LibraryConsensus2016Design paperCorpus record
The Honey Badger of BFT Protocols
HoneyBadgerBFT. Andrew Miller, Yu Xia, Kyle Croman, Elaine Shi and Dawn Song.
An asynchronous atomic broadcast. It does not wait for a timeout to make progress, and threshold encryption stops a leader from reading a batch and then dropping the transactions it dislikes.
HoneyBadgerBFT agrees on a batch of transactions with no timing assumption for progress. Threshold encryption hides the batch until it is chosen, so a replica cannot read a transaction and then vote it out.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 2
Code
Source, repository, and what is actually hosted
- ePrint 2016/199https://eprint.iacr.org/2016/199
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
Asynchrony is the model
Messages can be delayed arbitrarily. A protocol that waits out a timeout and then blames a leader is not this one. HoneyBadger is built so a slow link does not look like an attack.
Claim 02 · Paper model
No leader to bribe
Every replica proposes a batch. A common subset is agreed. Silencing one replica drops its batch. It does not let that replica pick the whole order.
Claim 03 · Paper model
Encrypt, then agree, then decrypt
The agreement runs on ciphertext. After the set is fixed, a threshold of keys reveals the contents. Censorship by content would require predicting the plaintext.
Claim 04 · Paper model
The cost is rounds and cryptography
Reliable broadcast plus binary agreement is heavier than a HotStuff happy path. The paper treats that as the price of not having a clock.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 Asynchrony is the model
Observation
What the study says
Messages can be delayed arbitrarily. A protocol that waits out a timeout and then blames a leader is not this one. HoneyBadger is built so a slow link does not look like an attack.
Model
What has to hold
Fewer than one third of replicas are Byzantine. Asynchrony does not relax that.
Falsifier
What would retire it
Does liveness depend on a timeout?
02 No leader to bribe
Observation
What the study says
Every replica proposes a batch. A common subset is agreed. Silencing one replica drops its batch. It does not let that replica pick the whole order.
Model
What has to hold
Threshold encryption is correctly shared. A dealer who keeps the full key can read batches early.
Falsifier
What would retire it
Are transactions encrypted until the batch is chosen?
03 Encrypt, then agree, then decrypt
Observation
What the study says
The agreement runs on ciphertext. After the set is fixed, a threshold of keys reveals the contents. Censorship by content would require predicting the plaintext.
Model
What has to hold
Threshold encryption is correctly shared. A dealer who keeps the full key can read batches early.
Falsifier
What would retire it
Who holds the threshold key, and how is it dealt?
04 The cost is rounds and cryptography
Observation
What the study says
Reliable broadcast plus binary agreement is heavier than a HotStuff happy path. The paper treats that as the price of not having a clock.
Model
What has to hold
The application can tolerate the latency of several cryptographic rounds.
Falsifier
What would retire it
What is the delivered order once plaintexts are known?
03 Sequence
One action, as an operating tape
- 01Each replica takes a batch of pending transactions and threshold-encrypts it.
- 02Replicas run reliable broadcast so honest batches cannot be shown to only some peers.
- 03A binary agreement decides, for each batch, whether it is in this round's common set.
- 04Once the set is fixed, replicas produce decryption shares.
- 05The union of the decrypted batches is the delivered block, in a deterministic order.
04 Load-bearing
The argument, and where a pitch drops it
Censorship resistance here is specific
The cut
It is resistance to dropping a transaction because of what it says, inside a round. It is not resistance to a quorum that refuses to include a given replica at all, and it is not privacy against the public ledger after decryption.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A later client, parameter or reward formula is a different object from this paragraph.
Timeouts are the thing that was removed
The cut
If a design has a view-change timer as its liveness engine, it is in the partially synchronous family. HoneyBadger is the reference for the other choice, and for why that choice is expensive.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
A later client, parameter or reward formula is a different object from this paragraph.
05 Register
What has to be true
Stake and threshold · Not re-measured
Fewer than one third of replicas are Byzantine. Asynchrony does not relax that.
Stake and threshold · Not re-measured
Threshold encryption is correctly shared. A dealer who keeps the full key can read batches early.
Network · Not re-measured
The network eventually delivers honest messages. Asynchronous means no bound, not no delivery.
Cryptography · Not re-measured
The application can tolerate the latency of several cryptographic rounds.
06 Divergence
What happened after the paper
HoneyBadger remained a research and systems paper more than a public chain brand. Later asynchronous and DAG protocols cite it when they want progress without timeouts, then change the broadcast layer. A chain that advertises asynchronous BFT should be asked whether agreement sees plaintext.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
Partially synchronous BFT can stall for the length of a timeout when the network is merely slow. HoneyBadger treats asynchrony as the normal case, and treats censorship of known contents as the attack.
What the design proposes
- A common subset of each replica's proposed batch, built from reliable broadcast and a binary agreement.
- Threshold encryption so the agreement runs on ciphertext.
- Decryption only after the set is chosen, so dropping a transaction means dropping a whole unknown batch.
How the mechanism is specified
- There is no single leader whose silence stops the protocol.
- The cost is several rounds of cryptography and a higher latency than a happy-path HotStuff commit.
- Asynchrony removes the timing assumption. It does not remove the need for two-thirds honesty.
What this page does not treat as proven
- This is not a proof-of-work chain and not a production client you can download under this name.
- Threshold keys are their own ceremony. Losing the dealer story loses the censorship claim.
- High latency can be the correct trade. It is still a trade.
Why the desk still reads it
Use it when a design claims to be asynchronous. Ask whether agreement sees plaintext, and what happens if one replica simply never sends.
09 Lexicon
Terms, opened into the record
- Asynchronous
- No assumed bound on message delay. Progress must not depend on guessing one.
- Common subset
- A set of input batches that every honest replica agrees to deliver together.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
Concepts
Papers
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.