Proposal 165: Easy migration for voting authority sets

[Nick Mathewson]

On Thu, May 28, 2009 at 05:02:09PM -0400, Paul Syverson wrote:
> On Thu, May 28, 2009 at 04:23:57PM -0400, Nick Mathewson wrote:
> > On Thu, May 28, 2009 at 03:58:42PM -0400, Paul Syverson wrote:
> > > Hi Nick et al.,
> > > 
> > > Two things:
> > > 
> > > 1. I think you mean that an authority votes with whatever the largest
> > > set is that it lists that is listed by the most members of that set. 
> > > (I added "largest" to your criterion.)
> > > 
> > > I guess there is an ambiguity of 'most' but if you have a set and a
> > > proper subset, both of which are listed by all the members of each,
> > > then the ones in the smaller set have no basis to prefer the larger
> > > one and will never drop the smaller one. If by 'most' you implicitly
> > > mean biggest rather than largest fraction, it is confusing since
> > > it is no longer relative to the givne voting set but relative to
> > > others.
> > 
> > Okay, I'll try again.  What I meant is that, given two sets S1 and S2 that an
> > authority lists, that authority will prefer S1 over S2 whenever the
> > number of other authorities in S1 that themselves list S1 is higher
> > than the number of other authorities in S2 that themselves list S2.
> > 
> 
> Much clearer, at least to me.

Okay.  Next time I revise this proposal, I'll put it in.

[...]
> > Here you're missing the line that says
> > 
> >    Once enough authorities list the new set as acceptable, we start
> >    having authorities stop listing the old set.  Once there are more
> >    listing the new set than the old set, the new set will win.
> > 
> > In other words, once the operators notice that enough authorities are
> > listing the set-minus-Bob, they manually stop listing
> > sets-including-Bob.  Assuming that there are N authorities (including
> > Bob), once N-1 authorities list the set without Bob, we need just 2
> > authorities to drop the set including Bob and we'll be fine.
> > 
> 
> I didn't miss the line. My point is that you won't ever get
> any honest authorities to drop the set including Bob, so you will
> never make it to 2 without changing something in the protocol.
> if either of those two authorities drop the list that includes Bob,
> they will not be honest (following the proposed protocol), because
> they are supposed to prefer the voting set for which the number of
> authorities that list themselves in it is higher not just the
> one that is moving in the direction they would like to go.
> It's the criterion for delisting a set that does not work.

Oh!  Okay, no, I've explained the protocol wrong.

When I say that authorities prefer the more-approved set, that _only
applies to choosing who the voters are in a given round of voting_.
It doesn't apply to deciding which sets to list in a vote.

Deciding which sets to list is a manual decision made by the authority
operators.  My intent was that the operator of an honest is absolutely
allowed to de-list an obsolete but larger set.  Authority operators
need to coordinate their actions here out-of-band.

Did that clear it up?

peace,
-- 
Nick