: Efficient TEE-assisted BFT consensus via rollback resilient recovery,

    J. Niu, X. Wen, G. Wu, S. Liu, J. Yu, and Y . Zhang, “Achilles: Efficient TEE-assisted BFT consensus via rollback resilient recovery,” in Proceedings of the Twentieth European Conference on Computer Systems. ACM, 2025, pp. 193–210. [Online]. Available: https: //doi.org/10.1145...

    2025

  27. [36]

    Cachin, R

    C. Cachin, R. Guerraoui, and L. E. T. Rodrigues, Introduction to Reliable and Secure Distributed Programming , 2nd ed. Springer,

  28. [37]

    Reaching agreement in the presence of faults,

    M. C. Pease, R. E. Shostak, and L. Lamport, “Reaching agreement in the presence of faults,” J. ACM , vol. 27, no. 2, pp. 228–234, 1980. [Online]. Available: https://doi.org/10.1145/322186.322188

    1980

  29. [38]

    Impossibility of distributed consensus with one faulty process,

    M. J. Fischer, N. A. Lynch, and M. Paterson, “Impossibility of distributed consensus with one faulty process,” in Proceedings of the Second ACM SIGACT-SIGMOD Symposium on Principles of Database Systems, March 21-23, 1983, Colony Square Hotel, Atlanta, Georgia, USA . ACM, 1983,...

    1983

  30. [39]

    Another advantage of free choice: Completely asynchronous agreement protocols (extended abstract),

    M. Ben-Or, “Another advantage of free choice: Completely asynchronous agreement protocols (extended abstract),” in Proceedings of the Second Annual ACM Symposium on Principles of Distributed Computing, Montreal, Quebec, Canada, August 17- 19, 1983 . ACM, 1983, pp. 27–30. [Onli...

    1983

  31. [40]

    Threshold signatures, multisignatures and blind signatures based on the Gap-Diffie-Hellman-Group signature scheme,

    A. Boldyreva, “Threshold signatures, multisignatures and blind signatures based on the Gap-Diffie-Hellman-Group signature scheme,” in Public Key Cryptography - PKC 2003, 6th International Workshop on Theory and Practice in Public Key Cryptography, Miami, FL, USA, January 6-8, ...

    2003 doi

  32. [41]

    Thetacrypt: A distributed service for threshold cryptography,

    M. Barbaraci, N. Schmid, O. Alpos, M. Senn, and C. Cachin, “Thetacrypt: A distributed service for threshold cryptography,” CoRR, vol. abs/2502.03247, 2025. [Online]. Available: https://doi.org/10. 48550/arXiv.2502.03247

    2025 doi arXiv

  33. [42]

    ABCperf: Performance evaluation of fault tolerant state machine replication made simple: Demo abstract,

    T. Spannagel, M. Leinweber, A. Castro, and H. Hartenstein, “ABCperf: Performance evaluation of fault tolerant state machine replication made simple: Demo abstract,” in Proceedings of the 24th International Middleware Conference Demos, Posters and Doctoral Symposium . ACM, 2023...

    2023

  34. [43]

    Foreshadow: Extracting the keys to the intel SGX kingdom with transient out-of-order execution,

    J. V . Bulck, M. Minkin, O. Weisse, D. Genkin, B. Kasikci, F. Piessens, M. Silberstein, T. F. Wenisch, Y . Yarom, and R. Strackx, “Foreshadow: Extracting the keys to the intel SGX kingdom with transient out-of-order execution,” in 27th USENIX Security Symposium, USENIX Securit...

    2018

  35. [44]

    Decouchant, D

    J. Decouchant, D. Kozhaya, V . Rahli, and J. Yu. (2022) DAMYSUS: streamlined BFT consensus leveraging trusted components (extended version). [Online]. Available: https://github.com/vrahli/damysus/blob/ main/doc/damysus-extended.pdf

    2022

  36. [45]

    Enabling parallel voting in streamlined consensus protocols,

    A. Einarsd ´ottir, “Enabling parallel voting in streamlined consensus protocols,” Master’s thesis, Delft University of Technology, 2024. [Online]. Available: https://resolver.tudelft.nl/uuid: 8b40ec25-155e-4c92-b746-290baacab577

    2024

  37. [46]

