A Rigorous Correctness Proof for Pastry

  • Noran AzmyEmail author
  • Stephan Merz
  • Christoph Weidenbach
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9675)


Peer-to-peer protocols for maintaining distributed hash tables, such as Pastry or Chord, have become popular for a class of Internet applications. While such protocols promise certain properties concerning correctness and performance, verification attempts using formal methods invariably discover border cases that violate some of those guarantees. Tianxiang Lu reported correctness problems in published versions of Pastry and also developed a model, which he called LuPastry, for which he provided a partial proof of correct delivery assuming no node departures, mechanized in the TLA\(^+\) Proof System. Lu’s proof is based on certain assumptions that were left unproven. We found counter-examples to several of these assumptions. In this paper, we present a revised model and rigorous proof of correct delivery, which we call LuPastry\(^+\). Aside from being the first complete proof, LuPastry\(^+\) also improves upon Lu’s work by reformulating parts of the specification in such a way that the reasoning complexity is confined to a small part of the proof.


  1. 1.
  2. 2.
    Bakhshi, R., Gurov, D.: Verification of peer-to-peer algorithms: a case study. Electron. Notes Theor. Comput. Sci. 181, 35–47 (2007)CrossRefGoogle Scholar
  3. 3.
    Borgström, J., Nestmann, U., Onana, L., Gurov, D.: Verifying a structured peer-to-peer overlay network: the static case. In: Priami, C., Quaglia, P. (eds.) GC 2004. LNCS, vol. 3267, pp. 250–265. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  4. 4.
    Cousineau, D., Doligez, D., Lamport, L., Merz, S., Ricketts, D., Vanzetto, H.: TLA\(^{+}\) proofs. In: Méry, D., Giannakopoulou, D. (eds.) FM 2012. LNCS, vol. 7436, pp. 147–154. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  5. 5.
    Lamport, L.: Specifying Systems: The TLA\(^+\) Language and Tools for Hardware and Software Engineers. Addison-Wesley, Boston (2002)Google Scholar
  6. 6.
    Lu, T.: Formal verification of the pastry protocol using TLA\(^+\). In: Li, X., Liu, Z., Yi, W. (eds.) SETTA 2015. LNCS, vol. 9409, pp. 284–299. Springer, Heidelberg (2015). doi: 10.1007/978-3-319-25942-0_19 CrossRefGoogle Scholar
  7. 7.
    Rowstron, A., Druschel, P.: Pastry: scalable, decentralized object location, and routing for large-scale peer-to-peer systems. In: Guerraoui, R. (ed.) Middleware 2001. LNCS, vol. 2218, pp. 329–350. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  8. 8.
    Stoica, I., Morris, R., Karger, D., Kaashoek, M.F., Balakrishnan, H.: Chord: a Scalable Peer-to-peer lookup service for internet applications. In: SIGCOMM 2001, pp. 149–160. ACM (2001)Google Scholar
  9. 9.
    Yu, Y., Manolios, P., Lamport, L.: Model checking TLA\(^+\) specifications. In: Pierre, L., Kropf, T. (eds.) CHARME 1999. LNCS, vol. 1703, pp. 54–66. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  10. 10.
    Zave, P.: Using lightweight modeling to understand chord. ACM SIGCOMM Comput. Commun. Rev. 42(2), 49–57 (2012)CrossRefGoogle Scholar
  11. 11.
    Zave, P.: How to Make Chord Correct (Using a Stable Base). CoRR abs/1502.06461 (2015)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2016

Authors and Affiliations

  • Noran Azmy
    • 1
    • 2
    • 3
    Email author
  • Stephan Merz
    • 2
    • 3
  • Christoph Weidenbach
    • 1
  1. 1.Max Planck Institute for InformaticsSaarbrückenGermany
  2. 2.InriaVillers-lès-NancyFrance
  3. 3.CNRS, Université de Lorraine, LORIA, UMR 7503Vandoeuvre-lès-NancyFrance

Personalised recommendations