Archivedistributed-systems
Byzantine Fault Tolerance Has a Different Threat Model
Crash faults assume nodes stop. Byzantine faults assume they lie — and that changes the quorum math.
- Published
- Reading time
- 1 min read
Crash-fault-tolerant consensus tolerates f failures with 2f + 1 nodes. Byzantine fault tolerance, where nodes may send conflicting messages, needs 3f + 1 and more rounds.
Why 3f + 1
With n = 3f + 1, any two quorums of 2f + 1 overlap in at least f + 1 nodes, so at least one honest node is in the intersection. With fewer nodes, an attacker controlling f nodes can equivocate and split the network.
The cost
- More messages and signatures per decision.
- Cryptographic overhead for message authentication.
- Complexity that is hard to test; implementations have had serious bugs.
Where it is justified
Permissioned settings with strong identities and a real adversarial threat: consortium ledgers, critical infrastructure, some blockchain consensus (Tendermint, HotStuff). For a typical microservice cluster behind a firewall, crash-fault Raft is the right tool.
Takeaway: BFT is for adversaries, not for flaky hardware. If your threat model is "a node crashes", paying 3f + 1 buys nothing.