SCP Safety Guarantee Question

Question

I have a question regarding the Stellar Consensus Protocol. In the SCP whitepaper it is stated on page 14 under the point 5.4 "Accepting is not enough": "But as discussed in Section 4.1, the only condition necessary to guarantee safety is quorum intersection of well-behaved nodes, which might hold even in the case that some well- behaved nodes are befouled."

I understand that a quorum intersection of befouled nodes would hurt safety but how can a node be befouled given the safety guarantee on page 9 under point 4.1 "Quorum intersection": "This is why the necessary property for safety—quorum intersection of well-behaved nodes after deleting ill-behaved nodes—is unaffected by the slices of ill-behaved nodes." ? A node can only be befouled if there exists an ill-behaved node befouling the node. If you delete all ill-behaved nodes how can there still be befouled nodes? In the SCP talk by David Mazières (https://www.youtube.com/watch?v=vmwnhZmEZjc) at 42:17 you can also hear him saying that after deleting all ill-behaved nodes two quorums which still enjoy quorum intersection would never accept contradictory statements. This also implies the same to me that no befouled nodes would exist given the safety guarantee.

If I understood it wrong and two quorums intersecting with each other despite ill-behaved nodes doesn't exclude the possibility that a quorum still can include ill-behaved nodes I wouldn't understand how a quorum could accept a statement if it would include ill-behaved nodes. Because for a quorum to accept a statement every member of it has to accept it. With an ill-behaved node in a quorum it could prevent a quorum from accepting it.

I'm a bit lost here because I don't understand which part I have not understood. It is clearly a misconception that I have but can't identify. Any help would highly appreciated since it's for my bachelor thesis.

Answer 1

A node can only be befouled if there exists an ill-behaved node befouling the node.

This is only true if you have nominal quorum intersection. That's why so many of the theorems say "assume an FBAS with quorum intersection." More recent expositions of the protocol such as the recent SOSP paper get around this problem by defining a quorum as a set containing a quorum slice for each well-behaved node. It's a bit weird to define quorums based on which nodes are faulty, but maybe more intuitive than requiring "nominal" quorum intersection based on slices announced by malicious nodes.

Either way, the point is that whatever quorum slices malicious nodes advertise does not affect the necessary property for any FBA protocol to guarantee safety.

If you delete all ill-behaved nodes how can there still be befouled nodes?

After deleting the ill-behaved nodes, you might no longer have quorum intersection. Or, the complement of the DSet might not be a quorum. In Figure 7, for instance, node v7 befouls all the other nodes.