Optimal Synchronous Approximate Agreement with Asynchronous Fallback

Approximate Agreement (AA) allows a set of n parties that start with real-valued inputs to obtain values that are at most within a parameter epsilon > 0 from each other and within the range of their inputs. Existing AA protocols, both for the synchronous network model (where any message is delivered within a known delay Delta time) and the asynchronous network model, are secure when up to t < n/3 of the parties are corrupted and require no initial setup (such as a public-key infrastructure (PKI) for signatures). We consider AA protocols where a PKI is available, and show the first AA protocol that achieves simultaneously security against t(s) corruptions when the network is synchronous and t(a) corruptions when the network is asynchronous, for any 0 <= t(a) < n/3 <= t(s) < n/2 such that t(a) + 2 center dot t(s) < n. We further show that our protocol is optimal by proving that achieving AA for t(a) +2 center dot t(s) >= n is impossible (even with setup). Remarkably, this is also the first AA protocol that tolerates more than n/3 corruptions in the synchronous network model.