    Malkhi and O

    D. Malkhi and O. Naor. (2022) The latest view on view synchronization. [Online]. Available: https://blog.chain.link/view-synchronization/

    2022

  38. [47]

    Consensus-agnostic state- machine replication,

    A. Heß, F. J. Hauck, and E. Meißner, “Consensus-agnostic state- machine replication,” in Proceedings of the 25th International Middleware Conference . ACM, 2024, p. 13. [Online]. Available: https://doi.org/10.1145/3652892.3700776

    2024

  39. [48]

    BBCA-CHAIN: one- message, low latency BFT consensus on a DAG,

    D. Malkhi, C. Stathakopoulou, and M. Yin, “BBCA-CHAIN: one- message, low latency BFT consensus on a DAG,” in Financial Cryptography and Data Security , 2025, pp. 51–73. [Online]. Available: https://doi.org/10.1007/978-3-031-78676-1 4

    2025 doi

  40. [49]

    Sailfish: Towards improving latency of DAG-based BFT,

    N. Shrestha, R. Shrothrium, A. Kate, and K. Nayak, “Sailfish: Towards improving latency of DAG-based BFT,” in 2025 IEEE Symposium on Security and Privacy (SP) , 2025. [Online]. Available: https://doi.org/10.1109/SP61157.2025.00021

    2025

  41. [50]

    Autobahn: Seamless high speed BFT,

    N. Giridharan, F. Suri-Payer, I. Abraham, L. Alvisi, and N. Crooks, “Autobahn: Seamless high speed BFT,” in Proceedings of the ACM SIGOPS 30th Symposium on Operating Systems Principles, SOSP 2024, Austin, TX, USA, November 4-6, 2024 . ACM, 2024, pp. 1–23. [Online]. Available: ...

    2024

  42. [51]

    Shoal++: High throughput DAG BFT can be fast and robust!

    B. Arun, Z. Li, F. Suri-Payer, S. Das, and A. Spiegelman, “Shoal++: High throughput DAG BFT can be fast and robust!” in 22nd USENIX Symposium on Networked Systems Design and Implementation (NSDI 25) , 2025, pp. 813–826. [Online]. Available: https://www.usenix.org/conference/ns...

    2025

  43. [52]

    Bandle: Asynchronous state machine replication made efficient,

    B. Wang, S. Liu, H. Dong, X. Wang, W. Xu, J. Zhang, P. Zhong, and Y . Zhang, “Bandle: Asynchronous state machine replication made efficient,” in Proceedings of the Nineteenth European Conference on Computer Systems, EuroSys 2024, Athens, Greece, April 22-25, 2024 . ACM, 2024, ...

    2024

  44. [53]

    Attiya and J

    H. Attiya and J. L. Welch, Distributed Computing - Fundamentals, Simulations, and Advanced Topics , 2nd ed., ser. Wiley series on parallel and distributed computing. Wiley, 2004. [Online]. Available: https://doi.org/10.1002/0471478210 APPENDIX A. Correctness Arguments

    2004 doi

  45. [56]

    IV-A3 transforms the best effort broadcast to a reliable broadcast

    Backfilling-Based Reliable Broadcast: In the following, we will argue that the backfilling mechanism as described in Sec. IV-A3 transforms the best effort broadcast to a reliable broadcast. Since we use the signature service to implement a FIFO broadcast with non-equivocation,...

  46. [57]

    The enclave will not reveal a toss unless at least one correct replica requests a toss

    Common Coin: The XOR construction is a variant of the straightforward t = n secret sharing; the resulting seed is kept confidential by secure communication and the TEE. The enclave will not reveal a toss unless at least one correct replica requests a toss. A correct replica wi...

  47. [58]

    connectivity guarantees

    Recovery Protocol: Obviously, the proposed recovery protocol is only live if all replicas are eventually reactive: Byzantine faulty replicas can stop the recovery procedure by not sending a RecoveryProposal at any time (or an in- valid one). In the following, we will argue tha...

  48. [2011]

    Available: https://doi.org/10.1007/978-3-642-15260-3

    [Online]. Available: https://doi.org/10.1007/978-3-642-15260-3

    doi

  49. [2021]

    Available: https://doi.org/10.1109/JIOT.2020.2993601

    [Online]. Available: https://doi.org/10.1109/JIOT.2020.2993601

    2020

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.