Why Byzantine Fault Tolerance Needs an Extra Node
Your Raft-based configuration store tolerates 1 crashed node using a cluster of 3 (majority quorum, N = 2f+1 for f=1). A separate team is building a multi-party settlement ledger where the participating nodes are run by different companies — one of them might not just crash, but could actively send conflicting or false messages to different peers (a Byzantine fault, not a crash fault).
To tolerate f=1 Byzantine (actively malicious or arbitrarily faulty) node using a classic BFT protocol like PBFT, how many total nodes are required?
4 nodes — Byzantine tolerance needs N ≥ 3f+1.
Raft/Paxos-style crash-fault tolerance only has to survive nodes going silent — a crashed node simply stops responding, and the protocol just needs any majority of the remaining nodes to agree. With N = 2f+1, any two quorums of size \lceil (N+1)/2 \rceil are guaranteed to overlap in at least one node, and that one honest, simply-slow-or-silent node is enough to carry forward whatever the previous quorum decided — it cannot lie about what it saw.
A Byzantine node can actively lie — telling different peers different things, or claiming to have voted for two conflicting values. Now a quorum's overlap node isn't automatically trustworthy: if that overlapping node happens to be the faulty one, it could tell one quorum "commit A" and another "commit B," breaking safety. To guarantee that any two quorums overlap in at least one honest node even in the worst case where the f faulty nodes are exactly the ones trying to cause a conflict, you need enough surplus honest nodes to outvote them in every possible quorum: N \geq 3f+1. For f=1 that's N=4 — a quorum of 2f+1=3 out of 4 nodes, so any two quorums of 3 out of 4 must share at least 2 nodes, and since at most 1 is faulty, at least 1 of the shared nodes is honest and consistent.
Concretely: with only N=3f=3 nodes and 1 Byzantine node, that one bad node can be in every quorum (since a quorum of 2f+1=3 out of 3 nodes is literally all of them), and it can tell the two honest nodes different things while itself appearing to agree with both — there's no way to isolate it. The extra node in 3f+1 is exactly what guarantees at least 2f+1 honest nodes always outnumber the f faulty ones within any quorum, which is the property PBFT-style protocols depend on for both safety and liveness.
Share this question